> Can you explain how the process-level sandbox is broken using webviews? Sure thing. It's the node integration that's an issue. To let the render processes im

> Can you explain how the process-level sandbox is broken using webviews? Sure thing. It's the node integration that's an issue. To let the render processes import node's APIs, the process-level sandbox had to be removed. Whether node-integration is enabled or not, that process-level sandbox is gone. The javascript sandbox is still present, but the os-enforced sandbox is gone. This situation isn't totally unsafe, but it's not as safe as it can be. The process-level sandbox acts as a strong second-line of defense against API compromises. For a project that doesn't need node integration in the browser (such as Beaker) then it'd be best to re-add it. > I hope y'all don't have to fork Electron but instead can upstream your changes. That would be nice! The team that works on Electron is superb, but they've explicitly stated, in conversations with the Brave team, that they're not interested in supporting Browser projects such as Brave or Beaker.[1] Their position is reasonable - though obviously I'd prefer they changed it. I'll stay in touch with them, and do my best to contribute upstream when it makes sense. If I don't have to fork, in the end, I certainly won't. 1. https://github.com/electron/electron/issues/5210 https://github.com/electron/electron/issues/5210