I disagree; the issue is Electron. Sure, you can write secure apps in Electron, just like you can do risky stuff in real-life and be fine most of the time. But

I disagree; the issue is Electron. Sure, you can write secure apps in Electron, just like you can do risky stuff in real-life and be fine most of the time. But why take the risk? Had the app been written with a native language and SDK, they wouldn’t need to worry about escaping or anything. I have yet to hear about getting remote code execution for dumping text into an UILabel or similar, while XSS happens almost every day.