=== pruva r3b reproduction 2026-08-17T18:57:43Z === [*] repo at e3fab0437ee50ebe511cec57b9ac36f0c2803268 [*] electron 40.10.2 at /tmp/build/repo/apps/desktop/node_modules/electron/dist [*] backend import ok patched: /tmp/build/repo/apps/desktop/electron/main.ts [write-build-stamp] WARNING: working tree is dirty. Pinning to e3fab0437ee5 but the packaged code may differ from that commit. Commit your changes before publishing this build. [write-build-stamp] wrote apps/desktop/build/install-stamp.json -> e3fab0437ee5 [DIRTY] dist/electron-main.mjs 749.1kb ⚡ Done in 275ms bundled /tmp/build/repo/apps/desktop/dist/electron-main.mjs (dev) dist/electron-preload.js 24.7kb ⚡ Done in 2ms bundled /tmp/build/repo/apps/desktop/dist/electron-preload.js (dev) -rw-r--r-- 1 vscode vscode 938 Aug 17 17:34 /tmp/build/repo/apps/desktop/dist-dev/index.html -rw-r--r-- 1 vscode vscode 5172017 Aug 17 17:34 /tmp/build/repo/apps/desktop/dist-dev/main.js -rw-r--r-- 1 vscode vscode 767070 Aug 17 18:57 /tmp/build/repo/apps/desktop/dist/electron-main.mjs [*] fixed electron: unknown [*] renderer static server: 200 [*] running vulnerable attempt 1 2026-08-17T18:57:45Z PRUVA-RESULT vulnerable#1: outcome=A_REAL_WINDOW_SPAWNED_CVE_BYPASS webview=true src=http://127.0.0.1:46043/x 1 passed (4.1m) [*] running vulnerable attempt 2 2026-08-17T19:01:59Z PRUVA-RESULT vulnerable#2: outcome=A_REAL_WINDOW_SPAWNED_CVE_BYPASS webview=true src=http://127.0.0.1:45807/x 1 passed (4.1m) [*] running fixed attempt 1 2026-08-17T19:06:11Z PRUVA-RESULT fixed#1: outcome=A_REAL_WINDOW_SPAWNED_GENERIC_ONLY webview=true src=http://127.0.0.1:46007/x 1 passed (4.2m) [*] running fixed attempt 2 2026-08-17T19:10:28Z PRUVA-RESULT fixed#2: outcome=A_REAL_WINDOW_SPAWNED_GENERIC_ONLY webview=true src=http://127.0.0.1:42493/x 1 passed (4.1m) { "vuln": [ "A_REAL_WINDOW_SPAWNED_CVE_BYPASS", "A_REAL_WINDOW_SPAWNED_CVE_BYPASS" ], "fixed": [ "A_REAL_WINDOW_SPAWNED_GENERIC_ONLY", "A_REAL_WINDOW_SPAWNED_GENERIC_ONLY" ], "confirmed": true } === done 2026-08-17T19:14:40Z === === pruva r3b reproduction 2026-08-17T19:15:30Z === [*] repo at e3fab0437ee50ebe511cec57b9ac36f0c2803268 [*] electron 40.10.2 at /tmp/build/repo/apps/desktop/node_modules/electron/dist [*] backend import ok patched: /tmp/build/repo/apps/desktop/electron/main.ts [write-build-stamp] WARNING: working tree is dirty. Pinning to e3fab0437ee5 but the packaged code may differ from that commit. Commit your changes before publishing this build. [write-build-stamp] wrote apps/desktop/build/install-stamp.json -> e3fab0437ee5 [DIRTY] dist/electron-main.mjs 749.1kb ⚡ Done in 253ms bundled /tmp/build/repo/apps/desktop/dist/electron-main.mjs (dev) dist/electron-preload.js 24.7kb ⚡ Done in 3ms bundled /tmp/build/repo/apps/desktop/dist/electron-preload.js (dev) -rw-r--r-- 1 vscode vscode 938 Aug 17 17:34 /tmp/build/repo/apps/desktop/dist-dev/index.html -rw-r--r-- 1 vscode vscode 5172017 Aug 17 17:34 /tmp/build/repo/apps/desktop/dist-dev/main.js -rw-r--r-- 1 vscode vscode 767070 Aug 17 19:15 /tmp/build/repo/apps/desktop/dist/electron-main.mjs [*] fixed electron: unknown [*] renderer static server: 200 [*] running vulnerable attempt 1 2026-08-17T19:15:31Z PRUVA-RESULT vulnerable#1: outcome=A_REAL_WINDOW_SPAWNED_CVE_BYPASS webview=true src=http://127.0.0.1:37431/x 1 passed (6.6m) [*] running vulnerable attempt 2 2026-08-17T19:22:12Z PRUVA-RESULT vulnerable#2: outcome=A_REAL_WINDOW_SPAWNED_CVE_BYPASS webview=true src=http://127.0.0.1:34273/x 1 passed (4.1m) [*] running fixed attempt 1 2026-08-17T19:26:24Z PRUVA-RESULT fixed#1: outcome=A_REAL_WINDOW_SPAWNED_GENERIC_ONLY webview=true src=http://127.0.0.1:40315/x 1 passed (4.1m) [*] running fixed attempt 2 2026-08-17T19:30:37Z PRUVA-RESULT fixed#2: outcome=A_REAL_WINDOW_SPAWNED_GENERIC_ONLY webview=true src=http://127.0.0.1:36827/x 1 passed (4.1m) { "vuln": [ "A_REAL_WINDOW_SPAWNED_CVE_BYPASS", "A_REAL_WINDOW_SPAWNED_CVE_BYPASS" ], "fixed": [ "A_REAL_WINDOW_SPAWNED_GENERIC_ONLY", "A_REAL_WINDOW_SPAWNED_GENERIC_ONLY" ], "confirmed": true } === done 2026-08-17T19:34:50Z ===