# Webview context isolation and navigation gate gaps

Page JS sharing a realm with native code, or reaching privileged origins through missing navigation gates

_Area: Memory corruption and native code. Seen in 6 disclosed reports; 4 confirmed bounties, median $7,500, range $2,430-$150,000; latest 2024-06-22. Updated 2026-10-23._

## How it works
A webview or Electron window assumes page JavaScript and native/preload code live in separate worlds. Two boundaries enforce that: JS-realm isolation (`contextIsolation`) and navigation gating (`will-navigate`). When either is missing, the assumption breaks. With isolation off, page script shares the realm with privileged code and can override built-ins the native side later calls. With no gate, attacker content navigates into a privileged context and runs with the app's authority. The root cause is a missing boundary, not one bad line.

## Where it shows up
- `webPreferences` with `contextIsolation: false` or absent, even when `nodeIntegration: false` looks safe [E1](https://bugbountylibrary.com/r/blog%3Aspeakerdeck-com-masatokinugawa-how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own.md)[E3](https://bugbountylibrary.com/r/blog%3Amksben-l0-cm-2020-10-discord-desktop-rce-html.md)
- Preload/Node code calling overridable built-ins (`Function.prototype.call`, `RegExp.prototype.test`, `Buffer` methods) [E1](https://bugbountylibrary.com/r/blog%3Aspeakerdeck-com-masatokinugawa-how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own.md)[E3](https://bugbountylibrary.com/r/blog%3Amksben-l0-cm-2020-10-discord-desktop-rce-html.md)
- No `will-navigate` handler, or one that misses cross-origin top navigation started from an iframe [E3](https://bugbountylibrary.com/r/blog%3Amksben-l0-cm-2020-10-discord-desktop-rce-html.md)
- IPC handlers doing property access without `hasOwnProperty` [E1](https://bugbountylibrary.com/r/blog%3Aspeakerdeck-com-masatokinugawa-how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own.md)
- Privileged origins (`chrome://`, `chrome-extension://`) serving user files as active HTML with no CSP [E2](https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md)
- Boundary checks enforced in the same process they protect [E6](https://bugbountylibrary.com/r/h1%3A1647287.md)

## How to review
Extract `app.asar` and read `webPreferences` first. Grep for `contextIsolation`, `nodeIntegration`, `will-navigate`, `setWindowOpenHandler`, and `hasOwnProperty` in IPC code. The invariant: untrusted page content must never share a JS realm with, or reach, native APIs. Confirm `contextIsolation: true`; confirm the navigation gate covers iframe-initiated top navigation (test by embedding a cross-origin frame that navigates the top window); confirm IPC reads validate keys with `hasOwnProperty`. For privileged origins, confirm user files are never rendered as active HTML [E2](https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md). The transferable rule from E4: validate a value *after* the last user-replaceable conversion, never re-encode through overridable prototypes. False positive: isolation on, gate present and tested, and no overridable built-ins in the privileged path.

## Variants seen
- Prototype override leaking `ipcRenderer` via webpack require [E1](https://bugbountylibrary.com/r/blog%3Aspeakerdeck-com-masatokinugawa-how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own.md)
- Sanitizer class-wildcard XSS feeding AngularJS `ng-init` [E1](https://bugbountylibrary.com/r/blog%3Aspeakerdeck-com-masatokinugawa-how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own.md)
- `will-navigate` bypass via iframe cross-origin navigation [E3](https://bugbountylibrary.com/r/blog%3Amksben-l0-cm-2020-10-discord-desktop-rce-html.md)
- Post-sanitization re-encode through monkey-patched `Buffer` [E4](https://bugbountylibrary.com/r/h1%3A2434811.md)
- Privileged-origin file rendering via legacy filesystem API [E2](https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md)
- Renderer-side flag flip of `nodeIntegrationInSubFrames` [E6](https://bugbountylibrary.com/r/h1%3A1647287.md)

## Why fixes fail
Disabling `nodeIntegration` alone does not help when `contextIsolation` is off [E1](https://bugbountylibrary.com/r/blog%3Aspeakerdeck-com-masatokinugawa-how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own.md). Sanitizing then re-encoding through overridable methods undoes the fix [E4](https://bugbountylibrary.com/r/h1%3A2434811.md). Enforcing a boundary check in the protected process lets a compromised renderer flip it [E6](https://bugbountylibrary.com/r/h1%3A1647287.md).

## Impact and severity
Full RCE in desktop apps [E1](https://bugbountylibrary.com/r/blog%3Aspeakerdeck-com-masatokinugawa-how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own.md)[E3](https://bugbountylibrary.com/r/blog%3Amksben-l0-cm-2020-10-discord-desktop-rce-html.md), sandbox escape reading arbitrary files [E4](https://bugbountylibrary.com/r/h1%3A2434811.md), privileged file access [E2](https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md), and renderer-to-IPC escalation [E6](https://bugbountylibrary.com/r/h1%3A1647287.md). High severity: the boundary is the only thing between page script and native execution, so a small XSS plus the missing gate becomes code execution.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aspeakerdeck-com-masatokinugawa-how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own.md
- E2: https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369.md
- E3: https://bugbountylibrary.com/r/blog%3Amksben-l0-cm-2020-10-discord-desktop-rce-html.md
- E4: https://bugbountylibrary.com/r/h1%3A2434811.md
- E5: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md
- E6: https://bugbountylibrary.com/r/h1%3A1647287.md