I wonder how widespread the issue might actually be, given the description at the end:

" can allow for remote code execution provided that the application is using a vulnerable version of Electron (version < 1.7.13, < 1.8.4, or < 2.0.0-beta.3) , and hasn't manually opted into one of the following:

* Declared webviewTag: false in its webPreferences.

* Enabled the nativeWindowOption option in its webPreferences.

* Intercepting new-window events and overriding event.newGuest without using the supplied options tag. "