Is there not a switch that you can flip in electron saying "only run JS code from external files where URL origin == app archive"? Limiting external web request

Is there not a switch that you can flip in electron saying "only run JS code from external files where URL origin == app archive"? Limiting external web requests to only your own domains would also fix this for the "basically Mozilla Prism" class of electron apps. That seems like it would make XSS basically impossible for these apps and surely easier to adapt to than a full sandbox. Pretty much the only attack vector left then is exploiting various media/data formats to gain proper RCE - but how is that any different than a usual desktop app?