# Discord Desktop - Remote Code Execution

Discord Desktop's Vimeo embed XSS plus a new-window sandbox escape and a V8 bug yielded remote code execution on the Electron client.

- Payout: unconfirmed
- Severity: critical
- Program: Discord
- Credited: s1r1us, ptr-yudai
- Disclosed: 2022-07-29
- Write-up quality: 8/10
- Original: https://blog.electrovolt.io/posts/discord-rce/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:critical tech:chromium tech:electron technique:chained technique:source-review vuln:rce vuln:sandbox-escape vuln:xss

**Target:** Electron desktop client (Discord embeds / Vimeo video embed)
**Root cause:** Discord's embed handling allowed a javascript: URL in a Vimeo og:video meta to execute script in the embed, and the new-window event handler let external sites open a window that, after a cross-origin redirect, ran without the Electron sandbox, exposing an old Chromium/V8 to a known exploit.
**Steps:**
1. Extract app source: `npx asar extract /Applications/Discord.app/Contents/Resources/app.asar ./` and note `sandbox` is unset in webPreferences, Electron 9.x / Chrome 83.
2. Craft an HTML page with `og:video:url` containing `javascript://...` payload and `og:video:type` text/html; paste link in Discord chat to trigger XSS in the Vimeo embed.
3. Bypass Vimeo CSP `default-src 'none'; script-src 'unsafe-inline'` by loading an external iframe via the old Chromium frame-src bypass.
4. Use the insufficient new-window event restriction to open the exploit in a new window, then redirect to a different origin to clear the sandbox.
5. Run the V8 exploit for crbug.com/1196683 in the unsandboxed renderer to pop calc / achieve RCE.
**How found:** Source-code audit of the extracted asar revealed nodeIntegration disabled and contextIsolation enabled but the sandbox flag missing, plus an outdated Chromium. After failing to find XSS in the React frontend, they focused on Discord embeds, found a Vimeo endpoint XSS, and a teammate noted the new-window restriction was insufficient; they observed that a cross-origin redirect cleared the sandbox.
**Exploitation:** Attacker posts a crafted link in Discord chat; the Vimeo embed renders attacker-controlled og:video metadata, executing javascript: in the embed. The embed opens a new window via the misconfigured new-window handler; a cross-origin redirect spawns an unsandboxed renderer, where a V8 exploit (crbug.com/1196683) achieves native code execution on the victim's machine.
**Escalation:** Chained embed XSS -> new-window sandbox escape -> V8 renderer exploit to escalate from script injection to full RCE.
**Insight:** When auditing Electron apps, check webPreferences for a missing `sandbox: true` even when nodeIntegration is off and contextIsolation is on; embed/preview renderers are a softer XSS target than the main React app, and a cross-origin redirect after window.open can move execution into an unsandboxed renderer.