AIKIDO-2026-115347

TL;DR

The updater plugin's check IPC command accepts an allowDowngrades boolean from frontend JavaScript, and the default permission set grants the WebView access to invoke this command. Setting allowDowngrades to true switches the version comparator from requiring a newer version to only requiring a different version, disabling the updater's only anti-rollback check. Any Cross-Site Scripting in the frontend can invoke this command and replay an old, validly signed build to force the application back to a version that was already patched. The fix moves the allowDowngrades option into application level Rust configuration so WebView code can no longer set it, and it now defaults to false.