Getting absolute file path from file input in isolated environment

I am new to Electron, so sorry if this was discussed or described somewhere already.

I am interested whether I can get the absolute file path from file input. HTML is displayed inside a BrowserView, which has nodeIntegration disabled and contextIsolation enabled.
My simple test does return a valid file path in this case, though my understanding is that it shouldn’t.
Maybe I am missing something? That looks like a security vulnerability…

Code:

main.js

const { app, BrowserWindow, BrowserView } = require('electron');

let mainWindow;

const createWindow = () => {
  // Create the browser window.
  mainWindow = new BrowserWindow({
    width: 800,
    height: 600,
  });

  let view = new BrowserView({
    webPreferences: {
      nodeIntegration: false,
      contextIsolation: true
    }
  })
  mainWindow.setBrowserView(view)
  view.setBounds({ x: 0, y: 0, width: 800, height: 600 })
  view.webContents.loadURL('http://localhost:8000/index.html')

  mainWindow.on('closed', () => {
    mainWindow = null;
  });
};
app.on('window-all-closed', () => {
  if (process.platform !== 'darwin') {
    app.quit();
  }
});

app.on('activate', () => {
  if (mainWindow === null) {
    createWindow();
  }
});

index.html

<html>
  <script type="text/javascript">
  function _on_file_change_() {
    file_input = document.getElementById('file1');
    console.log(file_input.files[0]);
  }
  </script>
  <head>
    <meta charset="UTF-8">
    <title>Hello World!</title>
  </head>
  <body>
    <input type="file" id='file1' onchange="_on_file_change_(this.files)"/>
  </body>
</html>