# Privileged origin renders user content

User files rendered as markup on a privileged origin or host process without CSP or sanitization

_Area: Memory corruption and native code. Seen in 2 disclosed reports; one confirmed bounty: $10,000; latest 2023-11-14. Updated 2026-10-23._

## How it works
A privileged origin or host process is assumed to display only trusted first-party content. That assumption breaks when a legacy or auxiliary path serves user-controlled files as renderable markup on that same origin. The content then inherits the origin's authority: its scripts run with the origin's privileges, reach private APIs, or execute in a host process with native capabilities. The trust boundary is drawn around the origin, not the content, so anything the origin can do, the injected content can do.

## Where it shows up
- Legacy schemes (`filesystem:`, `blob:`) combined with `chrome://` or `chrome-extension://` origins [E1](https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md)
- Auxiliary views: print, PDF export, preview, not just the main editor [E3](https://bugbountylibrary.com/r/h1%3A358049.md)
- User files served as HTML/JS with no CSP or sanitization on a privileged origin [E1](https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md)[E3](https://bugbountylibrary.com/r/h1%3A358049.md)
- Renderer with Node integration exposed to rendered content in any view [E3](https://bugbountylibrary.com/r/h1%3A358049.md)
- Legacy script sinks inside signed host components reachable from unexpected file formats [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md)

## How to review
List every origin and process that renders user-supplied files. Confirm the invariant: user content must never execute with the privileges of the origin or host rendering it. Each such path must enforce a CSP or sanitization, or render in an unprivileged context. For Electron, confirm Node integration is off in every view that touches user content, including print and export. Separately, for file formats that carry script, confirm execution is gated in the shared parser, not per extension; that is an auth-gating property, distinct from origin inheritance [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md).

## Variants seen
- Legacy filesystem URL on `chrome://file-manager` inheriting Chrome origin and Mojo access [E1](https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md)
- Stored XSS in an Electron print view escalating via `process_wrap` spawn [E3](https://bugbountylibrary.com/r/h1%3A358049.md)
- Legacy XSS in a signed DLL reached via `res://` from an MSC StringTable, executing in the host process [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md)

## Why fixes fail
Sanitization applied per-view leaves auxiliary views like print and export open; the shared renderer remains the real boundary [E3](https://bugbountylibrary.com/r/h1%3A358049.md).

## Impact and severity
Led to file read/write and privileged API access [E1](https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md), and RCE in a host process [E3](https://bugbountylibrary.com/r/h1%3A358049.md); high severity, worsened by native bindings and Node integration in rendered views. [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md) is a related but distinct auth-gating weakness.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md
- E3: https://bugbountylibrary.com/r/h1%3A358049.md