Running 1 test using 1 worker PRUVA-RESULT vulnerable#2: outcome=A_REAL_WINDOW_SPAWNED_CVE_BYPASS webview=true src=http://127.0.0.1:34273/x { "role": "vulnerable", "attempt": "2", "electronVersion": "40.10.2", "attackerUrl": "http://127.0.0.1:34273/x", "drivePath": "chat->open_preview-tool->preview.open-event->openPreview + [Open Preview] button click (preview-row.tsx -> openPreview) -> FALLBACK store-seed+reload", "webviewFound": true, "webviewSrc": "http://127.0.0.1:34273/x", "pageLoaded": true, "markers": [ "/marker?src=top-click", "/marker?src=frame-click", "/marker?src=top-click" ], "beacons": [ "/beacon?src=page-loaded", "/beacon?src=windowopen-result&value=null", "/beacon?src=top-click-dispatched", "/beacon?src=frame-spawned", "/beacon?src=frame-loaded", "/beacon?src=frame-windowopen-result&value=null", "/beacon?src=frame-click-dispatched", "/beacon?src=windowopen-result&value=null", "/beacon?src=top-click-dispatched" ], "outcome": "A_REAL_WINDOW_SPAWNED_CVE_BYPASS", "notes": [ "gateway never reported ready before submit" ], "messageRendered": true, "openPreviewClick": { "found": true, "count": 1, "clickedText": "Open Preview" }, "storeAfterClick": { "previewTabs": "[]", "activeTab": "", "alerts": [] }, "pageLoadedEarly": true, "completionCalls": 3, "modelsCalls": 8, "domAtEnd": { "hash": "#/20260817_192525_a9797f", "text": "New sessionCtrlN\nCapabilities\nMessaging\nArtifacts\nScheduled jobs\nPinned\nShift-click a chat to pin\nSessions\nPlease show @url:`http://127.0.0.1:34273/x`in…\nnow\nPlease show 127.0.0.1/xin the preview pane.\nOpen Preview\n\nPreview opened.\n\n39s ago\n⠋Waking up …\ndetached\n/tmp/build/repo/apps/desktop\n+81\nMock Model · Med\nBrowser\nGatewayreadydesktop\nv0.20.1 (+770)e3fab04", "webviews": 1, "previewTabs": "[{\"target\":{\"kind\":\"url\",\"label\":\"pruva-preview\",\"source\":\"http://127.0.0.1:34273/x\",\"url\":\"http://127.0.0.1:34273/x\"}}]", "activeTab": "", "layoutTree": null }, "instrument": { "browserWindowCreated": 4, "extraWindows": 3, "extraWindowDetails": [ { "t": 1786994767077, "event": "browser-window-created", "id": 2, "url": "" }, { "t": 1786994767481, "event": "browser-window-created", "id": 3, "url": "" }, { "t": 1786994768679, "event": "browser-window-created", "id": 4, "url": "" } ], "webContentsCreated": [ "window", "webview", "window", "window", "window" ], "guestDidCreateWindow": [ { "t": 1786994767172, "event": "guest.did-create-window", "guestId": 2, "childId": 2, "url": "http://127.0.0.1:34273/marker?src=top-click", "frameName": "", "disposition": "foreground-tab", "options": "{\"show\":true,\"width\":800,\"height\":600}" }, { "t": 1786994767573, "event": "guest.did-create-window", "guestId": 2, "childId": 3, "url": "http://127.0.0.1:34273/marker?src=frame-click", "frameName": "", "disposition": "foreground-tab", "options": "{\"show\":true,\"width\":800,\"height\":600}" }, { "t": 1786994768682, "event": "guest.did-create-window", "guestId": 2, "childId": 4, "url": "http://127.0.0.1:34273/marker?src=top-click", "frameName": "", "disposition": "foreground-tab", "options": "{\"show\":true,\"width\":800,\"height\":600}" } ], "openExternalCalls": [], "mainHandlerCalls": [], "guestConsole": [ { "t": 1786994767073, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA src=page-loaded", "line": 8, "sourceId": "http://127.0.0.1:34273/x" }, { "t": 1786994767074, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA src=windowopen-result&value=null", "line": 8, "sourceId": "http://127.0.0.1:34273/x" }, { "t": 1786994767173, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA src=top-click-dispatched", "line": 8, "sourceId": "http://127.0.0.1:34273/x" }, { "t": 1786994767178, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA src=frame-spawned", "line": 8, "sourceId": "http://127.0.0.1:34273/x" }, { "t": 1786994767477, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA-FRAME src=frame-loaded", "line": 11, "sourceId": "http://127.0.0.1:34273/frame?self=http%3A%2F%2F127.0.0.1%3A34273" }, { "t": 1786994767478, "event": "guest.console-message", "guestId": 2, "level": 3, "message": "Blocked opening 'http://127.0.0.1:34273/marker?src=frame-windowopen' in a new window because the request was made in a sandboxed frame whose 'allow-popups' permission is not set.", "line": 18, "sourceId": "http://127.0.0.1:34273/frame?self=http%3A%2F%2F127.0.0.1%3A34273" }, { "t": 1786994767478, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA-FRAME src=frame-windowopen-result&value=null", "line": 11, "sourceId": "http://127.0.0.1:34273/frame?self=http%3A%2F%2F127.0.0.1%3A34273" }, { "t": 1786994767573, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA-FRAME src=frame-click-dispatched", "line": 11, "sourceId": "http://127.0.0.1:34273/frame?self=http%3A%2F%2F127.0.0.1%3A34273" }, { "t": 1786994767772, "event": "guest.console-message", "guestId": 2, "level": 2, "message": "%cElectron Security Warning (Insecure Content-Security-Policy) font-weight: bold; This renderer process has either no Content Security\n Policy set or a policy with \"unsafe-eval\" enabled. This exposes users of\n this app to unnecessary security risks.\n\nFor more information and help, consult\nhttps://electronjs.org/docs/tutorial/security.\nThis warning will not show up\nonce the app is packaged.", "line": 2, "sourceId": "node:electron/js2c/sandbox_bundle" }, { "t": 1786994768577, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA src=windowopen-result&value=null", "line": 8, "sourceId": "http://127.0.0.1:34273/x" }, { "t": 1786994768772, "event": "guest.console-message", "guestId": 2, "level": 1, "message": "PRUVA src=top-click-dispatched", "line": 8, "sourceId": "http://127.0.0.1:34273/x" } ] }, "cveBypassWindowCount": 1, "genericWindowCount": 2 } ✓ 1 e2e/zz-pruva-r3b.spec.ts:71:1 › pruva r3b preview-webview escalation probe [vulnerable #2] (4.1m) 1 passed (4.1m)