Bananatron and the disappointing state of Electron app security

Last fall, we built Bananatron , a black-box auditing framework for Electron apps. We used Bananatron to audit 112 popular Electron apps and discovered several real-world vulnerabilities. We also found that the overall landscape of Electron app security is overwhelmingly poor. A majority of apps enable insecure Electron features that automatically escalate common web vulnerabilities into…