Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing

Source: arXiv:2607.20698 · Published 2026-07-22 · By Jianjia Yu, Zhengyu Liu, Ziyang Li, Yu Sun, Yinzhi Cao

TL;DR

The paper addresses the security problem of Message Progression Vulnerabilities (MPVs) in Electron desktop applications. MPVs arise when attacker-controlled inputs propagate progressively through multiple Electron processes—main, utility, and renderer—via message passing, eventually reaching privileged APIs capable of executing OS commands. These multi-step, cross-process exploit chains are challenging to detect and exploit because they require coordinating multiple payload injections across process boundaries. Prior work on Electron security mainly focused on unsafe configurations or DOM-level vulnerabilities and did not address MPVs.

The authors propose Proton, a novel segmented directed fuzzing framework to detect MPVs. Proton decomposes the end-to-end multi-process exploit chain into per-process segments at message-passing boundaries (Progression APIs). Each segment is fuzzed independently with harnesses generated using static analysis and LLM assistance. The fuzzing goals are either reaching a terminal sink or forwarding a payload to the next process segment, whose input corpus is seeded by the previous segment’s output. Proton then synthesizes end-to-end exploits by composing per-segment fuzzed inputs and validates them on the full app.

Evaluated on 589 popular real-world Electron apps, Proton discovered 23 zero-day MPVs, 22 of which lead to remote code execution. Many vulnerable projects have over 50k GitHub stars. Proton found 17 more vulnerabilities than end-to-end fuzzing baselines, indicating its effectiveness and efficiency at traversing complex multi-process exploit paths. The authors responsibly disclosed issues, resulting in 11 CVEs and fixes and a bug bounty from Vercel. Proton is open sourced to facilitate further research.

Key findings

• Proton uncovered 23 zero-day Message Progression Vulnerabilities (MPVs) out of 589 Electron apps tested.
• 22 out of the 23 MPVs lead to full OS command execution (remote code execution).
• Proton’s segmented fuzzing finds 17 more vulnerabilities than traditional end-to-end fuzzing on the same dataset.
• Applications with over 50k GitHub stars were among those found vulnerable.
• The largest evaluation included fuzzing over multiple Electron processes: main, utility, and renderer.
• Proton contributed 11 CVEs and 11 fixes after responsible disclosure.
• Attack chains involve multi-step message progression crossing at least 3 process boundaries on average, complicating detection.
• LLM-synthesized fuzzing harnesses and input reconstructors enable efficient generation of complex inputs across varied parsing schemes.

Threat model

The adversary is a remote web attacker who can craft malicious custom URI scheme links embedded on arbitrary third-party or attacker-controlled websites. They do not directly control Electron app internals or renderer web content. Instead, they rely on user interaction (clicking malicious URIs) to launch multi-process message-passing exploit chains. The attacker cannot compromise the OS or Electron app arbitrarily outside of this model. The Electron app may be configured insecurely (e.g., Node integration enabled), allowing eventual reach to privileged API sinks if MPVs exist.

Methodology — deep read

1. Threat Model and Assumptions: The threat model assumes a remote web attacker who can publish or embed crafted URIs on third-party or attacker-controlled websites but has no direct code injection into the Electron app. A victim user clicks these attacker-controlled custom URI scheme links, which the OS invokes in the Electron app. The attacker exploits multi-process message passing inside the app to propagate attacker-controllable payloads to privileged sinks (e.g., command execution). The Electron app is assumed vulnerable with permissive process configurations (e.g., nodeIntegration enabled, contextIsolation disabled). No prior compromise inside the app is necessary.

2. Data: The authors evaluated Proton on 589 real-world Electron applications collected from GitHub repositories. These come with source code for static analysis and dynamic fuzzing. Labels correspond to discovered zero-day MPVs validated by synthesized end-to-end exploits. The dataset includes large popular projects exceeding 50k GitHub stars.

3. Architecture / Algorithm: Proton introduces segmented directed fuzzing. The workflow begins with static progression analysis to identify candidate vulnerable paths: attacker input sources, intermediate Progression APIs (message passing or content fetch), and terminal dangerous sinks (e.g., exec()). This analysis segments the global exploit chain into contiguous per-process segments defined by boundaries at Progression APIs.

For each segment, Proton generates a fuzzing harness to inject inputs directly at the segment boundary and an input reconstructor that maps fuzzed abstract inputs backwards into valid inputs satisfying complex parsing schemas (e.g., JSON.parse(), new URL()). These harnesses bypass replaying the entire multi-process chain by isolating fuzzing to one process at a time.

Segmented fuzzing is coverage-guided, with objectives of either (a) reaching a terminal sink or (b) reaching an intermediate Progression API to generate corpus messages for the next segment.

After fuzzing all segments and generating candidate messages at boundaries, Proton synthesizes an end-to-end input by chaining these messages in order. This input is then used to validate an exploit against the complete multi-process application.

4. Training / Fuzzing Regime: Each segment is fuzzed independently using coverage-guided mutation-based fuzzers. The authors harness Large Language Models (LLMs) to synthesize fuzzing harnesses and input reconstructors automatically from static analysis results, increasing efficiency and correctness. Specifics on epochs, batch sizes, or hardware were not detailed but fuzzing is iterative until coverage plateaus or crashes are found.

5. Evaluation Protocol: Proton’s evaluation compares segmented fuzzing to traditional end-to-end fuzzing on the full app. Metrics include the number of discovered zero-day MPVs, exploitability (RCE chain completion), and efficiency (vulnerabilities found per time). The authors report both per-segment fuzzing success and final end-to-end exploit validation. Vulnerabilities were responsibly disclosed, with CVEs and patches tracked. The evaluation considered complex real-world apps under default secure and insecure Electron configurations.

6. Reproducibility: The authors open-sourced Proton to support further research on MPVs detection in Electron apps. They provide all fuzzing harnesses, static analysis tooling, and end-to-end exploit synthesis methodology. However, the dataset of 589 apps and their exact environment might not be fully public. No mention of frozen weights applies as this is not a ML model but a fuzzing framework.

Example workflow (from Paperlib app): Proton first segments the chain from custom URI parsing (main process) to fetch() (utility process) to DOM insertion (renderer process). Each segment is fuzzed independently. Fuzzing discovers inputs triggering unintended function invocations in main, CSRF fetch in utility, and DOM XSS in renderer. Proton composes these inputs into a full exploit causing arbitrary command execution launched via node integration in the renderer. Crash validation confirms exploit validity.

Technical innovations

• Formalization of Message Progression Vulnerabilities (MPVs) across multi-process Electron apps, highlighting complex multi-step cross-process exploit chains.
• Segmented directed fuzzing framework that decomposes end-to-end multi-process exploit paths into fuzzable segments at Progression APIs to reduce complexity and improve fuzzing efficiency.
• Automated generation of per-segment fuzzing harnesses and input reconstructors leveraging Large Language Models (LLMs) to handle complex parsing and input constraints.
• End-to-end exploit synthesis by chaining independently fuzzed segment inputs and validating the complete exploit against the full multi-process application.

Datasets

• Real-world Electron applications dataset — 589 applications — collected from GitHub repositories, including popular projects with over 50k GitHub stars.

Baselines vs proposed

• End-to-end traditional fuzzing: discovered 6 zero-day MPVs vs Proton segmented fuzzing: 23 zero-day MPVs on the same 589 apps (17 more).

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.20698.

Fig 1: An illustration of a zero-day MPV found by Proton in Paperlib: a victim clicks on a malicious custom URI link

Fig 2 (page 2).

Fig 3 (page 2).

Fig 4 (page 2).

Fig 5 (page 2).

Fig 6 (page 2).

Fig 7 (page 2).

Fig 8 (page 2).

Limitations

• No detailed performance overhead or fuzzing runtime reported; scalability to very large apps with many processes is not extensively analyzed.
• No explicit mention of evaluating robustness against active adaptive adversaries who might try to detect or evade fuzzing.
• Only Electron apps are considered; applicability to other multi-process IPC frameworks is untested.
• Complexity of synthesizing fuzzing harnesses depends on availability and quality of source code and static analysis.
• The approach assumes relatively stable app codebases; frequent upstream app changes may require frequent harness regeneration.

Open questions / follow-ons

• Can segmented fuzzing with Proton scale to Electron apps with complex dynamic code loading and plugin architectures?
• How effective is Proton against MPVs in apps hardened with latest security mitigations like context isolation and sandboxing?
• Can the segmented fuzzing approach be generalized beyond Electron to other multi-process IPC-based desktop or mobile apps?
• What are the best practices for integrating continuous segmented fuzzing into Electron app CI pipelines for ongoing MPV detection?

Why it matters for bot defense

This work is highly relevant for bot-defense and CAPTCHA practitioners concerned with the security of Electron-based desktop clients or applications that have multi-process architectures and IPC channels. Proton demonstrates the importance of analyzing message-passing chains that cross process boundaries as attack surfaces rather than only focusing on single-process vulnerabilities or conventional DOM attacks. The methodology of segmented fuzzing across IPC boundaries could be adapted to fuzz test complex multi-layered client architectures common in modern applications that could be targeted by bots or automated exploit attempts.

However, the focus here is on command execution exploits via Electron IPC and not directly on CAPTCHA bypass or bot detection. Still, understanding these multi-process message progression vulnerabilities helps broaden the defender’s view of attack surfaces and informs the design of defense-in-depth strategies protecting inter-component communications, which is crucial in bot-defense scenarios where attackers target any exploitable input channel. The proposed static analysis and harness-based fuzzing techniques could inspire novel testing or challenge generation approaches for CAPTCHA robustness validation within complicated client app ecosystems.

Cite

@article{arxiv2607_20698,
  title={ Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing },
  author={ Jianjia Yu and Zhengyu Liu and Ziyang Li and Yu Sun and Yinzhi Cao },
  journal={arXiv preprint arXiv:2607.20698},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.20698}
}

Read the full paper

• arXiv:2607.20698 (abstract)
• arXiv:2607.20698 (PDF)