diff --git a/lib/browser/guest-window-manager.js b/lib/browser/guest-window-manager.js
index b9aaaa6ce5bc..35a1432d6563 100644
--- a/lib/browser/guest-window-manager.js
+++ b/lib/browser/guest-window-manager.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const electron = require('electron');
+const nodeUrl = require('url');
 const { BrowserWindow } = electron;
 const { isSameOrigin } = process.electronBinding('v8_util');
 const { ipcMainInternal } = require('@electron/internal/browser/ipc-main-internal');
@@ -181,9 +182,8 @@ const isNodeIntegrationEnabled = function (sender) {
 
 // Checks whether |sender| can access the |target|:
 const canAccessWindow = function (sender, target) {
-  return isChildWindow(sender, target) ||
-         isScriptableWindow(sender, target) ||
-         isNodeIntegrationEnabled(sender);
+  return isScriptableWindow(sender, target) ||
+         (isChildWindow(sender, target) && isNodeIntegrationEnabled(sender));
 };
 
 // Routed window.open messages with raw options
@@ -191,6 +191,12 @@ ipcMainInternal.on('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_OPEN', (event, url, fra
   if (url == null || url === '') url = 'about:blank';
   if (frameName == null) frameName = '';
   if (features == null) features = '';
+  const parsedSourceURL = nodeUrl.parse(event.sender.getURL());
+  const parsedTargetURL = nodeUrl.parse(url);
+  if (parsedTargetURL.protocol === 'file:' && parsedSourceURL.protocol !== 'file:') {
+    event.returnValue = null;
+    return;
+  }
 
   const options = {};