Electron 14 lifecycle

Current status

standard supportlow

Electron 14 is currently in standard support.

Security: 15 tracked advisories affecting this line · 1 in CISA KEV. Details below — lifecycle and vulnerability status are separate.

Official lifecycle source: Electron npm releases

Support phase: standard support
End of life: Not officially published
Latest release: 14.0.1
Released: 13 Sept 2021

At a glance

Version line: 14
Initial release: 30 Aug 2021
Lifecycle phase: standard support
Latest stable: 14.0.1
Latest release date: 13 Sept 2021
EOL: Not officially published
Risk: low
Releases tracked: 15

Lifecycle timeline

Phases from published LifecyclePeriod records. Missing phases are not inferred.

Release
30 Aug 2021
standard supportcurrent
30 Aug 2021 → —
Source: Electron npm releases

Electron 14 is currently in standard support.

Upgrade options

Newer supported Electron version lines from CompatHub lifecycle data. Compatibility and security context use existing evidence only.

You are on Electron 14

Supported

Supported upgrade options

Electron 44
Supported· 30 major versions newer
Upgrade planner →
Electron 43
Supported· 29 major versions newer
Upgrade planner →
Electron 42
Supported· 28 major versions newer
Upgrade planner →

Open full upgrade planner for Electron 14 →

Known exploited vulnerabilities

CVE entries that CISA lists in the Known Exploited Vulnerabilities catalogue, including due dates and ransomware use when published. CVSS shown when NVD enrichment is available.

CVE-2023-5217GHSA-qqvq-6xgj-jw8gKnown exploited
Google Chromium libvpx Heap Buffer Overflow Vulnerability
Electron affected by libvpx's heap buffer overflow in vp8 encoding
CISA KEV:
listed · added 2023-10-02 · due 2023-10-23
Required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS:
8.8 (high) · NVD
CWE:
CWE-787
Affected:
<22.3.25
Fixed in:
22.3.25
Source:
OSV source · Advisory · CISA KEV

Security

Advisories affecting Electron 14 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities: 15
Known exploited: 1
Highest CVSS: 8.8

CVE-2023-5217GHSA-qqvq-6xgj-jw8gKnown exploited
Google Chromium libvpx Heap Buffer Overflow Vulnerability
Electron affected by libvpx's heap buffer overflow in vp8 encoding
CISA KEV:
listed · added 2023-10-02 · due 2023-10-23
Required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS:
8.8 (high) · NVD
CWE:
CWE-787
Affected:
<22.3.25
Fixed in:
22.3.25
Source:
OSV source · Advisory · CISA KEV
CVE-2026-70608GHSA-9f4c-93c8-jc8g
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
CVSS:
7.2 (high) · NVD
CWE:
CWE-1021, CWE-693
Affected:
<39.8.10
Fixed in:
39.8.10
Source:
OSV source
CVE-2026-70609GHSA-4f78-qhmw-8j8m
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
CVSS:
5.7 (moderate) · NVD
CWE:
CWE-116, CWE-94
Affected:
<39.8.7
Fixed in:
39.8.7
Source:
OSV source
CVE-2026-70612GHSA-p2rr-rvmm-c5fp
Electron: Sandboxed iframes can launch external protocol handlers
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70611GHSA-f2r8-jv7c-xqmp
Electron: DevTools embedder handler executes arbitrary files via shell open
Affected:
<39.8.9
Fixed in:
39.8.9
Source:
OSV source
CVE-2026-70610GHSA-ff2p-hmqr-hxm4
Electron: contextBridge object copy honors prototype setters
Affected:
<39.8.9
Fixed in:
39.8.9
Source:
OSV source
CVE-2026-70607GHSA-v93f-fgjr-hjrj
Electron: window.open features string controls some window options considered privileged
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70605GHSA-v64r-4m7r-3mvq
Electron: HTTP redirect followed into local file loader
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70604GHSA-v3j7-r9gq-3gjw
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Affected:
<39.8.10
Fixed in:
39.8.10
Source:
OSV source
CVE-2026-70602GHSA-m55f-7gqj-fr98
Electron: Extension tab APIs operate across session boundaries
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70603GHSA-5c9j-mhmv-5xgx
Electron: shell.openPath path validation bypass via embedded null byte
Affected:
<39.8.6
Fixed in:
39.8.6
Source:
OSV source
CVE-2026-70601GHSA-h7rp-cf8h-j98x
Electron: Context isolation bypass via Function.prototype.bind hijack
Affected:
<39.8.9
Fixed in:
39.8.9
Source:
OSV source
CVE-2026-70600GHSA-x8rc-wpg4-grpf
Electron: Cross-origin iframe can position native autofill popup
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70599GHSA-9pf5-hg6p-4pwp
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Affected:
<39.8.7
Fixed in:
39.8.7
Source:
OSV source
CVE-2026-70598GHSA-pfmc-3mgc-p6fp
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Affected:
<39.8.10
Fixed in:
39.8.10
Source:
OSV source

Latest release

14.0.1

Released 13 Sept 2021 · stable

https://registry.npmjs.org/electron/14.0.1

Previous releases

14.0.2
29 Sept 2021
14.1.0
30 Sept 2021
14.0.0
30 Aug 2021

Release history

15 concrete releases tracked for this line.

Version	Release date	Channel	Source
14.0.0	30 Aug 2021	stable	Source
14.0.1	13 Sept 2021	stable	Source
14.0.2	29 Sept 2021	stable	Source
14.1.0	30 Sept 2021	stable	Source
14.1.1	9 Oct 2021	stable	Source
14.2.0	20 Oct 2021	stable	Source
14.2.1	8 Nov 2021	stable	Source
14.2.2	1 Dec 2021	stable	Source
14.2.3	16 Dec 2021	stable	Source
14.2.4	11 Jan 2022	stable	Source
14.2.5	27 Jan 2022	stable	Source
14.2.6	15 Feb 2022	stable	Source
14.2.7	9 Mar 2022	stable	Source
14.2.8	24 Mar 2022	stable	Source
14.2.9	30 Mar 2022	stable	Source

Release activity

Total releases: 15
Last 30 days: 0
Last 90 days: 0
Avg. interval: ~15 days
Most recent: 13 Sept 2021

Should I use this version?

Suitable for new deployments

Electron 14 is currently supported (standard support).

Version comparison

Compact comparison against the nearest relevant release lines.

	14	44
Status	standard support	standard support
Latest release	14.0.0	44.1.1
EOL	Not published	Not published
Risk	low	low

Sources

Where this information comes from.

Lifecycle sources

Electron npm releasesfirst party · high confidence
Official source: https://www.npmjs.com/package/electron
Last verified 2 Sept 2026
OSV.devfirst party
Official source: https://osv.dev
Verification time not recorded
NVD (NIST)first party
Official source: https://nvd.nist.gov
Verification time not recorded
CISA Known Exploited Vulnerabilitiesfirst party
Official source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Verification time not recorded

Release sources

Electron npm releasesfirst party · high confidence
Official source: https://www.npmjs.com/package/electron
Last verified 2 Sept 2026

Data coverage

Last checked = last successful upstream check. Latest source update = when upstream content last changed.

Releases tracked: 15
Lifecycle periods: 1
EOL: Not officially published
Provenance records: 2
Data last checked: 2 Sept 2026
Latest source update: 2 Sept 2026

EOL: Not officially published