Hacker News Reader

Is Electron at risk too?

Visual Studio Code is built with Electron. VSCode has lots of extensions available. Can a VSCode extension exploit this 0day?

If your Electron app executes third party, remote code. But if it does, you should definitely not use it.

>If your Electron app executes third party, remote code.

There's a high chance that it does because of embedded content/ads/iframes/in-app browsers.

Which electron apps have embedded ads running third party JavaScript? That’s a huge security risk.

Are in-app browsers in Electron even secure in the first place? Does it use Chrome-style sandboxing with multiple processes, etc.? Do bugs in the Electron engine get patched in a timely fashion?

Genuinely asking here. I've never written an Electron app personally so I don't know how this stuff is done exactly, but the idea of in-app browsers in Electron apps sounds terrifying to me, security-wise.

Electron has been moving toward security by default in renderer processes, but Chromium sandboxing isn't yet enabled by default in these processes. More here: https://www.electronjs.org/docs/latest/tutorial/sandbox

Reply on news.ycombinator.com