/
← Voltar ao feed
medium technology

Cluely Electron app flaw: missing will-navigate guard and open IPC bridge enable silent screen and mic capture, with a path to RCE

1 fonte(s) · 1 atualização(ões) · publicado 13/02/2026 21:00 · coletado há 3 dias

Researchers at Hacktron disclosed a vulnerability chain in Cluely, an Electron-based AI assistant that reads the user's screen and microphone. They found it in July 2025 and published in February 2026. The main window had no will-navigate handler, so a link in the AI's markdown response could navigate the whole app to an attacker-controlled page. That page then ran inside the privileged renderer and could call exposed IPC handlers to capture screenshots and record system audio and the microphone without any user prompt. Because the renderer was unsandboxed, a V8 exploit could in principle give full remote code execution. Hacktron says the issue was silently patched after disclosure, with no acknowledgment, and that its analysis reflects Cluely as it was in mid-2025.

Detalhes técnicos

  • Missing navigation guard: the DisplayOverlay class blocks will-navigate, but the base Window class used for the main window does not. It only sets setWindowOpenHandler. Clicking a rendered link navigates the entire app to the attacker's URL.
  • Unrestricted IPC bridge: the preload script exposes ipcRenderer.send, invoke and on via contextBridge with no channel allowlist. Any page loaded in the renderer can call the main-process handlers capture-screenshot, mac-set-native-recorder-enabled and mac-set-mic-monitor-enabled.
  • No sandbox: webPreferences lacks sandbox: true, so a V8 exploit in the renderer would lead to full RCE. Hacktron did not demonstrate this chain on Cluely and refers to its earlier Discord Desktop RCE research.
  • Entry point: indirect prompt injection, for example in an interviewer's task text, makes the AI render a malicious markdown link such as [Click here to view the task requirements](https://attacker.com/exploit). The user must click it. The PoC page then auto-captures a screenshot and records 10 seconds of audio on load.
  • Impact: exposure of the screen contents, meeting audio and microphone input, plus potential full host compromise.

Remediação

  • Intercept will-navigate on all windows and block it or open URLs in the system browser.
  • Restrict the preload IPC bridge to an allowlist of required channels.
  • Enable the Chromium sandbox (sandbox: true) for renderers.
  • Run a vulnerability disclosure program so researchers can report bugs.
  • Hacktron says Cluely silently patched the issue. Defenders should treat AI agents with deep screen, mic and file access as high-privilege software.

Linha do tempo

  1. hacktron.ai ↗ · pub. 13/02/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Cluely Electron app flaw: missing will-navigate guard and open IPC bridge enable silent screen and mic capture, with a path to RCE

    ler a análise desta fonte

    Researchers at Hacktron disclosed a vulnerability chain in Cluely, an Electron-based AI assistant that reads the user's screen and microphone. They found it in July 2025 and published in February 2026. The main window had no will-navigate handler, so a link in the AI's markdown response could navigate the whole app to an attacker-controlled page. That page then ran inside the privileged renderer and could call exposed IPC handlers to capture screenshots and record system audio and the microphone without any user prompt. Because the renderer was unsandboxed, a V8 exploit could in principle give full remote code execution. Hacktron says the issue was silently patched after disclosure, with no acknowledgment, and that its analysis reflects Cluely as it was in mid-2025.

    Technical Details

    • Missing navigation guard: the DisplayOverlay class blocks will-navigate, but the base Window class used for the main window does not. It only sets setWindowOpenHandler. Clicking a rendered link navigates the entire app to the attacker's URL.
    • Unrestricted IPC bridge: the preload script exposes ipcRenderer.send, invoke and on via contextBridge with no channel allowlist. Any page loaded in the renderer can call the main-process handlers capture-screenshot, mac-set-native-recorder-enabled and mac-set-mic-monitor-enabled.
    • No sandbox: webPreferences lacks sandbox: true, so a V8 exploit in the renderer would lead to full RCE. Hacktron did not demonstrate this chain on Cluely and refers to its earlier Discord Desktop RCE research.
    • Entry point: indirect prompt injection, for example in an interviewer's task text, makes the AI render a malicious markdown link such as [Click here to view the task requirements](https://attacker.com/exploit). The user must click it. The PoC page then auto-captures a screenshot and records 10 seconds of audio on load.
    • Impact: exposure of the screen contents, meeting audio and microphone input, plus potential full host compromise.

    Remediation

    • Intercept will-navigate on all windows and block it or open URLs in the system browser.
    • Restrict the preload IPC bridge to an allowlist of required channels.
    • Enable the Chromium sandbox (sandbox: true) for renderers.
    • Run a vulnerability disclosure program so researchers can report bugs.
    • Hacktron says Cluely silently patched the issue. Defenders should treat AI agents with deep screen, mic and file access as high-privilege software.