diff --git a/lib/javascript.js b/lib/javascript.js
index bbe0fc85..be1cdb27 100644
--- a/lib/javascript.js
+++ b/lib/javascript.js
@@ -5,62 +5,48 @@
 var minstache = require('minstache')
 
 /**
- * Run the `src` function on the client-side, capture
- * the response and logs, and send back via
- * ipc to electron's main process
+ * Run the `src` function on the client-side, resolve
+ * with result, or reject with error
  */
 
 var execute = `
 (function javascript () {
-  var nightmare = window.__nightmare || window[''].nightmare;
-  try {
-    var fn = ({{!src}}), 
-      response, 
-      args = [];
-
-    {{#args}}args.push({{!argument}});{{/args}}
-
-    if(fn.length - 1 == args.length) {
-      args.push(((err, v) => {
-          if(err) return nightmare.reject(err);
-          nightmare.resolve(v);
-        }));
-      fn.apply(null, args);
-    } 
-    else {
-      response = fn.apply(null, args);
-      if(response && response.then) {
-        response.then((v) => {
-          nightmare.resolve(v);
-        })
-        .catch((err) => {
-          nightmare.reject(err)
-        });
+  return new Promise((resolve, reject) => {
+    try {
+      var fn = ({{!src}});
+      var args = [];
+
+      {{#args}}args.push({{!argument}});{{/args}}
+
+      if(fn.length - 1 == args.length) {
+        args.push(((err, v) => {
+            if(err) reject(err);
+            resolve(v);
+          }));
+        fn.apply(null, args);
       } else {
-        nightmare.resolve(response);
+        resolve(fn.apply(null, args));
       }
+    } catch(err) {
+      reject(err);
     }
-  } catch (err) {
-    nightmare.reject(err);
-  }
+  });
 })()
 `
 
 /**
- * Inject the `src` on the client-side, capture
- * the response and logs, and send back via
- * ipc to electron's main process
+ * Inject the `src` on the client-side, resolve
+ * with result, or reject with error
  */
-
 var inject = `
 (function javascript () {
-  var nightmare = window.__nightmare || window[''].nightmare;
-  try {
-    var response = (function () { {{!src}} \n})()
-    nightmare.resolve(response);
-  } catch (e) {
-    nightmare.reject(e);
-  }
+  return new Promise((resolve, reject) => {
+    try {
+      resolve((function () { {{!src}} \n})());
+    } catch(err) {
+      reject(err);
+    }
+  });
 })()
 `
 
diff --git a/lib/preload.js b/lib/preload.js
index aff8448b..1739318b 100644
--- a/lib/preload.js
+++ b/lib/preload.js
@@ -7,24 +7,6 @@ function send(_event) {
   ipc.send.apply(ipc, arguments)
 }
 
-// offer limited access to allow
-// .evaluate() and .inject()
-// to continue to work as expected.
-//
-// TODO: this could be avoided by
-// rewriting the evaluate to
-// use promises instead. But
-// for now this fixes the security
-// issue in: segmentio/nightmare/#1358
-window.__nightmare = {
-  resolve: function(value) {
-    send('response', value)
-  },
-  reject: function(err) {
-    send('error', error(err))
-  }
-}
-
 // Listen for error events
 window.addEventListener(
   'error',
diff --git a/lib/runner.js b/lib/runner.js
index 36ab45c9..a01a1b99 100644
--- a/lib/runner.js
+++ b/lib/runner.js
@@ -373,26 +373,13 @@ app.on('ready', function() {
    */
 
   parent.respondTo('javascript', function(src, done) {
-    var onresponse = (event, response) => {
-      renderer.removeListener('error', onerror)
-      renderer.removeListener('log', onlog)
-      done(null, response)
-    }
-
-    var onerror = (event, err) => {
-      renderer.removeListener('log', onlog)
-      renderer.removeListener('response', onresponse)
-      done(err)
-    }
-
-    var onlog = (event, args) => parent.emit.apply(parent, ['log'].concat(args))
-
-    renderer.once('response', onresponse)
-    renderer.once('error', onerror)
-    renderer.on('log', onlog)
-
-    //parent.emit('log', 'about to execute javascript: ' + src);
     win.webContents.executeJavaScript(src)
+      .then(response => {
+        done(null, response)
+      })
+      .catch(err => {
+        done(err)
+      })
   })
 
   /**