New Exploit Bypasses Code Integrity to Backdoor Signal, 1Password, Slack, and More

A new security exploit has been discovered that lets attackers slip unsigned code into widely used Electron-based desktop apps, including Signal, 1Password, Slack, and Google Chrome, by evading built-in code integrity checks. The flaw, tracked as Electron CVE-2025-55305, arises because Electron’s fuses, EnableEmbeddedAsarIntegrityValidation and OnlyLoadAppFromAsar, do not cover V8 heap snapshots, which load precompiled JavaScript state into memory.

An attacker with write access to an app installation folder can tamper with these snapshots to backdoor the app without breaking code signatures, and the modified snapshot runs before any integrity checks on startup.

Shadow demonstrated proof-of-concept backdoors for Slack, 1Password and Signal, and the researchers reported the flaw to Electron’s maintainers, who issued a patch; 1Password fixed the issue in v8.11.8-40, with Slack and Signal releasing updates as well, according to Trail of Bits responsible disclosure. Jacob DePriest, CISO at 1Password, said protecting customers’ data is their highest priority. Users are advised to update to the latest versions of Signal, 1Password, Slack and other Electron apps without delay.