The thing seems to be linked to FileReader. Maybe just linking to an external image is enough.
So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.