@arXiv_csCR_bot@mastoxiv.page2026-07-24 07:51:53
Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing
Jianjia Yu, Zhengyu Liu, Ziyang Li, Yu Sun, Yinzhi Cao
https://arxiv.org/abs/2607.20698 https://arxiv.org/pdf/2607.20698 https://arxiv.org/html/2607.20698
arXiv:2607.20698v1 Announce Type: new
Abstract: Electron is a popular framework for building cross-platform desktop applications using web technologies. Such applications consist of multiple processes with different privilege levels that communicate via message passing. When inter-process messages carry attacker-controlled inputs, they can propagate across processes and reach privileged APIs, e.g., command execution. Such a message propagation behavior is characterized as Message Progression Vulnerabilities (MPVs). The exploitation of MPVs is challenging because it often requires multiple steps, e.g., first arbitrary code execution in one process via message passing, and then command injection in another process using another message crafted in the first process. To our knowledge, existing works on Electron security only study unsafe configurations and malicious Document Object Model (DOM) content, i.e., they cannot detect or exploit these vulnerabilities that need to be triggered by complex cross-process exploits via message passing. We present Proton, a segmented directed fuzzing framework for detecting MPVs. Our key insight is to decompose end-to-end fuzzing into per-process segments along message-passing boundaries, where the goals of fuzzing each segment are either: (i) reaching a sink in the current process or (ii) propagating the payload to the next process, to enable the exploration of another process. In the second case, the messages seed the corpus of the next segment. Finally, Proton synthesizes crash inputs from each process to validate end-to-end exploits. We evaluate Proton against 589 real-world Electron applications, resulting in 23 zero-day MPVs. Among them, 22 lead to OS command execution, including projects with over 50k GitHub stars. We responsibly disclosed all findings. To date, we have received 13 acknowledgments, 11 fixes, and 11 CVEs, including a bug bounty from Vercel.
toXiv_bot_toot
@bibbleco@infosec.exchange2026-06-24 14:01:58
"US Secretary of State Marco Rubio [..] warned on Tuesday that no country is allowed to impose tolls on the Strait of Hormuz, where Iran has been pushing to charge ships passing through.
"It's an international waterway. No country is allowed to charge tolls or fees on an international waterway. That's existing international law," he said as he arrived in the UAE."
Pardon me, Mr Rubio, but aren't you the foreign minister of the USA? Since when did y…
@Techmeme@techhub.social2026-06-12 18:25:59
Sources: Microsoft considered spinning out or restructuring its Xbox unit as a wholly-owned subsidiary, or creating a joint venture with other partners (Aaron Holmes/The Information)
https://www.theinformation.com/articles/microsoft-con…
@leftsidestory@mstdn.social2026-07-21 02:41:15
Civic Museums IV - Relics🏛️
民间博物馆 IV - 残垣 🏛️
📷 Pentax MX
🎞️ LUCKY SHD 400 (FF)
If you like my work, Support by buying me a coffee or a roll of film from
PayPal https://www.paypal.com/paypalme/ydcdingsite
Wise
@cdarwin@c.im2026-07-03 20:55:35
True patriots should want all Americans to vote,
They should oppose would-be dictators,
They should yield to the Constitution,
and they should demand a nation that is offered to everyone equally.
Actual followers of Jesus should defend the vulnerable,
They should give comfort to the sick, food to the hungry, welcome to the immigrant, and love to the least among us.
And while the masqueraders and pretenders parade around in grand performative acts of lo…
@katrinakatrinka@infosec.exchange2026-07-11 04:08:37
I am 52 and was, for the very first time, called in for jury duty. I have been sent jury notices before, but was always excused the night before (or during COVID, not chosen for a virtual jury).
I've always been curious. As a licensed CPA, I know and passed the legal portion of the CPA exam. I have wondered from time to time what it's like to work in law.
Wednesday morning, I reported to the Utah Justice court. They got 24 other people and me to report, showed us a video …
@Erikmitk@mastodon.gamedev.place2026-06-14 08:43:53
I have not seen my cousin for maybe 30 years (due to family bullshit I had no say in as a kid).
We met yesterday and I am delighted that she also has two kids and lives the exact same #ADHD parenting life with her partner as we do!
It sure does run in families!
The kids bonded after 2 seconds instantly and even talked about their medication at the end of the day. Amazing ho…
@gray17@mastodon.social2026-06-02 18:41:15
> We introduce gpusnek, a fully functional Python interpreter ported to CUDA, enabling execution of arbitrary Python code directly on the GPU by running one whole interpreter on every CUDA core/thread. This is a tremendously bad idea, but for the duration of this paper we pretend that it is not
[Josef Dean in SIGBOVIK 2026]
@Techmeme@techhub.social2026-06-05 18:36:45
President Trump says he is weighing proposals for the US government to partner with major AI companies, and will soon discuss the idea with their executives (Bloomberg)
https://www.bloomberg.com/news/articles/2026-06-05/us-expl…
@Techmeme@techhub.social2026-07-08 03:15:49
Lisbon-based Bizay, a customized products marketplace for SMBs, raised a $55M Series D led by Indico, as it aims to accelerate its US expansion (Tamara Djurickovic/Tech.eu)
https://tech.eu/2026/07/07/bizay-secures-55m-to-fuel-us-growth-and-industry-…
