LaunchBreak a Sip of Tea, a Click, and a Full Multi stage Desktop Takeover

The talk starts from the spread of custom URI schemes in AI and agentic desktop apps, which let a browser link install plugins or MCP servers and import configuration in one click. Earlier Electron research assumed an attacker already controlled the renderer. This work instead models an attacker who begins outside the app, with only a link, and follows the input through the main, utility and renderer processes until it reaches a dangerous sink.

The researchers organize these bugs along three axes: where the payload comes from (the URI itself, a second payload fetched from an attacker server during processing, or a file dropped to disk and loaded later), how it moves across processes over IPC, and which sinks it reaches, such as command execution, dynamic evaluation or module loading. To find such chains they built Proton, a fuzzing framework that uses an LLM to map taint flows and then fuzzes each segment separately before composing them. Across 589 applications they report 18 zero-days, 17 of them remote code execution, with 11 CVEs assigned and a vendor bounty paid.

The "tea time" section walks through several cases: a terminal app that concatenated URL fields into a shell command, a mail client whose unsanitized HTML was reachable through a file-protocol origin quirk, an EPUB reader where disabled context isolation allowed prototype pollution to reach privileged objects, and a local server with path traversal. For users, the takeaway is to avoid trusting external links and to be careful with always-allow prompts. For developers, the key lessons are to keep untrusted input away from shell and eval sinks and to enable context isolation.