Electron v43.5.0 Security Patch Summary: Memory Safety, IPC & Process Isolation Fixes

Electron v43.5.0 Security Vulnerability Fix Summary Vulnerability Overview This update fixes multiple security vulnerabilities, primarily involving memory safety, process isolation, permission bypass, and resource loading issues. Scope of Impact Operating Systems: Windows, macOS, Linux Components: BrowserWindow, WebContents, utilityProcess, Node.js, Chromium, ANGLE, V8 Architectures: x64, arm64, armv7l Fix Details 1. Memory Safety and Crash Fixes Illegal Access Errors: Fixed illegal access errors and renderer crashes that could occur after closing a same-origin child window or removing a frame with enabled. Directory Opening Crashes: Fixed issues where the , , or flags caused directory opening failures on Linux arm64 and armv7l. IPC Crashes: Fixed crashes caused by calling after the utility process had exited. WebAuthn Crashes: Fixed an issue on macOS where the WebAuthn Touch ID prompt disappeared after local resource loading. Notification Crashes: Fixed crashes on macOS caused by notifications with unattached icons. Custom Title Bar Regression: Fixed an issue where windows became empty after navigating via back/forward history when using custom title bars. Shared Texture Crashes: Fixed renderer crashes in and utilityProcess caused by an object lifecycle bug. CORS Preflight Redirects: Fixed crashes that occurred when calling while listeners were redirecting CORS preflight requests. WebContents Destruction: Fixed crashes that occurred when WebContents or the parent window was destroyed but the API still referenced it. Event Handler Callbacks: Fixed crashes that occurred when event handler callbacks invoked Electron's synchronous APIs. Document Title Updates: Fixed document title update issues when using back/forward navigation and was not called. Local Resource Loading: Fixed an issue on macOS where loading local resources with region-specific strings (e.g., ) resulted in empty localized strings, potentially crashing the WebAuthn Touch ID prompt. GPU Process Termination: Fixed an issue on Windows where GPU processes in app/MSIX-packaged applications fell back to SwiftShader. Truncated Arguments: Fixed an issue where the receiving process would terminate or receive truncated arguments if a second process was passed an excessively long command line or large attached payload. Wayland Tray Icons: Fixed issues where tray icons did not display or disappeared on Wayland 33.4.1. Crash on Exit: Fixed utility process crashes on exit on Windows 11 24H2 and later. Native Message Boxes: Fixed an issue where native message boxes were incorrectly closed when other applications used invalid button IDs. 2. Other Changes ANGLE Fixes: Ported fixes from upstream ANGLE, Chromium, Dawn, Skia, and V8. V8 Code Cache: Fixed an issue on Windows where scripts failed to compile the V8 code cache on the first page load with a 1-in-200 chance. File Lookup Performance: Improved performance for locating ASAR archives and large file lookups. Multithreading Costs: Reduced the cost of sending large values via , handlers, and . Linux Startup Time: Improved application startup time on Linux by skipping OpenGL probing in GDK and loading FontConfig from the main thread during toolkit initialization. utilityProcess.fork(): Improved startup time for , / , child processes, and Node.js-enabled renderers. Startup Snapshots: Main processes on Linux arm64, Windows arm64, and macOS x64 builds now start from the embedded Node.js startup snapshot, consistent with other platforms, improving startup time. Renderer Loading: , , , and loading in renderers no longer wait for the main process, unless listeners or protocol interceptors are registered. Chromium Update: Updated to 130.0.7781.250. Node.js Update: Updated to v24.19.0. POC Code or Exploit Code No POC code or exploit code is included in the release notes.

Goal Reached Thanks to every supporter — we hit 100%!

Electron v43.5.0 Security Patch Summary: Memory Safety, IPC & Process Isolation Fixes

More from this source