Electron Security: Limit Renderer Privileges
A desktop app displays remote content with too much access to Node or the operating system. This guide gives you a small, testable way to approach the issue before changing a live system.
A practical workflow
- Keep context isolation on, expose a narrow preload API and validate IPC messages.
- Review navigation and external link handling before shipping.
What to check
A desktop wrapper does not make untrusted web content safe. Compare the result with the original problem and record what changed. If a measurement or test does not support the change, revisit the assumption rather than adding more complexity.
Keep the experiment small enough to reverse. Document the starting state, the change and the result so another person can repeat the process. Product menus and versions can change, so check the current documentation for your environment.
Official reference: Read the documentation.