Electron Releases

Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #53704 ^{(Also in 44, 45)}

Added the ELECTRON_DEBUG_DRAGGABLE_REGIONS environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. #53633 ^{(Also in 44, 45)}

Fixed a potential UAF when a select-usb-device handler destroys the requesting webContents. #54007 ^{(Also in 44, 45)}

Fixed default protocol client APIs falsely returning true on Windows. #53960 ^{(Also in 44, 45)}

Fixed a main-process crash when an app called loadURL() again right after a load failed because the renderer process exited before the page committed. #53944 ^{(Also in 44, 45)}

Fixed a memory leak on Windows when app.getPreferredSystemLanguages() was called. #53867 ^{(Also in 44, 45)}

Fixed a potential UAF in app.getPreferredSystemLanguages() on Windows. #53866 ^{(Also in 44, 45)}

Fixed a renderer crash when an iframe was removed right after loading with nodeIntegrationInSubFrames enabled and sandbox disabled, e.g. on pages that embed Meta Pixel. #53884 ^{(Also in 42, 44, 45)}

Fixed a Windows renderer crash when no default locale could be determined. #53948

Fixed webContents.capturePage() on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's offscreen.deviceScaleFactor. #53818 ^{(Also in 44, 45)}

File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53694 ^{(Also in 42, 44, 45)}

Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53689 ^{(Also in 42, 44, 45)}

Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53496 ^{(Also in 42, 44, 45)}

Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53510 ^{(Also in 42, 44, 45)}

Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53584 ^{(Also in 42, 44, 45)}

Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53540 ^{(Also in 42, 44, 45)}

Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #53750 ^{(Also in 44, 45)}

Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53671 ^{(Also in 42, 44, 45)}

Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. #53631 ^{(Also in 44, 45)}

Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53726 ^{(Also in 42, 44, 45)}

<webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53718 ^{(Also in 42, 44, 45)}

getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53707 ^{(Also in 42, 44, 45)}

nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53712 ^{(Also in 42, 44, 45)}

openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53698 ^{(Also in 42, 44, 45)}

pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53701 ^{(Also in 42, 44, 45)}

Backported fix from upstream V8. #53988

Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53984

Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. #53766

Fixed a renderer crash that could occur when printing from an iframe. #53761 ^{(Also in 44, 45)}

Fixed the app becoming unresponsive when a page has a very large number of app-region draggable elements. #53632 ^{(Also in 44, 45)}

Updated Node.js to v24.21.0. #53777