3 ms·
The thing seems to be linked to FileReader. Maybe just linking to an external image is enough.
by hartator 8y ago
The thing seems to be linked to FileReader. Maybe just linking to an external image is enough.
- idlewan 8y agoFileReader is not related to an image tag loading its image, it's a javascript API: https://developer.mozilla.org/en-US/docs/Web/API/FileReader https://developer.mozilla.org/en-US/docs/Web/API/FileReader So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.