# Privileged origin navigation bypass

Alternate navigation paths (popup, bookmark, drag-drop) loading attacker HTML into a privileged origin

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2018-10-23. Updated 2026-10-23._

## How it works
A privileged origin (chrome://, vscode-file://, vscode-webview://) is assumed reachable only through vetted entry points, and its pages are assumed to run with elevated trust. The assumption breaks because navigation restrictions are enforced per entry point, not per origin. Any path that reaches the origin without passing the check — a bookmark opened with middle-click, a noopener popup, a dropped OS shortcut file — delivers attacker HTML that then runs with the origin's privileges [E1](https://bugbountylibrary.com/r/h1%3A415258.md)[E2](https://bugbountylibrary.com/r/h1%3A415178.md)[E3](https://bugbountylibrary.com/r/h1%3A415967.md).

## Where it shows up
- Navigation guards that special-case the address bar but not bookmarks, middle-click, CTRL+click, window.open, or noopener popups [E2](https://bugbountylibrary.com/r/h1%3A415178.md)[E3](https://bugbountylibrary.com/r/h1%3A415967.md)
- Drag-and-drop of OS shortcut files (.webloc, .desktop) that navigate to their target URL [E1](https://bugbountylibrary.com/r/h1%3A415258.md)
- A privileged page whose HTML gains IPC/Node access (ipcRenderer/ipcMain, builtin require) once loaded [E1](https://bugbountylibrary.com/r/h1%3A415258.md)

## How to review
Identify every privileged origin and enumerate every primitive that can navigate a window to it: address bar, bookmark, popup (with and without noopener), drag-drop, redirect, file-scheme URL. The invariant: no attacker-influenced navigation may land in a privileged origin, regardless of which entry point triggered it. Check that the guard sits at the origin boundary, not at one entry point. Confirm the privileged page's elevated capabilities (IPC, require) are only reachable when the navigation itself was vetted.

## Variants seen
- Drag-drop of a shortcut file navigating to the privileged origin [E1](https://bugbountylibrary.com/r/h1%3A415258.md)
- Bookmark opened via middle-click/CTRL+click bypassing the navigation block [E2](https://bugbountylibrary.com/r/h1%3A415178.md)
- noopener popup skipping the privileged-navigation restriction [E3](https://bugbountylibrary.com/r/h1%3A415967.md)

## Why fixes fail
E1 and E2 show the same origin reached after a prior patch: blocking direct navigation and removing chrome.remote.require did not close drag-drop or bookmark paths. Fixes that patch one entry point leave siblings open.

## Impact and severity
Led to RCE in Electron-based apps (Muon/Brave) [E1](https://bugbountylibrary.com/r/h1%3A415258.md); E2 chains to a known RCE in the privileged page, and E3 shows the navigation primitive that enables it. Severity is high because the loaded HTML inherits IPC/Node access. Worse when the privileged page exposes ipcRenderer/ipcMain or builtin require [E1](https://bugbountylibrary.com/r/h1%3A415258.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A415258.md
- E2: https://bugbountylibrary.com/r/h1%3A415178.md
- E3: https://bugbountylibrary.com/r/h1%3A415967.md