News for hackers. Stuff that matters.
Re:Zero-click, wormable, cross-platform remote code executio... by dbjorge on Monday December 07, 2020 @10:57AM (#25333366)
The article explains the technical details of the render process escape. Contrary to all the current replies to this comment, it does not look to me that this is using a generalized Electron escape; rather, it is using specific main/render IPC calls which Teams has implemented unsafely as the escape mechanism. Perhaps folks are confusing this with an electron sandbox issue because Teams happens to have called the variable containing their IPC APIs "electronSafeIpc".

There are no comments on this comment yet.