Your Electron App Can Pop a Shell - Here's How to Check

Electron - the OpenJS Foundation's open-source framework that pairs Chromium with Node.js, powers a huge share of today's desktop software, including countless open-source apps. Its architecture quietly changes the security rules: a bug that would be a harmless cross-site scripting issue in a browser can become remote code execution on the user's machine.

This is a practitioner's field guide to security-reviewing and pentesting Electron applications. No prior security background is needed. If you build or maintain an Electron app, you'll leave able to audit your own.

We'll build a clear mental model of Electron's trust boundaries (main process, renderer, preload, IPC) and the two questions that drive almost every finding.

A repeatable methodology for both code review (white box) and pentesting (black/grey box): unpack the app, map the contextBridge and IPC surface, and trace untrusted input to dangerous capabilities.

The most common, highest-impact pitfalls; over-exposed bridge APIs, missing IPC sender validation, command injection and path traversal in handlers, unsafe shell.openExternal, unsandboxed embedded content, weak CSP, no-auth localhost servers, and insecure auto-update.

Live demo: Unpack a real Electron binary, enumerate its exposed API, and walk a bug from untrusted input to code execution, using only FOSS tools (asar, Electronegativity, @electron/fuses, Semgrep).

A hardening checklist maintainers can adopt immediately, plus a short look at the new attack surface in AI-assisted desktop apps.

Everything shown : the framework, the tooling, and the techniques are open source, so attendees can apply it to their own projects the same day.