One Click Account Takeover in Granola: How a Notification Link Broke Out of Electron - Strix

July 5th, 2026<br>One Click Account Takeover in Granola: How a Notification Link Broke Out of Electron

Alex Schapiro

TL;DR: Strix found a one-click account takeover in Granola's Electron desktop app. A user-controlled link in the activity feed could navigate a trusted Granola window to an attacker-controlled page, and that page kept access to Granola's privileged Electron bridge. Granola confirmed the issue quickly, shipped a server-side fix that protected users without an app update, patched a bypass we sent later, and found no evidence of exploitation in the wild.

Granola's disclosure: Report: Desktop App Navigation Vulnerability<br>Your browser does not support embedded video.<br>01Activity request<br>Attacker-controlled display name

02One click<br>Trusted window navigates off-origin

03Attacker page<br>Electron bridge still present

Redacted POC showing the activity-feed sequence. One click navigates the trusted renderer to attacker-controlled content while the Electron bridge remains available. Recorded June 25 during bypass retesting; Granola deployed the bypass fix June 26.We love using Granola (an AI notetaker) at Strix. Part of the reason is that Granola has handled security well in the past. And it of course deals with extremely sensitive data -- internal company notes, customer meetings etc. That made it a good target for a new thing we have been working on: asking Strix to reason about desktop apps, not just web apps.

So we handed Strix the Granola desktop app with no exploit hypothesis and asked it to go deep. It came back with a direct chain: one click on a notification could move a trusted Granola renderer to a page we controlled, while keeping Granola's privileged IPC bridge, SQLite control port, and session access within reach. Screen-capture paths and webcam-adjacent controls were also reachable in principle behind the bridge.

Let's get into it!

Introduction

Electron apps are very interesting targets. They look like desktop apps, but much of the UI is still web content. That makes them powerful, and it makes their security model depend on one question: which web content is allowed to talk to the native side?

Granola had done the standard Electron hardening work. Its main windows used contextIsolation: true and nodeIntegration: false. The renderer could not just reach into Node.js. Instead, a preload script exposed a scoped bridge on window.electron, and native capabilities lived behind IPC channels.

That shape is all good. But, the danger is that the bridge follows the window. If a privileged window that started on trusted app content can be navigated to attacker-controlled web content, the attacker does not need Node integration. They can inherit the bridge that was already there!<br>Electron trust boundary<br>Navigating off-origin kept the privileged bridge

At time of testing

Trusted rendererapp://ui/window.electron<br>Granola content starts inside a preload-bearing window.

same Browser Window<br>Attacker originhttps://attacker.examplewindow.electron<br>A new origin inherits the bridge already attached to the window.

privileged IPC<br>Final impactOne-click account takeover<br>Session access, plus a foothold into local desktop capabilities.

Fixed now

Trusted rendererapp://ui/window.electron<br>will-navigate and will-redirect enforce the boundary.

navigation blocked<br>System browsershell.openExternal()window.electron<br>External pages open outside the privileged renderer.

no privileged IPC<br>Final outcomeThe attack chain ends<br>Attacker-controlled code never enters Granola's trusted renderer.

At the time of testing, one click could navigate the trusted window to an attacker page without dropping window.electron, turning the navigation flaw into account takeover. Granola now blocks that transition.What Strix tested

Strix is the open-source autonomous hacking agent we build. For this run there was no live URL to crawl, so we gave it the extracted Granola app bundle and told it to find what it could. It spun up 56 agents .

One of those was focused on that Electron Trust Boundary.

Within minutes, the trust-boundary lead had mapped the native surface:<br>Electron Trust Boundary Agent

ThinkingCurrent evidence confirms a broad preload bridge: window.electron.ipcInvoke/ipcSend/ipcOn is available to renderer code, and renderer bundles actively use it for powerful channels like get-session, sqlite:port, and screenshot/system actions.

Then, it asked the million-dollar-question:<br>Electron Trust Boundary Agent

ThinkingThe critical next question is reachability from any remote or less-trusted renderer, because that would convert the generic IPC bridge into a high-impact trust-boundary break.

This is the key: can an attacker make untrusted JavaScript run in the renderer that had the privileged bridge?

Granola vulnerability overview

Strix confirmed two important primitives by running the packaged app under a local Electron...