Presumably this affects all electron apps which embed chrome too? Don’t they pin the chrome version?

Yes, but it's only a vulnerability if the app allows rendering untrusted HTML or visiting untrusted websites, which most Electron apps don't.