[Erlich_Bachman]

What is the attack vector that this protects against? Electron apps don't usually just run user-provided code off the internet? They just run the code provided by the app vendor?

[pvg]

XSS in the app or things it displays/depends on end up being RCE on the client.