Client execution is a class of attack where a vulnerability in an endpoint application lets an attacker run code on that device. The “client” is the software the user is actively running, such as a browser, chat app, or meeting tool. If the app safely processes untrusted content, the attack fails; if it does not, the attacker’s input can be turned into executable actions on the endpoint.
This matters because code running on a user’s machine can lead to data theft, credential capture, malware installation, or further movement inside a network. In real attacks, client execution often appears in features that handle shared content, rich media, previews, or parsing logic. Defenses include prompt patching, reducing feature exposure, sandboxing, and limiting risky capabilities with least privilege so a flaw in the client does not become full device compromise.