Let's learn how to attack “Modern Desktop” applications. Specifically we will look at the blurring lines between desktop and web applications, and how embedded (browsers) renders can be exploited, the methods for discovering exploits, and how they can be fixed. On this journey we go over remote code execution vulnerabilities I discovered in apps like Teams, Outlook, Facebook Workplace, chat apps like Slack and Google Chat, and even a Docker sandbox escape. I will also be introducing a new IAST (interactive application security testing) tool I developed to help find these issues. Last and most importantly look at how to prevent / fix these issues in your applications.