Loading story…
Researchers disclosed a remote code execution chain against Discord Desktop that combined a cross-site scripting flaw in Discord embeds, a Chromium content security policy bypass, and a V8 engine vulnerability to achieve code execution on the client. The attack began with XSS in a Vimeo embed rendered inside Discord, then used an older Chromium CSP bypass to load attacker-controlled content despite Vimeo’s restrictive policy. The write-up says Discord Desktop was running Electron 9 with Chromium 83, with nodeIntegration disabled and contextIsolation enabled, but without an explicit sandbox=true setting on the main window.
The researchers then abused Discord’s handling of the new-window event and redirect behavior to obtain an unsandboxed renderer, creating the conditions needed to exploit a known V8 issue tracked as Chromium bug 1196683 and reach code execution. The report credits collaboration with Harsh Jaiswal and ptrYudai, and links the exploit chain to a V8 code review reference associated with the underlying browser-engine bug. Discord later mitigated the issue by upgrading Electron and fixing the new-window configuration so external sites could no longer load in unsafe new windows.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A Chromium Gerrit review was created for change 2820971 in the V8 project, corresponding to the bug later referenced by the Discord RCE research as Chromium bug 1196683.
After the research, Discord updated Electron and corrected the new-window misconfiguration so external sites could no longer load in new windows, blocking the exploit chain described in the write-up.
Using the embed XSS, CSP bypass, Discord's unsafe new-window behavior, and the V8 bug 1196683 with help from ptrYudai, the researchers achieved remote code execution against Discord Desktop.
The researcher, working with Harsh Jaiswal, found a cross-site scripting issue in a Vimeo embed rendered by the Discord desktop application and chained it with an old Chromium CSP bypass to load attacker-controlled content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how `CVE-2023-3079` enabled remote code execution in the Chrome renderer through a type confusion flaw in the V8 JavaScript engine. The bug involved incorrect inline cache handling for property writes to `JSStrictArgumentsObject`, where the `StoreFastElementIC_GrowNoTransitionHandleCOW` handler could grow an elements backing store without changing the object from `PACKED_ELEMENTS` to `HOLEY_ELEMENTS`, creating an inconsistent internal state. That inconsistency exposed V8’s internal **"The Hole"** value to JavaScript, which should remain inaccessible, and the leaked value was then used to trigger a Turbofan JIT type inference error that removed bounds checks. The resulting out-of-bounds array access gave attackers the primitives needed for `addr_of` and arbitrary read/write, forming the first stage of a broader exploit chain that later pursued sandbox escape and privilege escalation in Chrome.
Jul 24, 2026
Google has patched **CVE-2026-11645**, an actively exploited flaw in Chrome’s V8 JavaScript and WebAssembly engine that can give attackers both out-of-bounds read and write capabilities from a crafted web page. The bug affects Chrome prior to **149.0.7827.103** on Windows and macOS and **149.0.7827.102** on Linux, creating a realistic drive-by compromise path in which renderer-process code execution could be chained with a sandbox escape for full device takeover. Public reporting notes that Google confirmed in-the-wild exploitation but did not disclose the campaign, attribution, or full exploit chain. The risk is amplified across the broader Chromium ecosystem because many **Electron** and Chromium-based applications ship their own embedded V8 runtimes and may remain vulnerable after browser updates. Historical Chromium issues and research around **XSS Auditor** and Chrome security bugs—including bypasses, cross-origin data extraction, form-data leakage through redirects, and Egor Homakov’s account of abusing Chrome bugs in an OAuth flow—underscore how browser flaws can expose sensitive data or be combined into larger attack chains. Organizations are being pushed to update Chrome immediately and inventory Chromium-derived applications that may require separate patch cycles.
Aug 16, 2026
Researchers disclosed a vulnerability chain in **Cluely**, an Electron-based AI desktop assistant, that could let an attacker take over the app’s privileged capabilities and potentially achieve remote code execution. According to the report, a markdown link rendered in an AI response could navigate Cluely’s main window to an attacker-controlled page because the application lacked a `will-navigate` handler. Once loaded inside the Electron renderer, that page could interact with a broadly exposed IPC bridge in the preload script, which reportedly lacked channel filtering. The exposed bridge allowed attacker-controlled content to invoke sensitive functions including screenshots, native recording, and microphone monitoring, effectively turning the assistant into spyware on the victim’s device. The researchers said the renderer was also unsandboxed, creating a possible path from renderer compromise to full RCE through a V8 exploit, and that exploitation could be triggered through prompt injection or social engineering that induced the AI to display a malicious link. The findings align with broader Electron attack-surface research presented at DEF CON, and the researchers said Cluely later patched the issue without publicly acknowledging the report.
Jul 23, 2026