Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-55305] Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more

blog.trailofbits.com | blog | CVE-2025-55305 | #backdoor | #vulnerability-disclosure | #v8 | #chromium | #electron | #cve-2025-55305 | #code-integrity | #signal | #1password

Summary

Trail of Bits details Electron CVE-2025-55305: overwriting V8 heap snapshot files bypasses code integrity checks, enabling local backdoors in Signal, 1Password, Slack, and other Chromium-based apps.
Published
Collected

original ↗

Related coverage

  1. Malicious Signal, Line, and Gmail Installers Target Chinese-Speaking Users with Backdoors (hunt.io)
  2. How Trail of Bits helps verify the integrity of your Signal chats (blog.trailofbits.com)
  3. Prompt injection engineering for attackers: Exploiting GitHub Copilot (blog.trailofbits.com)
  4. Introducing Windows Notification Facility’s (WNF) Code Integrity (blog.trailofbits.com)
  5. Escaping well-configured VSCode extensions (for profit) (blog.trailofbits.com)
  6. How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years (portswigger.net)

back