Electron

VS Code extension authors often assume XSS is “just a web app problem.” That’s a mistake. If your extension uses a webview, custom editor, notebook renderer, or any HTML UI at all, you’re building a mini browser surface inside an editor that developers trust deeply. That trust changes the impact. A sloppy XSS bug in a marketing site is bad. A sloppy XSS bug in a VS Code extension can expose workspace data, abuse extension APIs indirectly, phish secrets, or trick users into running commands. ...

Electron gives web developers a fast path to desktop apps. That speed comes with a nasty tradeoff: an XSS bug in Electron can become a local code execution bug if you wire things carelessly. That’s the core difference from browser-only XSS. In a normal website, XSS usually means session theft, UI redressing, or data exfiltration. In Electron, XSS can cross the line into filesystem access, shell execution, credential theft, and full app compromise. ...