Often they can, if they don't use certain features not yet encapsulated in webapps. Most of it is about trust, and you'll see certain web APIs built around ask

Often they can, if they don't use certain features not yet encapsulated in webapps. Most of it is about trust, and you'll see certain web APIs built around asking for permission to access the camera, or image files or whatever. Desktop apps often can't really trust each other. It's not a problem right now, but if you could XSS something into a game or social app which, with user-level permissions on your desktop could remote-control (for example click-simulating) your electron banking app, that would be really bad. Just a contrived example, but with great power comes great exploitability.