Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing

2026-07-22

AI Summary

This work addresses the challenge of detecting multi-step privilege escalation vulnerabilities (MPVs) in Electron applications, which arise from the compositional exploitation of inter-process message passing and often evade existing detection techniques. To this end, the authors propose Proton, a novel framework that introduces segmented directed fuzzing to Electron security analysis for the first time. Proton decomposes end-to-end fuzzing along message boundaries, separately exploring sensitive operations and message propagation paths within each process, and then automatically synthesizes cross-process exploitation chains through message seed transfer. Evaluated on 589 real-world Electron applications, Proton uncovered 23 zero-day MPV vulnerabilities—22 of which lead to arbitrary command execution—resulting in 13 vendor acknowledgments, 11 patches, 11 assigned CVEs, and a bug bounty from Vercel.

Abstract

Electron is a popular framework for building cross-platform desktop applications using web technologies. Such applications consist of multiple processes with different privilege levels that communicate via message passing. When inter-process messages carry attacker-controlled inputs, they can propagate across processes and reach privileged APIs, e.g., command execution. Such a message propagation behavior is characterized as Message Progression Vulnerabilities (MPVs). The exploitation of MPVs is challenging because it often requires multiple steps, e.g., first arbitrary code execution in one process via message passing, and then command injection in another process using another message crafted in the first process. To our knowledge, existing works on Electron security only study unsafe configurations and malicious Document Object Model (DOM) content, i.e., they cannot detect or exploit these vulnerabilities that need to be triggered by complex cross-process exploits via message passing. We present Proton, a segmented directed fuzzing framework for detecting MPVs. Our key insight is to decompose end-to-end fuzzing into per-process segments along message-passing boundaries, where the goals of fuzzing each segment are either: (i) reaching a sink in the current process or (ii) propagating the payload to the next process, to enable the exploration of another process. In the second case, the messages seed the corpus of the next segment. Finally, Proton synthesizes crash inputs from each process to validate end-to-end exploits. We evaluate Proton against 589 real-world Electron applications, resulting in 23 zero-day MPVs. Among them, 22 lead to OS command execution, including projects with over 50k GitHub stars. We responsibly disclosed all findings. To date, we have received 13 acknowledgments, 11 fixes, and 11 CVEs, including a bug bounty from Vercel.

Problem

• Message Progression Vulnerabilities
• Electron Applications
• Inter-process Communication
• Cross-process Exploits
• Privilege Escalation

Innovation

• segmented directed fuzzing
• Message Progression Vulnerabilities
• Electron applications
• cross-process exploitation
• inter-process message passing