Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more

Summary: Trail of Bits researchers found that Electron's integrity-checking fuses, EnableEmbeddedAsarIntegrityValidation and OnlyLoadAppFromAsar, did not cover V8 heap snapshot files, allowing unsigned JavaScript to be loaded into any V8 isolate. They demonstrated backdoors in Signal, 1Password (patched in v8.11.8-40), Slack, and Chrome by overwriting heap snapshots, and Electron issued CVE-2025-55305.
Why it matters: The technique is already catalogued as MITRE ATT&CK T1218.015 and used by the Loki C2 framework to backdoor trusted apps like VS Code and GitHub Desktop while evading CrowdStrike Falcon and AppLocker, and the Chrome team states local attacks are explicitly excluded from its threat model.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-55305
Related: ⚡ Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026