Why is this an issue?

Chromium uses process sandboxing to separate components that are part of its attack surface from the rest of the application. Since Electron uses Chromium internally, the same sandboxing principle is used here for the renderers and for preload scripts.

Renderer sandboxing is a critical component of the security model of Electron. Within the renderer, it is only possible to access a limited subset of APIs. Any privileged actions, e.g. filesystem interactions or spawning subprocesses, have to be executed through IPC with the main process. If renderer sandboxing is disabled, then an attacker who gains code execution within the renderer (for example through XSS) can pivot this easily into file system access and RCE.

What is the potential impact?

If sandboxing is not enabled in an Electron application, the potential impact can be severe and multifaceted:

Security Breaches

Malicious code running within the application can gain unrestricted access to system resources, leading to unauthorized data access, data exfiltration, or even complete system compromise.

Data Integrity

Without sandboxing, there is a higher risk of data corruption or manipulation, as malicious scripts can interfere with the application’s data handling processes.

User Privacy

Sensitive user information, such as personal data, credentials, and other private information, can be exposed to unauthorized access, leading to privacy violations.

Reputation Damage

Security incidents can lead to a loss of user trust and damage the reputation of the organization responsible for the application, resulting in potential financial and reputational losses.

How to fix it

Code examples

Noncompliant code example

Setting the sandbox property of webPreferences to false or setting nodeIntegration to true will result in a webview that will not be sandboxed.

<webview
    src="https://example.com/index.html"
    nodeintegration="true"
    >
</webview><!-- Noncompliant -->

<webview
    src="https://example.com/index.html"
    webpreferences="sandbox=false"
    >
</webview><!-- Noncompliant -->

Compliant solution

<webview
    src="https://example.com/index.html"
    nodeintegration="false"
    >
</webview>

<webview
    src="https://example.com/index.html"
    webpreferences="sandbox=true"
    >
</webview>

How does this work?

In the compliant examples sandbox or nodeIntegration are explicitly set to their secure value. It is also sufficient to not set any of these properties since they will default to secure values.

Resources

Documentation