Add explicit security related flags to browser windows

src/node/StreamWindow.js

@@ -95,7 +95,12 @@ export default class StreamWindow extends EventEmitter {
   createView() {
     const { win, overlayView, viewActions } = this
     const view = new BrowserView({
-      webPreferences: { partition: 'persist:session', sandbox: true },
+      webPreferences: {
+        nodeIntegration: false,
+        contextIsolation: true,
+        partition: 'persist:session',
+        sandbox: true,
+      },
     })
     view.setBackgroundColor('#000')
 

src/node/index.js

@@ -81,7 +81,12 @@ async function main() {
     } else if (msg.type === 'browse') {
       if (!browseWindow || browseWindow.isDestroyed()) {
         browseWindow = new BrowserWindow({
-          webPreferences: { partition: 'persist:session', sandbox: true },
+          webPreferences: {
+            nodeIntegration: false,
+            contextIsolation: true,
+            partition: 'persist:session',
+            sandbox: true,
+          },
         })
       }
       browseWindow.loadURL(msg.url)