feat: add webPreferences.enableRemoteModule option (#13028)

docs/api/browser-window.md

@@ -270,6 +270,8 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
       are more limited. Read more about the option [here](sandbox-option.md).
       **Note:** This option is currently experimental and may change or be
       removed in future Electron releases.
+    * `enableRemoteModule` Boolean (optional) - Whether to enable the [`remote`](remote.md) module.
+      Default is `true`.
     * `session` [Session](session.md#class-session) (optional) - Sets the session used by the
       page. Instead of passing the Session object directly, you can also choose to
       use the `partition` option instead, which accepts a partition string. When

docs/api/clipboard.md

@@ -4,6 +4,9 @@
 
 Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer-process)
 
+In the renderer process context it depends on the [`remote`](remote.md) module on Linux,
+it is therefore not available when this module is disabled.
+
 The following example shows how to write a string to the clipboard:
 
 ```javascript

docs/api/remote.md

@@ -24,6 +24,10 @@ win.loadURL('https://github.com')
 **Note:** For the reverse (access the renderer process from the main process),
 you can use [webContents.executeJavaScript](web-contents.md#contentsexecutejavascriptcode-usergesture-callback).
 
+**Note:** The remote module can be disabled for security reasons in the following contexts:
+- [`BrowserWindow`](browser-window.md) - by setting the `enableRemoteModule` option to `false`.
+- [`<webview>`](webview-tag.md) - by setting the `enableremotemodule` attribute to `false`.
+
 ## Remote Objects
 
 Each object (including functions) returned by the `remote` module represents an
@@ -180,7 +184,7 @@ belongs.
 **Note:** Do not use `removeAllListeners` on [`BrowserWindow`](browser-window.md).
 Use of this can remove all [`blur`](https://developer.mozilla.org/en-US/docs/Web/Events/blur)
 listeners, disable click events on touch bar buttons, and other unintended
-consequences.  
+consequences.
 
 ### `remote.getCurrentWebContents()`
 

docs/api/screen.md

@@ -7,6 +7,9 @@ Process: [Main](../glossary.md#main-process), [Renderer](../glossary.md#renderer
 You cannot require or use this module until the `ready` event of the `app`
 module is emitted.
 
+In the renderer process context it depends on the [`remote`](remote.md) module,
+it is therefore not available when this module is disabled.
+
 `screen` is an [EventEmitter](https://nodejs.org/api/events.html#events_class_eventemitter).
 
 **Note:** In the renderer / DevTools, `window.screen` is a reserved DOM

docs/api/webview-tag.md

@@ -126,6 +126,15 @@ integration and can use node APIs like `require` and `process` to access low
 level system resources. Node integration is disabled by default in the guest
 page.
 
+### `enableremotemodule`
+
+```html
+<webview src="http://www.google.com/" enableremotemodule="false"></webview>
+```
+
+When this attribute is `false` the guest page in `webview` will not have access
+to the [`remote`](remote.md) module. The remote module is avaiable by default.
+
 ### `plugins`
 
 ```html
@@ -613,6 +622,9 @@ Shows pop-up dictionary that searches the selected word on the page.
 Returns [`WebContents`](web-contents.md) - The web contents associated with
 this `webview`.
 
+It depends on the [`remote`](remote.md) module,
+it is therefore not available when this module is disabled.
+
 ## DOM events
 
 The following DOM events are available to the `webview` tag: