Why there is no Chrome Webview/Firefox Webview on Windows?

There is only Edge webview runtime on Windows.

This is why Electron exists.

2 Likes

Electron unfortunately is not a replacement for a WebView and has vastly different security properties. Electron apps often have severe security issues compared to a Chromium-based WebView:

  • Not keeping up with security updates
  • Deactivated sandbox
  • If sandbox is enabled, lax IPC and permissions allow for easy sandbox escapes and access to sensitive data
  • Exposing huge attack surface, despite not keeping the security of Chromium intact.
  • Electron should never be used with untrusted web content. WebView can do that.

See Critical vuln that lets miscreants hijack computers via Slack? *Sucks in air* We'll give you $1,750 for it • The Register
and
Platform Security Part Deux with Justin Schuh (search for “electron”)

2 Likes

More info from Daniel Micay here as well.

Huge bummer that Signal chose to use Electron on desktop, same with Proton’s mail desktop app. :pensive:

4 Likes

This is why I use PWAs when I can. For the 90% of Electron apps that are little more than repackaged websites with little need for the deeper OS integration that Electron sometimes provides, it’s basically just swapping out the dubious separate install of Chromium that may be outdated or have weaker security measures in place with your trusted, up-to-date browser that also guarantees you more privacy features in the case of something like Brave, especially since extensions like uBlock Origin also work inside of PWAs.