Apps that are launched as command line executables are impacted. E.g. if your app exposes itself in the path as myapp --help
Specifically this issue can only be exploited if the following conditions are met:
Your app is launched with an attacker-controlled working directory
The attacker has the ability to write files to that working directory
This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. Please bear this in mind when reporting similar issues in the future.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
26.0.0-beta.13
25.5.0
24.7.1
23.3.13
22.3.19
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Release Notes
electron/electron (electron)
### [`v26.2.2`](https://togithub.com/electron/electron/releases/tag/v26.2.2): electron v26.2.2
[Compare Source](https://togithub.com/electron/electron/compare/v26.2.1...v26.2.2)
### Release Notes for v26.2.2
#### Fixes
- Fixed an issue where `BrowserViews` that had their bounds set prior to being added to a `BrowserWindow` could have unexpected incorrect offsets. [#39850](https://togithub.com/electron/electron/pull/39850) (Also in [25](https://togithub.com/electron/electron/pull/39851), [27](https://togithub.com/electron/electron/pull/39627))
#### Other Changes
- Security: backported fix for [`1477588`](https://togithub.com/electron/electron/commit/1477588). [#39918](https://togithub.com/electron/electron/pull/39918)
- Updated Chromium to 116.0.5845.190. [#39887](https://togithub.com/electron/electron/pull/39887)
### [`v26.2.1`](https://togithub.com/electron/electron/releases/tag/v26.2.1): electron v26.2.1
[Compare Source](https://togithub.com/electron/electron/compare/v26.2.0...v26.2.1)
### Release Notes for v26.2.1
#### Fixes
- Fixed an error where listening to certain `chrome.tabs` events would throw incorrectly. [#39772](https://togithub.com/electron/electron/pull/39772) (Also in [25](https://togithub.com/electron/electron/pull/39770), [27](https://togithub.com/electron/electron/pull/39771))
- Fixed an issue where BrowserWindows could crash on macOS with `frame: false` and `roundedCorners: false` when going fullscreen. [#39795](https://togithub.com/electron/electron/pull/39795) (Also in [25](https://togithub.com/electron/electron/pull/39794), [27](https://togithub.com/electron/electron/pull/39796))
- Fixed an issue where accelerators representing DOM keys were not correctly converted in `webContents.sendInputEvent()`. [#39821](https://togithub.com/electron/electron/pull/39821) (Also in [27](https://togithub.com/electron/electron/pull/39822))
- Fixed devtools to allow restoring saved dock state on Windows. [#39768](https://togithub.com/electron/electron/pull/39768) (Also in [25](https://togithub.com/electron/electron/pull/39766), [27](https://togithub.com/electron/electron/pull/39767))
- Fixed issue where titlebar would be transparent for transparent windows that are fullscreen. [#39780](https://togithub.com/electron/electron/pull/39780) (Also in [25](https://togithub.com/electron/electron/pull/39779), [27](https://togithub.com/electron/electron/pull/39781))
#### Other Changes
- Fixed missing type for `Electron.TitleBarOverlay`. [#39805](https://togithub.com/electron/electron/pull/39805) (Also in [27](https://togithub.com/electron/electron/pull/39806))
- Updated Chromium to 116.0.5845.188. [#39828](https://togithub.com/electron/electron/pull/39828)
### [`v26.2.0`](https://togithub.com/electron/electron/releases/tag/v26.2.0): electron v26.2.0
### Release Notes for v26.2.0
#### Features
- Added support for several more extensions manifest keys including `host_permissions`, `author`, and `short_name`. [#39673](https://togithub.com/electron/electron/pull/39673) (Also in [27](https://togithub.com/electron/electron/pull/39672))
- Added the ability to send HTTP headers with `webContents.downloadURL()`. [#39562](https://togithub.com/electron/electron/pull/39562) (Also in [25](https://togithub.com/electron/electron/pull/39561), [27](https://togithub.com/electron/electron/pull/39560))
#### Fixes
- Fixed an issue where child windows opened when the parent window is *already fullscreen* did not respect the child windows' fullscreenability and resizability settings. [#39641](https://togithub.com/electron/electron/pull/39641) (Also in [24](https://togithub.com/electron/electron/pull/39643), [25](https://togithub.com/electron/electron/pull/39642), [27](https://togithub.com/electron/electron/pull/39640))
- Fixed an issue where pressing the escape key did not properly trigger PDF presentation mode exit. [#39705](https://togithub.com/electron/electron/pull/39705) (Also in [27](https://togithub.com/electron/electron/pull/39660))
- Fixed an issue where the Node.js `assert` module did not work in the renderer process. [#39624](https://togithub.com/electron/electron/pull/39624) (Also in [24](https://togithub.com/electron/electron/pull/39621), [25](https://togithub.com/electron/electron/pull/39622), [27](https://togithub.com/electron/electron/pull/39623))
- Fixed problem with promise resolved to early when browser initiated in-page navigation. [#39679](https://togithub.com/electron/electron/pull/39679) (Also in [25](https://togithub.com/electron/electron/pull/39678), [27](https://togithub.com/electron/electron/pull/39680))
#### Other Changes
- Updated Chromium to 116.0.5845.141. [#39692](https://togithub.com/electron/electron/pull/39692)
### [`v26.1.0`](https://togithub.com/electron/electron/releases/tag/v26.1.0): electron v26.1.0
### Release Notes for v26.1.0
#### Features
- Added support for --dns-result-order Node.js cli flag. [#39501](https://togithub.com/electron/electron/pull/39501) (Also in [25](https://togithub.com/electron/electron/pull/39500))
#### Fixes
- Fixed a potential crash when calling `BrowserWindow.moveTop()` on modal child windows. [#39527](https://togithub.com/electron/electron/pull/39527) (Also in [24](https://togithub.com/electron/electron/pull/39526), [25](https://togithub.com/electron/electron/pull/39528))
- Fixed an issue where `chrome://gpu` failed to load. [#39584](https://togithub.com/electron/electron/pull/39584) (Also in [27](https://togithub.com/electron/electron/pull/39583))
- Fixed an issue where certain properties of `chrome.tabs` Tab objects were not properly considered privileged. [#39607](https://togithub.com/electron/electron/pull/39607) (Also in [25](https://togithub.com/electron/electron/pull/39609), [27](https://togithub.com/electron/electron/pull/39608))
- Fixed decorations for tiled windows on Wayland. [#39571](https://togithub.com/electron/electron/pull/39571) (Also in [22](https://togithub.com/electron/electron/pull/39568), [24](https://togithub.com/electron/electron/pull/39567), [25](https://togithub.com/electron/electron/pull/39569), [27](https://togithub.com/electron/electron/pull/39570))
- Fixed to regenerate thumbnail toolbar buttons when explorer is restarted. [#39587](https://togithub.com/electron/electron/pull/39587) (Also in [24](https://togithub.com/electron/electron/pull/39585), [25](https://togithub.com/electron/electron/pull/39586))
- Support Region Capture API with tab MediaStream. [#39618](https://togithub.com/electron/electron/pull/39618)
#### Other Changes
- Security: backported fix for CVE-2023-4071.
- Security: backported fix for CVE-2023-4070.
- Security: backported fix for CVE-2023-4075.
- Security: backported fix for CVE-2023-4076.
- Security: backported fix for CVE-2023-4069.
- Security: backported fix for CVE-2023-4074.
- Security: backported fix for CVE-2023-4072.
- Security: backported fix for CVE-2023-4068.
- Security: backported fix for [`1464682`](https://togithub.com/electron/electron/commit/1464682).
- Security: backported fix for [`1464680`](https://togithub.com/electron/electron/commit/1464680).
- Security: backported fix for CVE-2023-4073. [#39516](https://togithub.com/electron/electron/pull/39516)
- Updated Chromium to 116.0.5845.97. [#39530](https://togithub.com/electron/electron/pull/39530)
### [`v26.0.0`](https://togithub.com/electron/electron/releases/tag/v26.0.0): electron v26.0.0
[Compare Source](https://togithub.com/electron/electron/compare/v25.8.2...v26.0.0)
### Release Notes for v26.0.0
#### Stack Upgrades
- Chromium `116.0.5845.62`
- [New in 116](https://developer.chrome.com/blog/new-in-chrome-116)
- [New in 115](https://developer.chrome.com/blog/new-in-chrome-115)
- Node `18.6.1`
- [Node 18.16.1 blog post](https://nodejs.org/en/blog/release/v18.16.1/)
- V8 `11.2`
#### Breaking Changes
- The `webContents.getPrinters` API has been deprecated. [#39459](https://togithub.com/electron/electron/pull/39459)
- The `systemPreferences.getAppLevelAppearance` and `systemPreferences.setAppLevelAppearance` APIs have been deprecated, as well as the `alternate-selected-control-text` value for `systemPreferences.getColor`. [#39492](https://togithub.com/electron/electron/pull/39492)
#### Features
##### Additions
- Added `safeStorage.setUsePlainTextEncryption` and `safeStorage.getSelectedStorageBackend` api. [#39107](https://togithub.com/electron/electron/pull/39107) (Also in [25](https://togithub.com/electron/electron/pull/39325))
- Added `safeStorage.setUsePlainTextEncryption` and `safeStorage.getSelectedStorageBackend` api. [#39155](https://togithub.com/electron/electron/pull/39155) (Also in [25](https://togithub.com/electron/electron/pull/39325))
- Added `senderIsMainFrame` to messages sent via `ipcRenderer.sendTo()`. [#39206](https://togithub.com/electron/electron/pull/39206) (Also in [24](https://togithub.com/electron/electron/pull/39207), [25](https://togithub.com/electron/electron/pull/39208))
- Added net.resolveHost that resolves hosts using defaultSession object. [#37853](https://togithub.com/electron/electron/pull/37853) (Also in [24](https://togithub.com/electron/electron/pull/38153), [25](https://togithub.com/electron/electron/pull/38152))
- Added new 'did-resign-active' event on `app`. [#37933](https://togithub.com/electron/electron/pull/37933) (Also in [25](https://togithub.com/electron/electron/pull/38018))
- Added partial support for `chrome.tabs.query`. [#39431](https://togithub.com/electron/electron/pull/39431) (Also in [25](https://togithub.com/electron/electron/pull/39430))
- Added setUSBProtectedClassesHandler to allow access to protected USB classes with WebUSB. [#38263](https://togithub.com/electron/electron/pull/38263) (Also in [24](https://togithub.com/electron/electron/pull/38498), [25](https://togithub.com/electron/electron/pull/38493))
- Added several new cursor values to the `cursor-changed` event. [#38210](https://togithub.com/electron/electron/pull/38210) (Also in [24](https://togithub.com/electron/electron/pull/38364), [25](https://togithub.com/electron/electron/pull/38363))
- Added support for Mica and Acrylic background effects on Windows. [#38163](https://togithub.com/electron/electron/pull/38163) (Also in [24](https://togithub.com/electron/electron/pull/38361), [25](https://togithub.com/electron/electron/pull/38357))
- Added support for flagging a Menu as being keyboard initiated. [#38954](https://togithub.com/electron/electron/pull/38954)
- Added support for several more Node.js cli flags in the main process. [#39373](https://togithub.com/electron/electron/pull/39373) (Also in [24](https://togithub.com/electron/electron/pull/39372), [25](https://togithub.com/electron/electron/pull/39374))
- Added the ability to send HTTP headers with `session.downloadURL()`. [#38871](https://togithub.com/electron/electron/pull/38871) (Also in [25](https://togithub.com/electron/electron/pull/38870))
- Added thermal management information to `powerMonitor`. [#37935](https://togithub.com/electron/electron/pull/37935) (Also in [24](https://togithub.com/electron/electron/pull/38027), [25](https://togithub.com/electron/electron/pull/38028))
- Expose `webContents` methods to center text selection, scroll to the page bottom and top, as well as adjust selected text. [#37978](https://togithub.com/electron/electron/pull/37978) (Also in [25](https://togithub.com/electron/electron/pull/38362))
- Support Chrome Extensions `minimum_chrome_version` manifest key. [#39357](https://togithub.com/electron/electron/pull/39357)
- Surface the `context-menu` event from extensions. [#38029](https://togithub.com/electron/electron/pull/38029) (Also in [25](https://togithub.com/electron/electron/pull/38356))
- `node:` prefixed requires are now supported in sandboxed renderer preloads for `events`, `timers` and `url`. [#38728](https://togithub.com/electron/electron/pull/38728) (Also in [24](https://togithub.com/electron/electron/pull/38727), [25](https://togithub.com/electron/electron/pull/38729))
##### Improvements
- Improved error message when `contentTracing.stopRecording()` fails because no trace was in progress. [#38488](https://togithub.com/electron/electron/pull/38488) (Also in [23](https://togithub.com/electron/electron/pull/38518), [24](https://togithub.com/electron/electron/pull/38520), [25](https://togithub.com/electron/electron/pull/38519))
##### Removed/Deprecated
- The `enable_desktop_capturer` build flag has been removed. [#38412](https://togithub.com/electron/electron/pull/38412)
#### Fixes
- Fixed `clipboard.readImage()` getting blocked when there is no PNG image in the clipboard. [#39487](https://togithub.com/electron/electron/pull/39487)
- Fixed a crash calling `nativeImage.resize()` before the app `ready` event. [#38861](https://togithub.com/electron/electron/pull/38861)
- Fixed a crash in `clipboard.readImage()` when reading images copied via context menu on macOS. [#39101](https://togithub.com/electron/electron/pull/39101)
- Fixed a crash while screen sharing on Wayland with PipeWire. [#39264](https://togithub.com/electron/electron/pull/39264)
- Fixed a potential crash when calling `tray.popUpContextMenu` on macOS. [#39313](https://togithub.com/electron/electron/pull/39313)
- Fixed a potential crash when re-parenting a BrowserWindow whose first parent has been destroyed. [#39297](https://togithub.com/electron/electron/pull/39297)
- Fixed a redundant permission popup while fetching screens and windows using `desktopCapturer.getSources()` on Wayland. [#39189](https://togithub.com/electron/electron/pull/39189)
- Fixed an accessibility issue where `VoiceOver` couldn't trigger the tray action when selected to emit the click event. [#39439](https://togithub.com/electron/electron/pull/39439)
- Fixed an issue where calls to `window.setKiosk(false)` would exit fullscreen regardless of the fullscreen state prior to kiosk mode. [#38219](https://togithub.com/electron/electron/pull/38219)
##### Also in earlier versions...
- Added about panel for menu role `about` on Linux as well. [#37828](https://togithub.com/electron/electron/pull/37828) (Also in [23](https://togithub.com/electron/electron/pull/37874), [24](https://togithub.com/electron/electron/pull/37872), [25](https://togithub.com/electron/electron/pull/37873))
- Added transparent color support for WCO on Windows. [#38716](https://togithub.com/electron/electron/pull/38716) (Also in [25](https://togithub.com/electron/electron/pull/38715))
- Ensured that Electron's custom `AXManualAccessibility` attribute works as expected in all relevant protocol methods. [#38142](https://togithub.com/electron/electron/pull/38142) (Also in [23](https://togithub.com/electron/electron/pull/38225), [24](https://togithub.com/electron/electron/pull/38224), [25](https://togithub.com/electron/electron/pull/38223))
- Fixed `desktopCapturer` thumbnail generation after screen sharing is cancelled on Wayland. [#39246](https://togithub.com/electron/electron/pull/39246) (Also in [25](https://togithub.com/electron/electron/pull/39245))
- Fixed `preload` script may not run in some child windows opened by `window.open`. [#38930](https://togithub.com/electron/electron/pull/38930) (Also in [23](https://togithub.com/electron/electron/pull/38933), [24](https://togithub.com/electron/electron/pull/38932), [25](https://togithub.com/electron/electron/pull/38931))
- Fixed `webContents.printToPDF` `preferCSSPageSize` type error. [#38793](https://togithub.com/electron/electron/pull/38793) (Also in [24](https://togithub.com/electron/electron/pull/38792), [25](https://togithub.com/electron/electron/pull/38791))
- Fixed a console error seen when loading PDFs. [#38127](https://togithub.com/electron/electron/pull/38127) (Also in [25](https://togithub.com/electron/electron/pull/38148))
- Fixed a crash seen when trying to change `nativeTheme` source during mara context menu close. [#38840](https://togithub.com/electron/electron/pull/38840) (Also in [25](https://togithub.com/electron/electron/pull/38839))
- Fixed a crash when listing desktop capture sources on Wayland with PipeWire. [#39049](https://togithub.com/electron/electron/pull/39049) (Also in [23](https://togithub.com/electron/electron/pull/39116), [24](https://togithub.com/electron/electron/pull/39050), [25](https://togithub.com/electron/electron/pull/39051))
- Fixed a potential crash calling `BrowserWindow.removeBrowserView()` with a destroyed `webContents`. [#38885](https://togithub.com/electron/electron/pull/38885) (Also in [24](https://togithub.com/electron/electron/pull/38884), [25](https://togithub.com/electron/electron/pull/38883))
- Fixed a potential crash when calling `webContents.print` with invalid settings. [#38165](https://togithub.com/electron/electron/pull/38165) (Also in [25](https://togithub.com/electron/electron/pull/38230))
- Fixed a potential crash when right-clicking on macOS windows with draggable regions. [#38100](https://togithub.com/electron/electron/pull/38100) (Also in [24](https://togithub.com/electron/electron/pull/38136), [25](https://togithub.com/electron/electron/pull/38115))
- Fixed a rare crash when closing active native tab on macOS. [#39410](https://togithub.com/electron/electron/pull/39410) (Also in [25](https://togithub.com/electron/electron/pull/39409))
- Fixed an error with `webContents.print` parameter validation by adding missing options required to set printer printable area. [#38721](https://togithub.com/electron/electron/pull/38721) (Also in [25](https://togithub.com/electron/electron/pull/38720))
- Fixed an error seen in the Top Level Windows section of `chrome://accessibility`. [#38179](https://togithub.com/electron/electron/pull/38179) (Also in [25](https://togithub.com/electron/electron/pull/38211))
- Fixed an issue on Linux where menus would not open after resizing/maximizing/unmaximizing a window. [#37798](https://togithub.com/electron/electron/pull/37798) (Also in [23](https://togithub.com/electron/electron/pull/37908), [24](https://togithub.com/electron/electron/pull/37906), [25](https://togithub.com/electron/electron/pull/37905))
- Fixed an issue on Windows 10 where the title bar was not correct after changing native theme. [#39309](https://togithub.com/electron/electron/pull/39309) (Also in [25](https://togithub.com/electron/electron/pull/39314))
- Fixed an issue where Windows `FrameView`s always appeared inactive regardless of focus status. [#38468](https://togithub.com/electron/electron/pull/38468) (Also in [25](https://togithub.com/electron/electron/pull/38473))
- Fixed an issue where `
This PR contains the following updates:
~19.1.0
->~26.2.0
GitHub Vulnerability Alerts
CVE-2023-39956
Impact
Apps that are launched as command line executables are impacted. E.g. if your app exposes itself in the path as
myapp --help
Specifically this issue can only be exploited if the following conditions are met:
This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. Please bear this in mind when reporting similar issues in the future.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
26.0.0-beta.13
25.5.0
24.7.1
23.3.13
22.3.19
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Release Notes
electron/electron (electron)
### [`v26.2.2`](https://togithub.com/electron/electron/releases/tag/v26.2.2): electron v26.2.2 [Compare Source](https://togithub.com/electron/electron/compare/v26.2.1...v26.2.2) ### Release Notes for v26.2.2 #### Fixes - Fixed an issue where `BrowserViews` that had their bounds set prior to being added to a `BrowserWindow` could have unexpected incorrect offsets. [#39850](https://togithub.com/electron/electron/pull/39850) (Also in [25](https://togithub.com/electron/electron/pull/39851), [27](https://togithub.com/electron/electron/pull/39627)) #### Other Changes - Security: backported fix for [`1477588`](https://togithub.com/electron/electron/commit/1477588). [#39918](https://togithub.com/electron/electron/pull/39918) - Updated Chromium to 116.0.5845.190. [#39887](https://togithub.com/electron/electron/pull/39887) ### [`v26.2.1`](https://togithub.com/electron/electron/releases/tag/v26.2.1): electron v26.2.1 [Compare Source](https://togithub.com/electron/electron/compare/v26.2.0...v26.2.1) ### Release Notes for v26.2.1 #### Fixes - Fixed an error where listening to certain `chrome.tabs` events would throw incorrectly. [#39772](https://togithub.com/electron/electron/pull/39772) (Also in [25](https://togithub.com/electron/electron/pull/39770), [27](https://togithub.com/electron/electron/pull/39771)) - Fixed an issue where BrowserWindows could crash on macOS with `frame: false` and `roundedCorners: false` when going fullscreen. [#39795](https://togithub.com/electron/electron/pull/39795) (Also in [25](https://togithub.com/electron/electron/pull/39794), [27](https://togithub.com/electron/electron/pull/39796)) - Fixed an issue where accelerators representing DOM keys were not correctly converted in `webContents.sendInputEvent()`. [#39821](https://togithub.com/electron/electron/pull/39821) (Also in [27](https://togithub.com/electron/electron/pull/39822)) - Fixed devtools to allow restoring saved dock state on Windows. [#39768](https://togithub.com/electron/electron/pull/39768) (Also in [25](https://togithub.com/electron/electron/pull/39766), [27](https://togithub.com/electron/electron/pull/39767)) - Fixed issue where titlebar would be transparent for transparent windows that are fullscreen. [#39780](https://togithub.com/electron/electron/pull/39780) (Also in [25](https://togithub.com/electron/electron/pull/39779), [27](https://togithub.com/electron/electron/pull/39781)) #### Other Changes - Fixed missing type for `Electron.TitleBarOverlay`. [#39805](https://togithub.com/electron/electron/pull/39805) (Also in [27](https://togithub.com/electron/electron/pull/39806)) - Updated Chromium to 116.0.5845.188. [#39828](https://togithub.com/electron/electron/pull/39828) ### [`v26.2.0`](https://togithub.com/electron/electron/releases/tag/v26.2.0): electron v26.2.0 ### Release Notes for v26.2.0 #### Features - Added support for several more extensions manifest keys including `host_permissions`, `author`, and `short_name`. [#39673](https://togithub.com/electron/electron/pull/39673) (Also in [27](https://togithub.com/electron/electron/pull/39672)) - Added the ability to send HTTP headers with `webContents.downloadURL()`. [#39562](https://togithub.com/electron/electron/pull/39562) (Also in [25](https://togithub.com/electron/electron/pull/39561), [27](https://togithub.com/electron/electron/pull/39560)) #### Fixes - Fixed an issue where child windows opened when the parent window is *already fullscreen* did not respect the child windows' fullscreenability and resizability settings. [#39641](https://togithub.com/electron/electron/pull/39641) (Also in [24](https://togithub.com/electron/electron/pull/39643), [25](https://togithub.com/electron/electron/pull/39642), [27](https://togithub.com/electron/electron/pull/39640)) - Fixed an issue where pressing the escape key did not properly trigger PDF presentation mode exit. [#39705](https://togithub.com/electron/electron/pull/39705) (Also in [27](https://togithub.com/electron/electron/pull/39660)) - Fixed an issue where the Node.js `assert` module did not work in the renderer process. [#39624](https://togithub.com/electron/electron/pull/39624) (Also in [24](https://togithub.com/electron/electron/pull/39621), [25](https://togithub.com/electron/electron/pull/39622), [27](https://togithub.com/electron/electron/pull/39623)) - Fixed problem with promise resolved to early when browser initiated in-page navigation. [#39679](https://togithub.com/electron/electron/pull/39679) (Also in [25](https://togithub.com/electron/electron/pull/39678), [27](https://togithub.com/electron/electron/pull/39680)) #### Other Changes - Updated Chromium to 116.0.5845.141. [#39692](https://togithub.com/electron/electron/pull/39692) ### [`v26.1.0`](https://togithub.com/electron/electron/releases/tag/v26.1.0): electron v26.1.0 ### Release Notes for v26.1.0 #### Features - Added support for --dns-result-order Node.js cli flag. [#39501](https://togithub.com/electron/electron/pull/39501) (Also in [25](https://togithub.com/electron/electron/pull/39500)) #### Fixes - Fixed a potential crash when calling `BrowserWindow.moveTop()` on modal child windows. [#39527](https://togithub.com/electron/electron/pull/39527) (Also in [24](https://togithub.com/electron/electron/pull/39526), [25](https://togithub.com/electron/electron/pull/39528)) - Fixed an issue where `chrome://gpu` failed to load. [#39584](https://togithub.com/electron/electron/pull/39584) (Also in [27](https://togithub.com/electron/electron/pull/39583)) - Fixed an issue where certain properties of `chrome.tabs` Tab objects were not properly considered privileged. [#39607](https://togithub.com/electron/electron/pull/39607) (Also in [25](https://togithub.com/electron/electron/pull/39609), [27](https://togithub.com/electron/electron/pull/39608)) - Fixed decorations for tiled windows on Wayland. [#39571](https://togithub.com/electron/electron/pull/39571) (Also in [22](https://togithub.com/electron/electron/pull/39568), [24](https://togithub.com/electron/electron/pull/39567), [25](https://togithub.com/electron/electron/pull/39569), [27](https://togithub.com/electron/electron/pull/39570)) - Fixed to regenerate thumbnail toolbar buttons when explorer is restarted. [#39587](https://togithub.com/electron/electron/pull/39587) (Also in [24](https://togithub.com/electron/electron/pull/39585), [25](https://togithub.com/electron/electron/pull/39586)) - Support Region Capture API with tab MediaStream. [#39618](https://togithub.com/electron/electron/pull/39618) #### Other Changes - Security: backported fix for CVE-2023-4071. - Security: backported fix for CVE-2023-4070. - Security: backported fix for CVE-2023-4075. - Security: backported fix for CVE-2023-4076. - Security: backported fix for CVE-2023-4069. - Security: backported fix for CVE-2023-4074. - Security: backported fix for CVE-2023-4072. - Security: backported fix for CVE-2023-4068. - Security: backported fix for [`1464682`](https://togithub.com/electron/electron/commit/1464682). - Security: backported fix for [`1464680`](https://togithub.com/electron/electron/commit/1464680). - Security: backported fix for CVE-2023-4073. [#39516](https://togithub.com/electron/electron/pull/39516) - Updated Chromium to 116.0.5845.97. [#39530](https://togithub.com/electron/electron/pull/39530) ### [`v26.0.0`](https://togithub.com/electron/electron/releases/tag/v26.0.0): electron v26.0.0 [Compare Source](https://togithub.com/electron/electron/compare/v25.8.2...v26.0.0) ### Release Notes for v26.0.0 #### Stack Upgrades - Chromium `116.0.5845.62` - [New in 116](https://developer.chrome.com/blog/new-in-chrome-116) - [New in 115](https://developer.chrome.com/blog/new-in-chrome-115) - Node `18.6.1` - [Node 18.16.1 blog post](https://nodejs.org/en/blog/release/v18.16.1/) - V8 `11.2` #### Breaking Changes - The `webContents.getPrinters` API has been deprecated. [#39459](https://togithub.com/electron/electron/pull/39459) - The `systemPreferences.getAppLevelAppearance` and `systemPreferences.setAppLevelAppearance` APIs have been deprecated, as well as the `alternate-selected-control-text` value for `systemPreferences.getColor`. [#39492](https://togithub.com/electron/electron/pull/39492) #### Features ##### Additions - Added `safeStorage.setUsePlainTextEncryption` and `safeStorage.getSelectedStorageBackend` api. [#39107](https://togithub.com/electron/electron/pull/39107) (Also in [25](https://togithub.com/electron/electron/pull/39325)) - Added `safeStorage.setUsePlainTextEncryption` and `safeStorage.getSelectedStorageBackend` api. [#39155](https://togithub.com/electron/electron/pull/39155) (Also in [25](https://togithub.com/electron/electron/pull/39325)) - Added `senderIsMainFrame` to messages sent via `ipcRenderer.sendTo()`. [#39206](https://togithub.com/electron/electron/pull/39206) (Also in [24](https://togithub.com/electron/electron/pull/39207), [25](https://togithub.com/electron/electron/pull/39208)) - Added net.resolveHost that resolves hosts using defaultSession object. [#37853](https://togithub.com/electron/electron/pull/37853) (Also in [24](https://togithub.com/electron/electron/pull/38153), [25](https://togithub.com/electron/electron/pull/38152)) - Added new 'did-resign-active' event on `app`. [#37933](https://togithub.com/electron/electron/pull/37933) (Also in [25](https://togithub.com/electron/electron/pull/38018)) - Added partial support for `chrome.tabs.query`. [#39431](https://togithub.com/electron/electron/pull/39431) (Also in [25](https://togithub.com/electron/electron/pull/39430)) - Added setUSBProtectedClassesHandler to allow access to protected USB classes with WebUSB. [#38263](https://togithub.com/electron/electron/pull/38263) (Also in [24](https://togithub.com/electron/electron/pull/38498), [25](https://togithub.com/electron/electron/pull/38493)) - Added several new cursor values to the `cursor-changed` event. [#38210](https://togithub.com/electron/electron/pull/38210) (Also in [24](https://togithub.com/electron/electron/pull/38364), [25](https://togithub.com/electron/electron/pull/38363)) - Added support for Mica and Acrylic background effects on Windows. [#38163](https://togithub.com/electron/electron/pull/38163) (Also in [24](https://togithub.com/electron/electron/pull/38361), [25](https://togithub.com/electron/electron/pull/38357)) - Added support for flagging a Menu as being keyboard initiated. [#38954](https://togithub.com/electron/electron/pull/38954) - Added support for several more Node.js cli flags in the main process. [#39373](https://togithub.com/electron/electron/pull/39373) (Also in [24](https://togithub.com/electron/electron/pull/39372), [25](https://togithub.com/electron/electron/pull/39374)) - Added the ability to send HTTP headers with `session.downloadURL()`. [#38871](https://togithub.com/electron/electron/pull/38871) (Also in [25](https://togithub.com/electron/electron/pull/38870)) - Added thermal management information to `powerMonitor`. [#37935](https://togithub.com/electron/electron/pull/37935) (Also in [24](https://togithub.com/electron/electron/pull/38027), [25](https://togithub.com/electron/electron/pull/38028)) - Expose `webContents` methods to center text selection, scroll to the page bottom and top, as well as adjust selected text. [#37978](https://togithub.com/electron/electron/pull/37978) (Also in [25](https://togithub.com/electron/electron/pull/38362)) - Support Chrome Extensions `minimum_chrome_version` manifest key. [#39357](https://togithub.com/electron/electron/pull/39357) - Surface the `context-menu` event from extensions. [#38029](https://togithub.com/electron/electron/pull/38029) (Also in [25](https://togithub.com/electron/electron/pull/38356)) - `node:` prefixed requires are now supported in sandboxed renderer preloads for `events`, `timers` and `url`. [#38728](https://togithub.com/electron/electron/pull/38728) (Also in [24](https://togithub.com/electron/electron/pull/38727), [25](https://togithub.com/electron/electron/pull/38729)) ##### Improvements - Improved error message when `contentTracing.stopRecording()` fails because no trace was in progress. [#38488](https://togithub.com/electron/electron/pull/38488) (Also in [23](https://togithub.com/electron/electron/pull/38518), [24](https://togithub.com/electron/electron/pull/38520), [25](https://togithub.com/electron/electron/pull/38519)) ##### Removed/Deprecated - The `enable_desktop_capturer` build flag has been removed. [#38412](https://togithub.com/electron/electron/pull/38412) #### Fixes - Fixed `clipboard.readImage()` getting blocked when there is no PNG image in the clipboard. [#39487](https://togithub.com/electron/electron/pull/39487) - Fixed a crash calling `nativeImage.resize()` before the app `ready` event. [#38861](https://togithub.com/electron/electron/pull/38861) - Fixed a crash in `clipboard.readImage()` when reading images copied via context menu on macOS. [#39101](https://togithub.com/electron/electron/pull/39101) - Fixed a crash while screen sharing on Wayland with PipeWire. [#39264](https://togithub.com/electron/electron/pull/39264) - Fixed a potential crash when calling `tray.popUpContextMenu` on macOS. [#39313](https://togithub.com/electron/electron/pull/39313) - Fixed a potential crash when re-parenting a BrowserWindow whose first parent has been destroyed. [#39297](https://togithub.com/electron/electron/pull/39297) - Fixed a redundant permission popup while fetching screens and windows using `desktopCapturer.getSources()` on Wayland. [#39189](https://togithub.com/electron/electron/pull/39189) - Fixed an accessibility issue where `VoiceOver` couldn't trigger the tray action when selected to emit the click event. [#39439](https://togithub.com/electron/electron/pull/39439) - Fixed an issue where calls to `window.setKiosk(false)` would exit fullscreen regardless of the fullscreen state prior to kiosk mode. [#38219](https://togithub.com/electron/electron/pull/38219) ##### Also in earlier versions... - Added about panel for menu role `about` on Linux as well. [#37828](https://togithub.com/electron/electron/pull/37828) (Also in [23](https://togithub.com/electron/electron/pull/37874), [24](https://togithub.com/electron/electron/pull/37872), [25](https://togithub.com/electron/electron/pull/37873)) - Added transparent color support for WCO on Windows. [#38716](https://togithub.com/electron/electron/pull/38716) (Also in [25](https://togithub.com/electron/electron/pull/38715)) - Ensured that Electron's custom `AXManualAccessibility` attribute works as expected in all relevant protocol methods. [#38142](https://togithub.com/electron/electron/pull/38142) (Also in [23](https://togithub.com/electron/electron/pull/38225), [24](https://togithub.com/electron/electron/pull/38224), [25](https://togithub.com/electron/electron/pull/38223)) - Fixed `desktopCapturer` thumbnail generation after screen sharing is cancelled on Wayland. [#39246](https://togithub.com/electron/electron/pull/39246) (Also in [25](https://togithub.com/electron/electron/pull/39245)) - Fixed `preload` script may not run in some child windows opened by `window.open`. [#38930](https://togithub.com/electron/electron/pull/38930) (Also in [23](https://togithub.com/electron/electron/pull/38933), [24](https://togithub.com/electron/electron/pull/38932), [25](https://togithub.com/electron/electron/pull/38931)) - Fixed `webContents.printToPDF` `preferCSSPageSize` type error. [#38793](https://togithub.com/electron/electron/pull/38793) (Also in [24](https://togithub.com/electron/electron/pull/38792), [25](https://togithub.com/electron/electron/pull/38791)) - Fixed a console error seen when loading PDFs. [#38127](https://togithub.com/electron/electron/pull/38127) (Also in [25](https://togithub.com/electron/electron/pull/38148)) - Fixed a crash seen when trying to change `nativeTheme` source during mara context menu close. [#38840](https://togithub.com/electron/electron/pull/38840) (Also in [25](https://togithub.com/electron/electron/pull/38839)) - Fixed a crash when listing desktop capture sources on Wayland with PipeWire. [#39049](https://togithub.com/electron/electron/pull/39049) (Also in [23](https://togithub.com/electron/electron/pull/39116), [24](https://togithub.com/electron/electron/pull/39050), [25](https://togithub.com/electron/electron/pull/39051)) - Fixed a potential crash calling `BrowserWindow.removeBrowserView()` with a destroyed `webContents`. [#38885](https://togithub.com/electron/electron/pull/38885) (Also in [24](https://togithub.com/electron/electron/pull/38884), [25](https://togithub.com/electron/electron/pull/38883)) - Fixed a potential crash when calling `webContents.print` with invalid settings. [#38165](https://togithub.com/electron/electron/pull/38165) (Also in [25](https://togithub.com/electron/electron/pull/38230)) - Fixed a potential crash when right-clicking on macOS windows with draggable regions. [#38100](https://togithub.com/electron/electron/pull/38100) (Also in [24](https://togithub.com/electron/electron/pull/38136), [25](https://togithub.com/electron/electron/pull/38115)) - Fixed a rare crash when closing active native tab on macOS. [#39410](https://togithub.com/electron/electron/pull/39410) (Also in [25](https://togithub.com/electron/electron/pull/39409)) - Fixed an error with `webContents.print` parameter validation by adding missing options required to set printer printable area. [#38721](https://togithub.com/electron/electron/pull/38721) (Also in [25](https://togithub.com/electron/electron/pull/38720)) - Fixed an error seen in the Top Level Windows section of `chrome://accessibility`. [#38179](https://togithub.com/electron/electron/pull/38179) (Also in [25](https://togithub.com/electron/electron/pull/38211)) - Fixed an issue on Linux where menus would not open after resizing/maximizing/unmaximizing a window. [#37798](https://togithub.com/electron/electron/pull/37798) (Also in [23](https://togithub.com/electron/electron/pull/37908), [24](https://togithub.com/electron/electron/pull/37906), [25](https://togithub.com/electron/electron/pull/37905)) - Fixed an issue on Windows 10 where the title bar was not correct after changing native theme. [#39309](https://togithub.com/electron/electron/pull/39309) (Also in [25](https://togithub.com/electron/electron/pull/39314)) - Fixed an issue where Windows `FrameView`s always appeared inactive regardless of focus status. [#38468](https://togithub.com/electron/electron/pull/38468) (Also in [25](https://togithub.com/electron/electron/pull/38473)) - Fixed an issue where `