Update dependency electron to v41.10.3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
electron	41.3.0 → 41.10.3

---

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

CVE-2026-70604 / GHSA-v3j7-r9gq-3gjw

More information

Details

Impact

A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked.

Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.

Workarounds

Set corsEnabled: true on schemes that must enforce CORS, and validate the request Origin in your protocol handler before returning sensitive data.

Fixed Versions

• 42.0.0
• 41.4.0
• 40.9.3
• 39.8.10

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw
• https://github.com/advisories/GHSA-v3j7-r9gq-3gjw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

CVE-2026-70608 / GHSA-9f4c-93c8-jc8g

More information

Details

Impact

A sandboxed iframe without the allow-popups keyword could still open a new window (or trigger setWindowOpenHandler) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction.

Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected. Apps that deny window creation in setWindowOpenHandler, or that do not embed untrusted content in sandboxed iframes, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for any content you do not trust, rather than relying on the iframe sandbox alone.

Fixed Versions

• 42.0.1
• 41.10.3
• 39.8.10

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

• CVSS Score: 7.2 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g
• https://github.com/electron/electron/pull/51437
• https://github.com/electron/electron/pull/51438
• https://github.com/electron/electron/pull/51439
• https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57
• https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3
• https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f
• https://github.com/electron/electron/releases/tag/v39.8.10
• https://github.com/electron/electron/releases/tag/v41.10.3
• https://github.com/electron/electron/releases/tag/v42.0.1
• https://github.com/advisories/GHSA-9f4c-93c8-jc8g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

electron/electron (electron)

v41.10.3: electron v41.10.3

Compare Source

Release Notes for v41.10.3

Fixes

• Fixed app.disableHardwareAcceleration() not fully disabling GPU hardware usage on Windows starting from Electron 38. #​52368 ^{(Also in 42, 43, 44)}
• Fixed unnecessary autofill popup creation for fields without datalist suggestions, which could cause input latency on macOS. #​52320 ^{(Also in 42, 43, 44)}

Other Changes

• Backported fixes from upstream Chromium and V8. #​52396

v41.10.2: electron v41.10.2

Compare Source

Release Notes for v41.10.2

Fixes

• Fixed a renderer crash when calling WebAssembly.compileStreaming() or WebAssembly.instantiateStreaming() with nodeIntegration enabled. #​52240 ^{(Also in 42, 43)}

Other Changes

• Backported fixes from upstream Chromium. #​52304

v41.10.1: electron v41.10.1

Compare Source

Release Notes for v41.10.1

Fixes

• Fixed crash triggered by replacing an open application menu. #​52278 ^{(Also in 42, 43, 44)}

v41.10.0: electron v41.10.0

Compare Source

Release Notes for v41.10.0

Other Changes

• Backported fixes from upstream Chromium, ANGLE, Dawn, Skia, and V8. #​52231
• Updated Node.js to v24.18.0. #​52104

v41.9.2: electron v41.9.2

Compare Source

Release Notes for v41.9.2

Fixes

• Fixed an issue where clicking the maximize button could progressively shrink the window in some Wayland environments. #​52074 ^{(Also in 42, 43)}

v41.9.1: electron v41.9.1

Compare Source

Release Notes for v41.9.1

Fixes

• Fixed ProtocolResponse.url requests being made through the default session instead of the session the protocol handler was registered on when ProtocolResponse.session was not set. #​52134 ^{(Also in 40, 42, 43)}
• Made "reload" menu items work with BaseWindow. #​52118 ^{(Also in 42, 43)}

Other Changes

• Backported fixes from upstream Chromium. #​52120
• Backported fixes from upstream Chromium. #​52170

v41.9.0: electron v41.9.0

Compare Source

Release Notes for v41.9.0

Fixes

• Fixed Windows edge case in NativeWindowViews::MoveBehindTaskBarIfNeeded(). #​52023 ^{(Also in 42, 43)}

Other Changes

• Backported fixes from upstream Chromium. #​51976
• Updated Node.js to v24.17.0. #​52065

v41.8.0: electron v41.8.0

Compare Source

Release Notes for v41.8.0

Fixes

• Fixed a browser process crash when calling webContents.reload() or navigating synchronously from the render-process-gone event; the event is now emitted after the renderer's teardown notification has completed. #​51917 ^{(Also in 42, 43)}
• Fixed a bug on Linux where a 1px line appeared at the top of frameless windows if the window and web contents had different background colors. #​52004 ^{(Also in 42, 43)}

Other Changes

• Backported fixes from upstream Chromium and V8. #​51936
• Backported fixes from upstream Chromium, Skia and Dawn. #​51943
• Updated Node.js to v24.16.0. #​51746

Documentation

• Documentation changes: #​51925

v41.7.2: electron v41.7.2

Compare Source

Release Notes for v41.7.2

Fixes

• Fixed an issue on Linux and Windows where frameless windows would shrink when calling win.center(). Additionally, fixed an issue where frameless windows would appear slightly off-center on Windows. #​51919 ^{(Also in 42, 43)}
• Fixed an issue where the "Toggle Developer Tools" menu item failed to function correctly with BaseWindow. #​51902 ^{(Also in 42, 43)}

Other Changes

• Fixed silent data truncation in Buffer/TextEncoder APIs and a crash in fs.writeFileSync with non-ASCII strings on Apple Silicon. #​51851 ^{(Also in 42, 43)}
• Security: backported fixes for CVE-2026-9110, CVE-2026-9111, CVE-2026-9114, CVE-2026-9115, CVE-2026-9116, CVE-2026-9117, CVE-2026-9118, CVE-2026-9120, CVE-2026-9121, CVE-2026-9122, CVE-2026-9124, CVE-2026-9126. #​51906

v41.7.1: electron v41.7.1

Compare Source

Release Notes for v41.7.1

Fixes

• Fixed a potential crash when using webContents.print(). #​51728 ^{(Also in 42)}
• Fixed an issue where custom options in webContents.print() did not prefill the print dialog on macOS. #​51682 ^{(Also in 40, 42)}

v41.7.0: electron v41.7.0

Compare Source

Release Notes for v41.7.0

Features

• Allowed the --experimental-inspector-network-resource Node.js flag to be passed through Electron. #​51377 ^{(Also in 42)}

Fixes

• Fixed crash for Notification close. #​51656 ^{(Also in 42, 43)}

Other Changes

• Backported a batch of upstream fixes for memory-safety and validation issues across media, GPU, networking, accessibility, compositing and the ANGLE GL backend. #​51667
• Backported fixes for several use-after-free and object-lifetime issues in input, UI, Aura, HID and file-system teardown paths, a runtime-effect validation gap in Skia, and an integer overflow in the GLSL translator. #​51647

v41.6.1: electron v41.6.1

Compare Source

Release Notes for v41.6.1

Other Changes

• Improved performance of native event emission, IPC dispatch, and option-dictionary parsing. #​51613 ^{(Also in 42)}
• Security: backported 20 High-severity fixes from Chrome 148 stable release. #​51612

v41.6.0: electron v41.6.0

Compare Source

Release Notes for v41.6.0

Fixes

• Fixed a crash in the macOS Touch ID WebAuthn prompt caused by a missing string resource, and added touchID.promptReason to app.configureWebAuthn() to customize the prompt text. #​51604 ^{(Also in 42, 43)}

v41.5.2: electron v41.5.2

Compare Source

Release Notes for v41.5.2

Fixes

• Improved external resize band positioning and scaling for frameless windows on Windows. #​51560 ^{(Also in 43)}

v41.5.1: electron v41.5.1

Compare Source

Release Notes for v41.5.1

Fixes

• Fixed app.getLoginItemSettings() returning undefined for executableWillLaunchAtLogin on macOS; the property is now always a boolean. #​51508 ^{(Also in 40, 42)}
• Fixed a potential race condition crash when closing DevTools. #​51474 ^{(Also in 42)}
• Fixed cross-origin isolation failing for non-file origins. #​51403 ^{(Also in 42)}
• Improved the way Electron determines the default XDG App ID and WM_CLASS on Linux for better platform compatibility if desktopName is not provided in package.json. #​51480 ^{(Also in 42)}

v41.5.0: electron v41.5.0

Compare Source

Release Notes for v41.5.0

Features

• Added app.configureWebAuthn() to enable the Touch ID platform authenticator for WebAuthn on macOS, and a select-webauthn-account session event for choosing between multiple discoverable credentials. #​51412 ^{(Also in 42)}

Fixes

• Fixed a regression on Windows where frameless windows changed their size after calling setResizable. #​51427 ^{(Also in 42)}
• Fixed an issue on Windows where a transient UnhookWindowsHookEx failure in setIgnoreMouseEvents(true, { forward: true }) teardown could cause duplicate low-level mouse hooks to be installed on the next activation. #​51419 ^{(Also in 42)}
• Fixed remote debugging via --remote-debugging-port not working when inspecting from Chrome's chrome://inspect page. The DevTools page would appear empty due to the frontend URL pointing to a CDN that returned 404 for Electron's Chromium builds. #​51413

v41.4.0: electron v41.4.0

Compare Source

Release Notes for v41.4.0

Features

• Added support for heap profiling via contentTracing.enableHeapProfiling(). #​51178 ^{(Also in 42)}

Fixes

• Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #​51270 ^{(Also in 39, 40, 42)}
• Fixed a crash when providing invalid HTTP header names or values in the webRequest.onBeforeSendHeaders() callback. #​51365 ^{(Also in 40, 42)}
• Fixed a bug that cause offscreen rendering doesn't have valid screen info and unable to get valid result of related media queries.
  • Added webPreference.offscreen.deviceScaleFactor to allow user specify a value, instead of using user's primary display's value. #​50375 ^{(Also in 40)}
• Fixed a bug where errors would occur when using the Chrome DevTools Fetch API. #​51371 ^{(Also in 42)}
• Fixed a crash that could occur when an autofill suggestion popup was shown while a window was closing. #​51321 ^{(Also in 42)}
• Fixed a regression where frameless fullscreen windows had white borders on Windows. #​51332 ^{(Also in 42)}
• Fixed a renderer crash when a page uses the <geolocation> HTML element. #​51373 ^{(Also in 42)}
• Fixed an issue where calling contentTracing APIs before app.whenReady() would crash the application. #​51352 ^{(Also in 42)}
• Fixed an issue where some toast notification properties didn't work as expected in WinRT. #​51397 ^{(Also in 42)}
• Fixed buggy behavior where Backspace would accept macOS text replacements inside contenteditable elements. #​51343 ^{(Also in 40, 42)}
• This PR fixes a regression in silent printing where custom DPI values from webContents.print were not honored, causing incorrect output scaling in real-world print flows. #​51355 ^{(Also in 42)}

Other Changes

• Backported a fix for route_id validation in the GPU command buffer. #​51319
• Backported fix in Skia for 4955347. #​51264
• Backported security fixes for 4927361, 4926688, 4934134, 4933194, 4941583, 4962818. #​51259
• Updated Chromium to 146.0.7680.216. #​51382

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.