security/fuses

12 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Electron Fuses overview and purpose

Fuses are magic bits in the Electron binary that can be flipped at package time to enable or disable certain features and restrictions. They allow developers to disable unused but powerful Electron features to improve security posture without forking Electron. Fuses are flipped before code signing, so the OS becomes responsible for ensuring the bits aren't flipped back via OS-level code signing validation like Gatekeeper on macOS or AppLocker on Windows.

runAsNode fuse - disable ELECTRON_RUN_AS_NODE

The runAsNode fuse toggles whether the ELECTRON_RUN_AS_NODE environment variable is respected. Default is Enabled. When disabled, child_process.fork in the main process will not function as expected, and Utility Processes should be used instead for standalone Node.js processes.

cookieEncryption fuse - encrypt cookie store

The cookieEncryption fuse toggles whether the cookie store on disk is encrypted using OS level cryptography keys. Default is Disabled. When enabled, the SQLite database used by Chromium to store cookies will be encrypted instead of plaintext. This is a one-way transition: enabling it will encrypt existing unencrypted cookies on write, but disabling it later will make the cookie store corrupt. On macOS, this fuse requires code signing to work correctly as it relies on Keychain access.

nodeOptions fuse - disable NODE_OPTIONS environment variable

The nodeOptions fuse toggles whether the NODE_OPTIONS and NODE_EXTRA_CA_CERTS environment variables are respected. Default is Enabled. NODE_OPTIONS can be used to pass custom options to the Node.js runtime and isn't typically used in production apps, so this fuse can safely be disabled.

nodeCliInspect fuse - disable inspection flags

The nodeCliInspect fuse toggles whether the --inspect, --inspect-brk, and similar debugging flags are respected. Default is Enabled. When disabled, it also ensures that SIGUSR1 signal does not initialize the main process inspector. Most apps can safely disable this fuse.

loadBrowserProcessSpecificV8Snapshot fuse - use separate snapshot for main process

The loadBrowserProcessSpecificV8Snapshot fuse changes which V8 snapshot file is used for the browser process. Default is Disabled. When enabled, the main process uses the file called browser_v8_context_snapshot.bin for its V8 snapshot, while other processes use their normal snapshot file. This can improve security and startup performance by separating snapshots between renderer and main processes.

grantFileProtocolExtraPrivileges fuse - restrict file:// protocol privileges

The grantFileProtocolExtraPrivileges fuse changes whether pages loaded from file:// protocol receive extra privileges beyond traditional web browsers. Default is Enabled. When enabled, file:// pages can use fetch to load assets over file://, use service workers, and have universal access to child frames on file:// regardless of sandbox settings. If not serving pages from file://, this fuse should be disabled.

wasmTrapHandlers fuse - use signal handlers for WebAssembly memory safety

The wasmTrapHandlers fuse controls whether V8 will use signal handlers to trap Out of Bounds memory access from WebAssembly. Default is Enabled. Supported on 64-bit Linux, macOS, Windows x86_64, and Linux and macOS aarch64. When disabled, V8 uses explicit bound checks which increase compile time, module size, and runtime cost but work on all platforms.

How to flip fuses with @electron/fuses package

Use the @electron/fuses JavaScript utility to flip fuses. Pass the path to the electron module and an object with FuseVersion.V1 and the fuse options to flipFuses(). Validate fused apps or check fuse status using the CLI: npx @electron/fuses read --app /path/to/app.

flipFuses example code

const { flipFuses, FuseVersion, FuseV1Options } = require('@electron/fuses') flipFuses( // Path to electron require('electron'), // Fuses to flip { version: FuseVersion.V1, [FuseV1Options.RunAsNode]: false } )

Manual fuse flipping - fuse wire structure

The fuse wire in the Electron binary is structured as: sentinel_bytes (always 'dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX') | fuse_version (1 byte, unsigned int) | fuse_wire_length (1 byte, unsigned int for number of fuses) | fuse_wire (N bytes where '0' = disabled, '1' = enabled, 'r' = removed).

Manual fuse flipping - locate and modify fuse wire

To manually flip fuses, locate the sentinel sequence 'dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX' in the Electron binary, then find the fuse's position in the fuse_wire and change it to '0' (0x30 for disabled) or '1' (0x31 for enabled). The current fuse schema is available in the Electron repository at build/fuses/fuses.json5.

Give your agent this brain