# Disabling context isolation, nodeIntegrationInSubFrames using an unauthorised frame.

Electron's renderer-side check for nodeIntegrationInSubFrames/contextIsolation could be flipped by a renderer exploit, granting ipcRenderer access and possible RCE via privileged IPC handlers.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: s1r1u5
- Disclosed: 2022-08-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1647287
- Library page: https://bugbountylibrary.com/r/h1%3A1647287
- Tags: area:os domain:desktop impact:privesc impact:rce kind:bounty platform:hackerone sev:medium tech:electron technique:chained technique:source-review vuln:access-control vuln:sandbox-escape

**Target:** Electron renderer process / WebPreferences and preload contextBridge
**Root cause:** Electron enforces nodeIntegrationInSubFrames and contextIsolation checks inside the renderer process itself, so a compromised renderer can flip those flags to 1 and expose the preload contextBridge API.
**Steps:**
1. Obtain JS execution in a renderer (renderer exploit).
2. Modify the renderer-side WebPreferences flags `node_integration_sub_frames` and `context_isolation` to true/1.
3. Trigger creation of a new frame so the preload contextBridge API is exposed.
4. Access `ipcRenderer` from the new frame and send messages to main-process IPC handlers.
**How found:** Code reading of electron_sandboxed_renderer_client.cc revealed the node_integration_sub_frames/context_isolation check runs in the renderer process, implying a compromised renderer could flip the flag.
**Exploitation:** A renderer exploit flips the in-renderer flags, causing Electron to expose the preload contextBridge API to a new frame; the attacker then uses ipcRenderer to invoke privileged main-process IPC handlers lacking senderFrame validation, potentially reaching RCE.
**Escalation:** Chains renderer compromise to ipcRenderer access, then to privileged IPC handlers on main process for potential RCE.
**Insight:** When a security boundary check (like nodeIntegrationInSubFrames) is enforced in the same process it protects against, a renderer compromise can flip the flag; audit Electron apps for IPC handlers that trust messages without validating senderFrame.