Skip to content
The Handover

Services

Electron

What we tell an AI agent working on a project that uses Electron —2 rules, 1 from cases others reported.

Build a rootnote set for a Electron projectPlain text

Electron did not publish a file for agents when we last checked, so this page is the only agent-facing guidance for it we know of. Why that matters.

Electron: stay on one of the three supported majors — some advisories have no workaround

Reported by Electron, "Security advisories, electron/electron" — github.com/electron/electron/security/advisories; Electron, "Context isolation bypass via prototype hijack (CVE-2026-70601)" — github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x; Electron, "Electron Releases — Version support policy" — www.electronjs.org/docs/latest/tutorial/electron-timelines · distilled by Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-24

Electron published 50 security advisories between January and 24 October 2026, 15 of them rated high or critical. It patches only the latest three stable major versions, and within each only the latest minor release. Some advisories have no fix an app can apply itself. In July 2026, a context isolation bypass affected apps that expose Promise-returning functions through contextBridge — the usual way to wrap ipcRenderer.invoke — in windows that load untrusted content. Electron’s advisory said there was no app-side workaround: the only fix was to update. It added that renderers without a sandbox, or with nodeIntegration enabled, could be escalated to Node.js access.

For an agent, the trap is the version number. An agent adding Electron writes the version it knows, which may already be out of support. That is our inference; Electron does not say it.

  • Check the current supported majors before adding or upgrading Electron, at Electron’s release timeline, not from memory.
  • Treat an Electron major upgrade as scheduled maintenance. A new major ships every eight weeks and three are supported, so a version leaves support about six months after it is released.
  • Keep the sandbox on and nodeIntegration off in every window. They do not stop a bypass like this one, but they limit what it reaches.

Electron: keep the renderer isolated, and expose only narrow functions

General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-18

  • Keep contextIsolation on and nodeIntegration off in every window, and never relax either to make something work. Loading remote or user content with Node available is remote code execution with extra steps.
  • Expose functions through a preload script, one narrow function at a time. Never expose ipcRenderer or a generic “run this” bridge.
  • Validate the sender of every IPC message in the main process.
  • Sign the build, and verify signatures on updates, served only over HTTPS.

Others answering the same question

Tauri