Electron's docs (https://electronjs.org/docs/tutorial/security#isolation-for-...) mention that you should webview or BrowserView with a certain option with untrusted content, not that it shouldn't be done at all.