11 ms·

If your Electron app executes third party, remote code. But if it does, you should definitely not use it.

• gruez 5y ago
  >If your Electron app executes third party, remote code. There's a high chance that it does because of embedded content/ads/iframes/in-app browsers.
  • mr_toad 5y ago
    Which electron apps have embedded ads running third party JavaScript? That’s a huge security risk.
  • kentonv 5y ago
    Are in-app browsers in Electron even secure in the first place? Does it use Chrome-style sandboxing with multiple processes, etc.? Do bugs in the Electron engine get patched in a timely fashion? Genuinely asking here. I've never written an Electron app personally so I don't know how this stuff is done exactly, but the idea of in-app browsers in Electron apps sounds terrifying to me, security-wise.
    • mwcampbell 5y ago
      Electron has been moving toward security by default in renderer processes, but Chromium sandboxing isn't yet enabled by default in these processes. More here: https://www.electronjs.org/docs/latest/tutorial/sandbox https://www.electronjs.org/docs/latest/tutorial/sandbox