Electron Releases

• Internal guest-view IPCs (attach/detach/call/property get/set) are honoured only from the frame that created the <webview>.
• The internal window.close() IPC is honoured only from the top-level document; replies to webContents.executeJavaScript() / insertCSS() are accepted only from the frame they were sent to; webContents.sendToFrame() only addresses frames of that WebContents; process.getProcessMemoryInfo() is scoped to the caller's process.
• Docs: the security.md sender-validation example checks senderFrame.origin; webview-tag.md points at the main-process ipc-message event for identifying the sending frame.

Notes: Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame.