Kong · jackkav · May 21, 2026
diff --git a/packages/insomnia/src/main/window-utils.ts b/packages/insomnia/src/main/window-utils.ts
@@ -201,7 +201,6 @@ export function createWindow(): ElectronBrowserWindow {
       zoomFactor: getZoomFactor(),
       nodeIntegration: true,
       nodeIntegrationInWorker: false, // must remain false to ensure the nunjucks web worker sandbox does not have access to Node.js APIs
-      webviewTag: true,
       // TODO: enable context isolation
       contextIsolation: false,
       disableBlinkFeatures: 'Auxclick',

diff --git a/packages/insomnia/src/ui/components/viewers/response-viewer.tsx b/packages/insomnia/src/ui/components/viewers/response-viewer.tsx
@@ -283,7 +283,7 @@ export const ResponseViewer = ({
         body={getBodyAsString()}
         key={disableHtmlPreviewJs ? 'no-js' : 'yes-js'}
         url={url}
-        webpreferences={`disableDialogs=true, javascript=${disableHtmlPreviewJs ? 'no' : 'yes'}`}
+        disableHtmlPreviewJs={disableHtmlPreviewJs}
       />
     );
   }

diff --git a/packages/insomnia/src/ui/components/viewers/response-web-view.test.ts b/packages/insomnia/src/ui/components/viewers/response-web-view.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest';
+
+import { getResponsePreviewHtml, getResponsePreviewSandbox } from './response-web-view';
+
+describe('response-web-view', () => {
+  it('injects a base tag into the document head', () => {
+    expect(getResponsePreviewHtml('<html><head></head><body>Hello</body></html>', 'https://example.com/path/')).toBe(
+      '<html><head><base href="https://example.com/path/"></head><body>Hello</body></html>',
+    );
+  });
+
+  it('keeps scripts disabled when HTML preview JS is turned off', () => {
+    expect(getResponsePreviewSandbox(true)).toBe('');
+  });
+
+  it('allows scripts when HTML preview JS is enabled', () => {
+    expect(getResponsePreviewSandbox(false)).toBe('allow-scripts');
+  });
+});
diff --git a/packages/insomnia/src/ui/components/viewers/response-web-view.tsx b/packages/insomnia/src/ui/components/viewers/response-web-view.tsx
@@ -1,30 +1,24 @@
-import React, { type FC, useEffect, useRef } from 'react';
+import React, { type FC } from 'react';
 
 interface Props {
   body: string;
   url: string;
-  webpreferences: string;
+  disableHtmlPreviewJs: boolean;
 }
-export const ResponseWebView: FC<Props> = ({ webpreferences, body, url }) => {
-  const webviewRef = useRef<Electron.WebviewTag>(null);
 
-  useEffect(() => {
-    const webview = webviewRef.current;
-    const handleDOMReady = () => {
-      if (webview) {
-        webview.removeEventListener('dom-ready', handleDOMReady);
-        const bodyWithBase = body.replace('<head>', `<head><base href="${url}">`);
-        webview.loadURL(`data:text/html; charset=utf-8,${encodeURIComponent(bodyWithBase)}`);
-      }
-    };
-    if (webview) {
-      webview.addEventListener('dom-ready', handleDOMReady);
-    }
-    return () => {
-      if (webview) {
-        webview.removeEventListener('dom-ready', handleDOMReady);
-      }
-    };
-  }, [body, url]);
-  return <webview data-testid="ResponseWebView" ref={webviewRef} src="about:blank" webpreferences={webpreferences} />;
+export const getResponsePreviewHtml = (body: string, url: string) => body.replace('<head>', `<head><base href="${url}">`);
+
+export const getResponsePreviewSandbox = (disableHtmlPreviewJs: boolean) =>
+  disableHtmlPreviewJs ? '' : 'allow-scripts';
+
+export const ResponseWebView: FC<Props> = ({ body, disableHtmlPreviewJs, url }) => {
+  return (
+    <iframe
+      className="h-full w-full border-0"
+      data-testid="ResponseWebView"
+      sandbox={getResponsePreviewSandbox(disableHtmlPreviewJs)}
+      srcDoc={getResponsePreviewHtml(body, url)}
+      title="HTML response preview"
+    />
+  );
 };