> it's just an obscure way to hack yourself. that's only true for applications that strictly only ever work on and display content that the user has created th

> it's just an obscure way to hack yourself. that's only true for applications that strictly only ever work on and display content that the user has created themselves. This is an increasingly rare type of application in the age of the internet and social media to the point where I would argue that most applications these days interact with data created by other users (think opening an image file, displaying a chat message, displaying an email, etc). With Electron you're setting yourself up in a way where a single case of a forgotten input escaping automatically means a remote code execution attack. On websites, XSS certainly are a bad thing, but they are still somewhat limited in scope and generic mitigations exists in many browsers. In Electron apps, an XSS means an RCE unless you make use of features like `conextIsolation`. Reading your comment makes it obvious to me that this isn't already a well-known issue. People generally aren't aware or believe their type of application to be immune and thus it would, and that's the point of my initial comment, make sense to either default to secure or at least default to asking the user to specifically make the decision to be insecure. Defaulting to turning every XSS attack into an RCE seems to me like a very bad decision.