[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-143278-105":59,"doc-detail-143278-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","coindef-a-comprehensive-code-injection-defense-for-the-electron-framework","COINDEF - A Comprehensive Code Injection Defense for the Electron Framework","","COINDEF addresses code injection risks in Electron, where web technologies and native execution are fused into one executable, expanding attack surfaces beyond traditional web-only defenses. The approach enforces structural integrity of JavaScript Abstract Syntax Trees (ASTs) together with execution context inside the Electron JavaScript engine. Hybrid profiling builds baseline AST behavior, then runtime enforcement blocks injected semantics. Evaluation on 20 real applications shows exploit prevention with 3.96% startup overhead and negligible interaction overhead.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/coindef-a-comprehensive-code-injection-defense-for-the-electron-framework/143278/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/coindef-a-comprehensive-code-injection-defense-for-the-electron-framework/143278.png","ImageObject",300,407,{"name":92,"@type":93},"Emma Wilson","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-29","2026-08-25",true,{"@type":102,"interactionType":103,"userInteractionCount":46},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"Why do traditional web defenses fail for Electron applications?","Question",{"text":112,"@type":113},"Electron combines web and native environments in a single executable, creating vulnerabilities and an expanded attack surface that traditional defenses do not cover across both contexts simultaneously.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How does COINDEF detect and prevent code injection?",{"text":117,"@type":113},"COINDEF builds expected AST structural profiles with execution context during learning, then compares observed ASTs at runtime to enforce structural integrity and block injected semantics.",{"name":119,"@type":110,"acceptedAnswer":120},"What are COINDEF’s two operational phases?",{"text":121,"@type":113},"COINDEF uses a learning phase to generate AST profiles via static and dynamic profiling, and an enforcing phase to validate interpreted code against those profiles while applying security policies for unseen cases.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},143278,1787694127,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":46,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":129,"read_time":144},3848291630094,"https://eur-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45","2025 IEEE Symposium on Security and Privacy (SP)  \nCOINDEF: A Comprehensive Code Injection Defense for the Electron Framework  \nZheng Yang, Simon P. Chung, Jizhou Chen, Runze Zhang, Brendan Saltaformaggio, Wenke Lee  \nGeorgia Institute of Technology  \nAbstract—The increasing popularity of cross-platform frameworks like Electron underscores the appeal of using familiar web technologies for desktop application development. Electron fuses the web and native environments into one single executable. However, this fusion creates unique vulnerabilities and significantly expands the attack surfaces for Electron applications, rendering traditional web defenses ineffective, as they are not designed to operate across both web and native contexts simultaneously. To address these challenges, we propose COINDEF, a centralized defense mechanism that enforces the structural integrity of Abstract Syntax Trees (ASTs) with execution context. COINDEF operates within the JavaScript engine, providing rapid, tamper-proof, and comprehensive mitigation against code injection attacks to Electron applications. COINDEF employs hybrid profiling to collect AST structural profiles, establishing a baseline of expected behavior. Then, COINDEF enforces these profiles for code as it is interpreted at runtime. In an evaluation of COINDEF on 20 representative real-world applications, we demonstrate its effectiveness in blocking exploits, incurring a 3.96% runtime overhead during application startup and negligible overhead during user interaction. Comparing COINDEF to state-of-the-art defenses for Electron applications, we show that COINDEF offers comprehensive protection against sophisticated code injection attacks through DOM manipulations and dynamic code execution.  \n1. Introduction  \nThe increasing popularity of the Electron framework for developing cross-platform applications highlights the enduring allure of software paradigms that leverage familiar web technologies [1] . However, this novel use of web technologies outside of the sandboxed browser setting also means vulnerabilities from web applications (e.g., cross-site scripting (XSS) , prototype pollution, etc.) can affect the underlying client machine, potentially resulting in the remote execution of malicious code (RCE) .  \nOne such attack with real-world consequences is the Water Labuu campaign discovered in October 2022 [2], which spreads malicious messages through Meiqia, an Electron-based chatting application used by over 400,000 companies for customer service. A simple click on the malicious message injects malicious code into the app and leads to the exploitation of CVE-2021-21220 [3], stealing more than 300,000 US dollars worth of cryptocurrency.  \nUnfortunately, Meiqia is not the only one that is vulnerable. Similar campaigns can be launched against other high-profile apps like Slack, Discord, MSTeams, potentially targeting any subsequently discovered RCE [4]–[10] to execute malicious code of the attackers’choice on millions of machines and devices.  \nDespite extensive research into defenses against XSS for web applications [11]–[15] and RCE for native environments such as NodeJS [16]–[18], little has been done to address the root cause of such RCE attacks–code injection–within Electron applications. These prior solutions are effective within their respective runtime environments (web or native), but they are not equipped to handle the dual environments nature of Electron applications, which fuse web and native environments. This fusion introduces unique vulnerabilities and a broader attack surface [19], rendering existing defenses ineffective for protecting both environments simultaneously. Although recent studies have examined the attack surfaces in Electron applications and proposed mitigation [20]–[22], none have addressed the underlying code injection issues driving these security risks.  \nIn our pursuit of a comprehensive and practical defense, we investigated the underlying cause of code","cbCaivfgoW1aRaxf","https://ap.wps.com/l/cbCaivfgoW1aRaxf","pdf",1234249,18,"English","# Introduction\n## Attack background and motivation\n## COINDEF approach and phases\n## Learning and enforcing mechanisms","[{\"question\":\"Why do traditional web defenses fail for Electron applications?\",\"answer\":\"Electron combines web and native environments in a single executable, creating vulnerabilities and an expanded attack surface that traditional defenses do not cover across both contexts simultaneously.\"},{\"question\":\"How does COINDEF detect and prevent code injection?\",\"answer\":\"COINDEF builds expected AST structural profiles with execution context during learning, then compares observed ASTs at runtime to enforce structural integrity and block injected semantics.\"},{\"question\":\"What are COINDEF’s two operational phases?\",\"answer\":\"COINDEF uses a learning phase to generate AST profiles via static and dynamic profiling, and an enforcing phase to validate interpreted code against those profiles while applying security policies for unseen cases.\"}]","COINDEF - A Comprehensive Code Injection Defense for the Electron Framework | PDF",45]