Superhuman Desktop — cross-origin NativeApi PoC

window.NativeApi bridge

…

Arbitrary local file read via NativeApi.readLocalFile()

…

Exfiltration to attacker server

…