Re:Serious Chrome zero-day
by AgentME on Wednesday March 06, 2019 @04:21PM
(#19322917)
If the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functionality would do that.
[ Parent
| on HN ]
Which is a massive security issue in itself--Electron documentation even warns you about this.
Electron's docs (https://electronjs.org/docs/tutorial/security#isolation-for-...) mention that you should webview or BrowserView with a certain option with untrusted content, not that it shouldn't be done at all.
Re:Serious Chrome zero-day
by nickysielicki on Wednesday March 06, 2019 @04:36PM
(#19323090)
Do most Electron apps make use of CSP? eg: is it an inherent part of the build process, or is it something that the developer needs to explicitly add?
The thing seems to be linked to FileReader. Maybe just linking to an external image is enough.
FileReader is not related to an image tag loading its image, it's a javascript API: https://developer.mozilla.org/en-US/docs/Web/API/FileReader
So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.