chore(deps): update dependency electron to v41.10.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
electron	41.5.2 → 41.10.3

---

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

CVE-2026-70608 / GHSA-9f4c-93c8-jc8g

More information

Details

Impact

A sandboxed iframe without the allow-popups keyword could still open a new window (or trigger setWindowOpenHandler) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction.

Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected. Apps that deny window creation in setWindowOpenHandler, or that do not embed untrusted content in sandboxed iframes, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for any content you do not trust, rather than relying on the iframe sandbox alone.

Fixed Versions

• 42.0.1
• 41.10.3
• 39.8.10

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

• CVSS Score: 7.2 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

• https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g
• https://github.com/electron/electron/pull/51437
• https://github.com/electron/electron/pull/51438
• https://github.com/electron/electron/pull/51439
• https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57
• https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3
• https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f
• https://github.com/electron/electron/releases/tag/v39.8.10
• https://github.com/electron/electron/releases/tag/v41.10.3
• https://github.com/electron/electron/releases/tag/v42.0.1
• https://github.com/advisories/GHSA-9f4c-93c8-jc8g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

electron/electron (electron)

v41.10.3: electron v41.10.3

Compare Source

Release Notes for v41.10.3

Fixes

• Fixed app.disableHardwareAcceleration() not fully disabling GPU hardware usage on Windows starting from Electron 38. #​52368 ^{(Also in 42, 43, 44)}
• Fixed unnecessary autofill popup creation for fields without datalist suggestions, which could cause input latency on macOS. #​52320 ^{(Also in 42, 43, 44)}

Other Changes

• Backported fixes from upstream Chromium and V8. #​52396

v41.10.2: electron v41.10.2

Compare Source

Release Notes for v41.10.2

Fixes

• Fixed a renderer crash when calling WebAssembly.compileStreaming() or WebAssembly.instantiateStreaming() with nodeIntegration enabled. #​52240 ^{(Also in 42, 43)}

Other Changes

• Backported fixes from upstream Chromium. #​52304

v41.10.1: electron v41.10.1

Compare Source

Release Notes for v41.10.1

Fixes

• Fixed crash triggered by replacing an open application menu. #​52278 ^{(Also in 42, 43, 44)}

v41.10.0: electron v41.10.0

Compare Source

Release Notes for v41.10.0

Other Changes

• Backported fixes from upstream Chromium, ANGLE, Dawn, Skia, and V8. #​52231
• Updated Node.js to v24.18.0. #​52104

v41.9.2: electron v41.9.2

Compare Source

Release Notes for v41.9.2

Fixes

• Fixed an issue where clicking the maximize button could progressively shrink the window in some Wayland environments. #​52074 ^{(Also in 42, 43)}

v41.9.1: electron v41.9.1

Compare Source

Release Notes for v41.9.1

Fixes

• Fixed ProtocolResponse.url requests being made through the default session instead of the session the protocol handler was registered on when ProtocolResponse.session was not set. #​52134 ^{(Also in 40, 42, 43)}
• Made "reload" menu items work with BaseWindow. #​52118 ^{(Also in 42, 43)}

Other Changes

• Backported fixes from upstream Chromium. #​52120
• Backported fixes from upstream Chromium. #​52170

v41.9.0: electron v41.9.0

Compare Source

Release Notes for v41.9.0

Fixes

• Fixed Windows edge case in NativeWindowViews::MoveBehindTaskBarIfNeeded(). #​52023 ^{(Also in 42, 43)}

Other Changes

• Backported fixes from upstream Chromium. #​51976
• Updated Node.js to v24.17.0. #​52065

v41.8.0: electron v41.8.0

Compare Source

Release Notes for v41.8.0

Fixes

• Fixed a browser process crash when calling webContents.reload() or navigating synchronously from the render-process-gone event; the event is now emitted after the renderer's teardown notification has completed. #​51917 ^{(Also in 42, 43)}
• Fixed a bug on Linux where a 1px line appeared at the top of frameless windows if the window and web contents had different background colors. #​52004 ^{(Also in 42, 43)}

Other Changes

• Backported fixes from upstream Chromium and V8. #​51936
• Backported fixes from upstream Chromium, Skia and Dawn. #​51943
• Updated Node.js to v24.16.0. #​51746

Documentation

• Documentation changes: #​51925

v41.7.2: electron v41.7.2

Compare Source

Release Notes for v41.7.2

Fixes

• Fixed an issue on Linux and Windows where frameless windows would shrink when calling win.center(). Additionally, fixed an issue where frameless windows would appear slightly off-center on Windows. #​51919 ^{(Also in 42, 43)}
• Fixed an issue where the "Toggle Developer Tools" menu item failed to function correctly with BaseWindow. #​51902 ^{(Also in 42, 43)}

Other Changes

• Fixed silent data truncation in Buffer/TextEncoder APIs and a crash in fs.writeFileSync with non-ASCII strings on Apple Silicon. #​51851 ^{(Also in 42, 43)}
• Security: backported fixes for CVE-2026-9110, CVE-2026-9111, CVE-2026-9114, CVE-2026-9115, CVE-2026-9116, CVE-2026-9117, CVE-2026-9118, CVE-2026-9120, CVE-2026-9121, CVE-2026-9122, CVE-2026-9124, CVE-2026-9126. #​51906

v41.7.1: electron v41.7.1

Compare Source

Release Notes for v41.7.1

Fixes

• Fixed a potential crash when using webContents.print(). #​51728 ^{(Also in 42)}
• Fixed an issue where custom options in webContents.print() did not prefill the print dialog on macOS. #​51682 ^{(Also in 40, 42)}

v41.7.0: electron v41.7.0

Compare Source

Release Notes for v41.7.0

Features

• Allowed the --experimental-inspector-network-resource Node.js flag to be passed through Electron. #​51377 ^{(Also in 42)}

Fixes

• Fixed crash for Notification close. #​51656 ^{(Also in 42, 43)}

Other Changes

• Backported a batch of upstream fixes for memory-safety and validation issues across media, GPU, networking, accessibility, compositing and the ANGLE GL backend. #​51667
• Backported fixes for several use-after-free and object-lifetime issues in input, UI, Aura, HID and file-system teardown paths, a runtime-effect validation gap in Skia, and an integer overflow in the GLSL translator. #​51647

v41.6.1: electron v41.6.1

Compare Source

Release Notes for v41.6.1

Other Changes

• Improved performance of native event emission, IPC dispatch, and option-dictionary parsing. #​51613 ^{(Also in 42)}
• Security: backported 20 High-severity fixes from Chrome 148 stable release. #​51612

v41.6.0: electron v41.6.0

Compare Source

Release Notes for v41.6.0

Fixes

• Fixed a crash in the macOS Touch ID WebAuthn prompt caused by a missing string resource, and added touchID.promptReason to app.configureWebAuthn() to customize the prompt text. #​51604 ^{(Also in 42, 43)}

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud