Electron 22 lifecycle

At a glance

Version line

22

Initial release

30 Nov 2022

Lifecycle phase

unknown

Latest stable

22.3.27

Latest release date

9 Oct 2023

EOL

Not officially published

Risk

medium

Releases tracked

33

1. Release

   30 Nov 2022

2. unknowncurrent

   30 Nov 2022 → —

   Source: Electron npm releases

Electron 22 has no published vendor calendar support schedule in CompatHub's sources. Release history and dependency requirements are recorded from package metadata without inventing support commitments.

• CVE-2023-5217GHSA-qqvq-6xgj-jw8gKnown exploited

  Google Chromium libvpx Heap Buffer Overflow Vulnerability

  Electron affected by libvpx's heap buffer overflow in vp8 encoding

  CISA KEV:

  listed · added 2023-10-02 · due 2023-10-23

  Required action:

  Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  CVSS:

  8.8 (high) · NVD

  CWE:

  CWE-787

  Affected:

  <22.3.25

  Fixed in:

  22.3.25

  Source:

  OSV source · Advisory · CISA KEV

Known vulnerabilities

15

Known exploited

1

Highest CVSS

8.8

• CVE-2023-5217GHSA-qqvq-6xgj-jw8gKnown exploited

  Google Chromium libvpx Heap Buffer Overflow Vulnerability

  Electron affected by libvpx's heap buffer overflow in vp8 encoding

  CISA KEV:

  listed · added 2023-10-02 · due 2023-10-23

  Required action:

  Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  CVSS:

  8.8 (high) · NVD

  CWE:

  CWE-787

  Affected:

  <22.3.25

  Fixed in:

  22.3.25

  Source:

  OSV source · Advisory · CISA KEV

• CVE-2026-70608GHSA-9f4c-93c8-jc8g

  Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

  CVSS:

  7.2 (high) · NVD

  CWE:

  CWE-1021, CWE-693

  Affected:

  <39.8.10

  Fixed in:

  39.8.10

  Source:

  OSV source

• CVE-2026-70609GHSA-4f78-qhmw-8j8m

  Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

  CVSS:

  5.7 (moderate) · NVD

  CWE:

  CWE-116, CWE-94

  Affected:

  <39.8.7

  Fixed in:

  39.8.7

  Source:

  OSV source

• CVE-2026-70612GHSA-p2rr-rvmm-c5fp

  Electron: Sandboxed iframes can launch external protocol handlers

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70611GHSA-f2r8-jv7c-xqmp

  Electron: DevTools embedder handler executes arbitrary files via shell open

  Affected:

  <39.8.9

  Fixed in:

  39.8.9

  Source:

  OSV source

• CVE-2026-70610GHSA-ff2p-hmqr-hxm4

  Electron: contextBridge object copy honors prototype setters

  Affected:

  <39.8.9

  Fixed in:

  39.8.9

  Source:

  OSV source

• CVE-2026-70607GHSA-v93f-fgjr-hjrj

  Electron: window.open features string controls some window options considered privileged

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70605GHSA-v64r-4m7r-3mvq

  Electron: HTTP redirect followed into local file loader

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70604GHSA-v3j7-r9gq-3gjw

  Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

  Affected:

  <39.8.10

  Fixed in:

  39.8.10

  Source:

  OSV source

• CVE-2026-70602GHSA-m55f-7gqj-fr98

  Electron: Extension tab APIs operate across session boundaries

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70603GHSA-5c9j-mhmv-5xgx

  Electron: shell.openPath path validation bypass via embedded null byte

  Affected:

  <39.8.6

  Fixed in:

  39.8.6

  Source:

  OSV source

• CVE-2026-70601GHSA-h7rp-cf8h-j98x

  Electron: Context isolation bypass via Function.prototype.bind hijack

  Affected:

  <39.8.9

  Fixed in:

  39.8.9

  Source:

  OSV source

• CVE-2026-70600GHSA-x8rc-wpg4-grpf

  Electron: Cross-origin iframe can position native autofill popup

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70599GHSA-9pf5-hg6p-4pwp

  Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

  Affected:

  <39.8.7

  Fixed in:

  39.8.7

  Source:

  OSV source

• CVE-2026-70598GHSA-pfmc-3mgc-p6fp

  Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

  Affected:

  <39.8.10

  Fixed in:

  39.8.10

  Source:

  OSV source

Total releases

33

Last 30 days

0

Last 90 days

0

Avg. interval

~10 days

Most recent

9 Oct 2023

Releases tracked

33

Lifecycle periods

1

EOL

Not officially published

Provenance records

2

Data last checked

2 Sept 2026

Latest source update

2 Sept 2026

EOL: Not officially published

• Previous

  Electron 21

  unknown

• Next

  Electron 23

  unknown