Context isolation bypass via nested unserializable return value in Electron

Root

Cause

Electron's contextIsolation feature separates the renderer's "main world" from the preload script's "isolated world". The contextBridge API allows controlled communication. However, when a function exposed via contextBridge returns a JavaScript object that cannot be cloned (e.g., a canvas rendering context) or when a return value throws a user-generated exception during serialization (e.g., a dynamic getter), the normal "object could not be cloned" error is suppressed, and the object's reference leaks into the main world [1][4]. This breaches the isolation boundary, giving renderer code unintended access to the isolated world's objects.

Exploitation

An attacker who can execute arbitrary JavaScript in the renderer's main world (e.g., via a cross-site scripting vulnerability) can exploit this by calling an exposed API that returns such a problematic value. The attacker does not require authentication beyond the existing renderer access. No special network position is needed; the attack occurs entirely within the Electron application's process [1].

Impact

Successful exploitation allows code running in the main world to reach into the isolated Electron context and perform privileged actions. This includes accessing Node.js APIs, the filesystem, and other system resources, potentially leading to remote code execution or full system compromise [4].

Mitigation

Electron has released patches in versions 25.0.0-alpha.2, 24.0.1, 23.2.3, and 22.3.6 [1]. Developers using earlier versions should update immediately. As a workaround, ensure that all values returned from functions exposed via contextBridge are serializable and do not contain dynamic getters that could throw exceptions [4].