Electron App Escape — XSS to RCE

An Electron app is a web page wearing a native costume — Chromium on top, full Node.js underneath. When the two layers are fused together by a careless config, a single cross-site scripting bug stops being “steal a cookie” and becomes run a command on the user’s laptop. This is how XSS turns into RCE on the desktop.