fix: check process.isMainFrame in sandboxed_renderer/init.js (#16500)

lib/renderer/web-view/web-view-init.js

@@ -17,7 +17,7 @@ function handleFocusBlur (guestInstanceId) {
 }
 
 module.exports = function (contextIsolation, webviewTag, guestInstanceId) {
-  // Load webview tag implementation.
+  // Don't allow recursive `<webview>`.
   if (webviewTag && guestInstanceId == null) {
     const webViewImpl = require('@electron/internal/renderer/web-view/web-view-impl')
     if (contextIsolation) {

lib/sandboxed_renderer/init.js

@@ -127,7 +127,9 @@ switch (window.location.protocol) {
 const guestInstanceId = binding.guestInstanceId && parseInt(binding.guestInstanceId)
 
 // Load webview tag implementation.
-require('@electron/internal/renderer/web-view/web-view-init')(contextIsolation, isWebViewTagEnabled, guestInstanceId)
+if (process.isMainFrame) {
+  require('@electron/internal/renderer/web-view/web-view-init')(contextIsolation, isWebViewTagEnabled, guestInstanceId)
+}
 
 const errorUtils = require('@electron/internal/common/error-utils')
 
@@ -176,4 +178,6 @@ try {
 }
 
 // Warn about security issues
-require('@electron/internal/renderer/security-warnings')()
+if (process.isMainFrame) {
+  require('@electron/internal/renderer/security-warnings')()
+}