# Sandbox escape via privileged URL trust

Privileged URL, origin, or window proxy reachable from renderer input without revalidating the real sender

_Area: Memory corruption and native code. Seen in 3 disclosed reports; one confirmed bounty: $3,000; latest 2022-07-29. Updated 2026-10-24._

## How it works
A privileged surface (a webview, a child window, a privileged URL scheme) is meant to be reachable only from trusted code. The bug is that the trust decision is made from attacker-influenced data instead of the real sender: a `parentOrigin` query parameter, a `window.open` proxy that lets the opener eval into the child, or a new-window handler that keeps running after a cross-origin redirect. The assumption that breaks is "only trusted origins can reach this privileged context." Once renderer-controlled input reaches that context, the sandbox boundary is gone.

## Where it shows up
- postMessage handlers that read origin from a query param or message field rather than the actual sender origin [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)
- Custom `window.open`/`BrowserWindowProxy` semantics that let the opener eval into a child window [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md)
- Privileged URL schemes reachable from renderer content (`chrome-devtools://`, `vscode-file://`) [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)[E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md)
- Path traversal (`..%2F`) in a privileged file scheme escaping the install path [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)
- `new-window` handlers that do not re-check origin after a redirect [E3](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md)
- Embed/preview renderers as the softer XSS entry point into these paths [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md)

## How to review
For every privileged context, find the exact check that gates entry and confirm it uses the real sender origin, not a parameter, header, or redirect target. The invariant: no renderer-supplied value may select or reach a privileged URL, origin, or window proxy without revalidation against the actual sender. Check that privileged schemes cannot be navigated to from untrusted content, that file-scheme paths are canonicalized before traversal checks, and that window proxies do not grant cross-origin eval. Treat a missing `sandbox: true` (even with nodeIntegration off and contextIsolation on) as a contributing factor that widens the blast radius, not the root cause [E3](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md).

## Variants seen
- Origin leak via font-src plus trusted `parentOrigin` param, then file-scheme traversal to RCE [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)
- SOP-subverting window proxy plus privileged devtools URL to override nodeIntegration [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md)
- Embed XSS plus new-window escape after cross-origin redirect, with missing sandbox flag [E3](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md)

## Impact and severity
All three reached remote code execution on desktop Electron apps, escaping the renderer sandbox [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)[E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md). Severity is high: the privileged context runs with Node or file access. It worsens when privileged schemes are reachable from content, when origin checks trust parameters, and when the sandbox flag is absent alongside an outdated Chromium [E3](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md