chore(deps): update dependency electron to v39 [security] by renovate[bot] · Pull Request #9618 · wireapp/wire-desktop

renovate · 2026-04-22T13:39:14Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
electron	`38.8.6` → `39.8.10`

Electron: Use-after-free in offscreen child window paint callback

CVE-2026-34774 / GHSA-532v-xpq5-8h95

More information

Details

Impact

Apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected.

Workarounds

Deny child window creation from offscreen renderers in your setWindowOpenHandler, or ensure child windows are closed before the parent is destroyed.

Fixed Versions

41.0.0
40.7.0
39.8.1

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Use-after-free in offscreen shared texture release() callback

CVE-2026-34764 / GHSA-8x5q-pvf5-64mp

More information

Details

Impact

Apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that do not enable shared-texture offscreen rendering are not affected.

Workarounds

Ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable.

Fixed Versions

42.0.0-alpha.5
41.1.0
40.8.5
39.8.5

For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Crash in clipboard.readImage() on malformed clipboard image data

CVE-2026-34781 / GHSA-f37v-82c4-4x64

More information

Details

Impact

Apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process.

Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution.

Workarounds

Validate that the clipboard contains image data via clipboard.availableFormats() before calling clipboard.readImage(). Note this only narrows the window — upgrading to a fixed version is recommended.

Fixed Versions

42.0.0-alpha.5
41.1.0
40.8.5
39.8.5

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 2.8 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Parent process code-sign check is spoofable

CVE-2026-70597 / GHSA-jm7p-cc5g-qwxx

More information

Details

Impact

On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check; a local attacker could bypass it and run their own code inside the signed app, inheriting its TCC permissions and keychain access.

Apps are only affected if they enable those macOS fuse-based restrictions. Apps that do not enable them are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.0
39.8.8

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

CVE-2026-70598 / GHSA-pfmc-3mgc-p6fp

More information

Details

Impact

In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen) and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.0
39.8.10

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 3.9 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

CVE-2026-70599 / GHSA-9pf5-hg6p-4pwp

More information

Details

Impact

For serial-port and media (camera / microphone) permission checks made from an iframe, the requestingOrigin passed to session.setPermissionCheckHandler was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe device access intended only for the top-level origin.

Apps are only affected if they use setPermissionCheckHandler with origin-based logic and embed cross-origin iframes with delegated device permissions. Apps that base the decision on details.securityOrigin, or that do not embed such iframes, are not affected.

Workarounds

Check details.securityOrigin instead of requestingOrigin for these permissions, or do not delegate device permissions to untrusted iframes.

Fixed Versions

42.0.0-beta.1
41.2.0
40.9.0
39.8.7

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Cross-origin iframe can position native autofill popup

CVE-2026-70600 / GHSA-x8rc-wpg4-grpf

More information

Details

Impact

The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI.

Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected.

Workarounds

Do not embed untrusted content in iframes inside windows that display trusted UI.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.0
39.8.8

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 3.1 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Context isolation bypass via Function.prototype.bind hijack

CVE-2026-70601 / GHSA-h7rp-cf8h-j98x

More information

Details

Impact

Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access.

Apps are affected if they expose Promise-returning functions via contextBridge — the standard pattern for wrapping ipcRenderer.invoke — in windows that load untrusted content. Apps that never load untrusted content in those windows are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

42.0.0-beta.5
41.2.2
40.9.2
39.8.9

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: shell.openPath path validation bypass via embedded null byte

CVE-2026-70603 / GHSA-5c9j-mhmv-5xgx

More information

Details

Impact

shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths (for example, checking the file extension) before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation.

Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. Node's fs APIs already reject paths containing null bytes, so apps that call fs.existsSync(), fs.stat(), or similar before shell.openPath() are not affected. Apps that do not call shell.openPath() with untrusted input are not affected.

Workarounds

Reject any path containing a null byte before passing it to shell.openPath():

if (filePath.includes('\0')) throw new Error('invalid path');

Fixed Versions

42.0.0-beta.1
41.1.1
40.9.0
39.8.6

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

CVSS Score: 6.0 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Extension tab APIs operate across session boundaries

CVE-2026-70602 / GHSA-m55f-7gqj-fr98

More information

Details

Impact

Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session.

Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. Apps that do not load extensions, or that use a single session, are not affected.

Workarounds

Only load extensions from sources you trust; do not rely on session separation alone to contain an extension.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.0
39.8.8

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 6.6 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

CVE-2026-70604 / GHSA-v3j7-r9gq-3gjw

More information

Details

Impact

A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked.

Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.

Workarounds

Set corsEnabled: true on schemes that must enforce CORS, and validate the request Origin in your protocol handler before returning sensitive data.

Fixed Versions

42.0.0
41.4.0
40.9.3
39.8.10

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: HTTP redirect followed into local file loader

CVE-2026-70605 / GHSA-v64r-4m7r-3mvq

More information

Details

Impact

When following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed.

Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed (the default) and expose the response body. Apps that only request fixed, trusted URLs are not affected.

Workarounds

Set redirect: 'error' or redirect: 'manual' on requests to untrusted URLs and validate any redirect target before following it.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.0
39.8.8

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: window.open features string controls some window options considered privileged

CVE-2026-70607 / GHSA-v93f-fgjr-hjrj

More information

Details

Impact

Some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths.

Apps are only affected if untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler. Apps that deny window.open() for untrusted content, or set overrideBrowserWindowOptions explicitly, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for untrusted content, or supply overrideBrowserWindowOptions so every window option is set explicitly.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.0
39.8.8

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

CVE-2026-70609 / GHSA-4f78-qhmw-8j8m

More information

Details

Impact

The mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js.

Apps are only affected if untrusted input can reach the mode argument of openDevTools(), or if untrusted content can call openDevTools() on a <webview> it embeds. Apps that only ever pass a fixed dock mode are not affected.

Workarounds

Only pass fixed, allowlisted values (right, bottom, undocked, detach) as the DevTools mode, and do not expose openDevTools to untrusted content.

Fixed Versions

42.0.0-beta.1
41.2.0
40.9.0
39.8.7

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 5.7 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

CVE-2026-70608 / GHSA-9f4c-93c8-jc8g

More information

Details

Impact

A sandboxed iframe without the allow-popups keyword could still open a new window (or trigger setWindowOpenHandler) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction.

Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected. Apps that deny window creation in setWindowOpenHandler, or that do not embed untrusted content in sandboxed iframes, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for any content you do not trust, rather than relying on the iframe sandbox alone.

Fixed Versions

42.0.1
41.10.3
39.8.10

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 7.2 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: contextBridge object copy honors prototype setters

CVE-2026-70610 / GHSA-ff2p-hmqr-hxm4

More information

Details

Impact

Objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled.

Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks. Apps that only accept primitive arguments, or that validate object arguments, are not affected.

Workarounds

Validate objects received from untrusted content with own-property checks (Object.hasOwn), or copy them onto a null-prototype object before use.

Fixed Versions

42.0.0-beta.4
41.2.2
40.9.2
39.8.9

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 5.4 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: DevTools embedder handler executes arbitrary files via shell open

CVE-2026-70611 / GHSA-f2r8-jv7c-xqmp

More information

Details

Impact

The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend (such as a malicious DevTools extension) could use this to execute native code outside the sandbox.

Apps are only affected if DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. Apps that do not open DevTools in that context are not affected.

Workarounds

Do not open DevTools for windows that load untrusted content, and do not load untrusted DevTools extensions.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.2
39.8.9

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Sandboxed iframes can launch external protocol handlers

CVE-2026-70612 / GHSA-p2rr-rvmm-c5fp

More information

Details

Impact

Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers.

Apps are only affected if they render untrusted content in sandboxed iframes and grant the openExternal permission (granted by default when no setPermissionRequestHandler is installed). Apps whose permission handler denies openExternal for untrusted content are not affected.

Workarounds

Install a setPermissionRequestHandler that denies the openExternal permission for untrusted content.

Fixed Versions

42.0.0-beta.3
41.2.1
40.9.0
39.8.8

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

CVSS Score: 5.4 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

electron/electron (electron)

`v39.8.10`: electron v39.8.10

Compare Source

Release Notes for v39.8.10

[!WARNING]
Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 ^{(Also in 40, 41, 42)}
Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 ^{(Also in 42)}

Other Changes

Backported a fix for route_id validation in the GPU command buffer. #51327
Backported security fixes for 4933194, 4941583, 4932347, 4927361, 4934134, 4926688, 4962818. #51257
Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266

`v39.8.9`: electron v39.8.9

Compare Source

Release Notes for v39.8.9

Other Changes

Fixed gn gen failing to resolve electron_version when building from a git worktree checkout. #51163 ^{(Also in 40, 41, 42)}
Security: backported fixes for CVE-2026-6296, CVE-2026-6297, CVE-2026-6298, CVE-2026-6299, CVE-2026-6300, CVE-2026-6301, CVE-2026-6302, CVE-2026-6303, CVE-2026-6304, CVE-2026-6305, CVE-2026-6306, CVE-2026-6307, CVE-2026-6308, CVE-2026-6309, CVE-2026-6311, CVE-2026-6312, CVE-2026-6313, CVE-2026-6314, CVE-2026-6316, CVE-2026-6318, CVE-2026-6358, CVE-2026-6359, CVE-2026-6360, CVE-2026-6361, CVE-2026-6362, CVE-2026-6363, CVE-2026-6364. #51141

`v39.8.8`: electron v39.8.8

Compare Source

Release Notes for v39.8.8

Fixes

Fixed an issue where DevTools would re-attach to the window when opened after previously being detached. #50818 ^{(Also in 40, 41, 42)}

Other Changes

Backported fix for chromium:74266014. #50175
Backported upstream v8 fixes for several maglev, inspector, and arm64 code-generation edge cases. #50993

`v39.8.7`: electron v39.8.7

Compare Source

Release Notes for v39.8.7

Other Changes

Backported fix for 4897116. #50624
Backported fix for 4939526. #50620

`v39.8.6`: electron v39.8.6

Compare Source

Release Notes for v39.8.6

Fixes

Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50595 ^{(Also in 40, 41, 42)}

`v39.8.5`: electron v39.8.5

Compare Source

Release Notes for v39.8.5

Fixes

Fixed a crash in clipboard.readImage() when the clipboard contains malformed image data. #50493 ^{(Also in 40, 41, 42)}
Fixed a crash when calling an offscreen shared texture's release() after the texture object was garbage collected. #50499 ^{(Also in 40, 41, 42)}

`v39.8.4`: electron v39.8.4

Compare Source

Release Notes for v39.8.4

Fixes

Fixed an issue where nodeIntegrationInWorker overrides in setWindowOpenHandler were not honored for child windows sharing a renderer process with their opener. #50468 ^{(Also in 38, 40, 41)}
Fixed crash when handling JavaScript dialogs from windows opened with invalid or empty URLs. #50400 ^{(Also in 40, 41, 42)}
Fixed improper focus tracking in BaseWindow on MacOS. #50338 ^{(Also in 40, 41, 42)}
Fixed window freeze when failing to enter/exit fullscreen on macOS. #50341 ^{(Also in 40, 41, 42)}

Other Changes

Added support for using a proxy during yarn install. #50349 ^{(Also in 40, 41, 42)}
Backported fix for 4859353. #50440
Backported fix for 4893813. #50443
Backported fix for chromium:475877320. #50436
Backported fixes for 4847510, 4871177. #50461

`v39.8.3`: electron v39.8.3

Compare Source

Release Notes for v39.8.3

Fixes

Added additional ASAR support to additional fs copy methods. #50284 ^{(Also in 40, 41, 42)}
Fixed user resizing of transparent windows on win32 platform. #50300 ^{(Also in 40, 41, 42)}

`v39.8.2`: electron v39.8.2

Compare Source

Release Notes for v39.8.2

Other Changes

Backported fix for b/491421267. #50230

`v39.8.1`: electron v39.8.1

Compare Source

Release Notes for v39.8.1

Fixes

Added validation to protocol client methods to reject protocol names that do not conform to the RFC 3986 URI scheme grammar. #50156 ^{(Also in 38, 40, 41)}
Fixed an issue on macOS where calling autoUpdater.quitAndInstall() could fail if checkForUpdates() was called again after an update was already downloaded. #50215 ^{(Also in 40, 41)}
Fixed an issue where Chrome Devtools menus may not appear in certain embedded windows. #50136 ^{(Also in 40, 41)}
Fixed an issue where additionalData passed to app.requestSingleInstanceLock on Windows could be truncated or fail to deserialize in the primary instance's second-instance event. #50174 ^{(Also in 38, 40, 41)}
Fixed an issue where screen.getCursorScreenPoint() crashed on Wayland when it was called before a BrowserWindow had been created. [#50106](https://

✂ Note

PR body was truncated to here.

sonarqubecloud · 2026-05-12T11:32:40Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2026-06-11T13:51:12Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2026-07-12T13:48:55Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

renovate Bot added the renovate label Apr 22, 2026

otto-the-bot added type: chore 🧹 👕 size: S labels Apr 22, 2026

renovate Bot changed the title ~~chore(deps): update dependency electron to v39 [security]~~ chore(deps): update dependency electron to v39 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot deleted the renovate/npm-electron-vulnerability branch April 27, 2026 18:42

renovate Bot changed the title ~~chore(deps): update dependency electron to v39 [security] - autoclosed~~ chore(deps): update dependency electron to v39 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch 3 times, most recently from f22c000 to 5820fea Compare April 29, 2026 19:37

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from 5820fea to d0ccc74 Compare May 12, 2026 11:32

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from d0ccc74 to 2b36910 Compare May 28, 2026 15:45

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from 2b36910 to 78d164b Compare June 11, 2026 13:50

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from 78d164b to 9586f53 Compare July 12, 2026 13:48

renovate Bot requested review from arjita-mitra, e-maad, otto-the-bot, screendriver, thisisamir98 and zskhan as code owners July 12, 2026 13:48

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch 2 times, most recently from e885105 to bff296d Compare July 20, 2026 20:39

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from bff296d to 49bfcac Compare July 24, 2026 15:27

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from 49bfcac to 47b666b Compare August 11, 2026 21:58

chore(deps): update dependency electron to v39 [security]

7650b91

renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from 47b666b to 7650b91 Compare August 26, 2026 13:20

Navigation Menu

Uh oh!

chore(deps): update dependency electron to v39 [security] - #9618

chore(deps): update dependency electron to v39 [security]#9618
renovate[bot] wants to merge 1 commit into
devfrom
renovate/npm-electron-vulnerability

renovate Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented May 12, 2026

Uh oh!

sonarqubecloud Bot commented Jun 11, 2026

Uh oh!

sonarqubecloud Bot commented Jul 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Electron: Use-after-free in offscreen child window paint callback

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Use-after-free in offscreen shared texture release() callback

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Crash in clipboard.readImage() on malformed clipboard image data

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Parent process code-sign check is spoofable

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Cross-origin iframe can position native autofill popup

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Context isolation bypass via Function.prototype.bind hijack

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: shell.openPath path validation bypass via embedded null byte

Details

Impact

Workarounds

Fixed Versions

For more information

Severity

References

Electron: Extension tab APIs operate across session boundaries

Details

Impact

Workarounds

renovate Bot commented Apr 22, 2026 •

edited

Loading