If the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functionality would do that.

Which is a massive security issue in itself--Electron documentation even warns you about this.

Electron's docs (https://electronjs.org/docs/tutorial/security#isolation-for-...) mention that you should webview or BrowserView with a certain option with untrusted content, not that it shouldn't be done at all.

Do most Electron apps make use of CSP? eg: is it an inherent part of the build process, or is it something that the developer needs to explicitly add?

The thing seems to be linked to FileReader. Maybe just linking to an external image is enough.

FileReader is not related to an image tag loading its image, it's a javascript API: https://developer.mozilla.org/en-US/docs/Web/API/FileReader

So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.

They are very likely to be vulnerable.

> uses up all your resources > is enormous in size for no reason > javascript

Ok, agreed.