Electron, Desktop Apps and Browser Extensions
Node.js in the renderer, custom protocols with filesystem reach, extension permissions and content scripts, and secrets still sitting in source maps.
These are web applications with filesystem and process access. The same bug that would be a contained XSS in a tab is a different finding here.
Electron Apps
Electron combines a web application with desktop APIs. XSS changes severity when the renderer can cross into Node or privileged IPC. Electron separates the main process from renderers. contextIsolation, sandbox and nodeIntegration define renderer capability. Preload scripts and IPC handlers become bridges between web content and local APIs. Remote origins inside BrowserWindow increase risk. I review BrowserWindow options, preload code, navigation, new-window behavior and IPC authorization before testing XSS. Disabling nodeIntegration helps, but an unsafe preload may re-expose filesystem or shell access through a custom API.
1
grep -R 'nodeIntegration\|contextIsolation\|ipcMain\|contextBridge' -n .
Chromium-Based Desktop Apps
Chromium-based desktop applications inherit web problems and add custom protocols, local files and native bridges. Frameworks such as Electron, CEF and custom wrappers use Chromium with different levels of native integration. Custom URI schemes, file:// access, local HTTP servers and native messaging create additional trust boundaries. I identify framework, version, local ports, registered protocols and bridges exposed to the renderer. Even with browser sandboxing, a custom protocol handler may accept path traversal or command arguments in the native process.
1
2
netstat -ano | findstr LISTENING
reg query HKCU\Software\Classes /s | findstr /i 'URL Protocol'
Browser Extensions
A browser extension may read pages, cookies and tabs while running code distributed outside the control of the site being visited. Extensions have manifest permissions, host permissions, background service workers and content scripts. Message passing connects pages, content scripts and extension contexts. Validating sender and origin is essential around privileged APIs. I review manifest permissions, matches, externally_connectable, web_accessible_resources and runtime.onMessage handlers. A broad permission is not a vulnerability by itself. The finding appears when a less-trusted origin can invoke a privileged capability.
1
cat manifest.json | jq .
Source Maps
A source map may reveal original filenames, source code and structure that minification hid by accident rather than by design. .map files connect transformed bundles to original source. Some include sourcesContent with complete code. Internal endpoints, feature flags, comments and integration keys may appear. Secrets embedded in frontend code remain public even without source maps. I look for sourceMappingURL, download only in-scope artifacts and search for endpoint and credential patterns. Removing source maps reduces source disclosure. Any valid secret found needs rotation and removal from client-side code.
1
2
grep -R 'sourceMappingURL' -n downloaded-js/
jq '.sources,.sourcesContent' app.js.map | head