Not enough, using "host files" won't protect from websocket/blob/webrtc/base64 injections.