Electron 24 lifecycle

At a glance

Version line

24

Initial release

4 Apr 2023

Lifecycle phase

unknown

Latest stable

24.8.8

Latest release date

11 Oct 2023

EOL

Not officially published

Risk

medium

Releases tracked

29

1. Release

   4 Apr 2023

2. unknowncurrent

   4 Apr 2023 → —

   Source: Electron npm releases

Electron 24 has no published vendor calendar support schedule in CompatHub's sources. Release history and dependency requirements are recorded from package metadata without inventing support commitments.

Known vulnerabilities

15

Known exploited

0

Highest CVSS

7.2

• CVE-2026-70608GHSA-9f4c-93c8-jc8g

  Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

  CVSS:

  7.2 (high) · NVD

  CWE:

  CWE-1021, CWE-693

  Affected:

  <39.8.10

  Fixed in:

  39.8.10

  Source:

  OSV source

• CVE-2026-70609GHSA-4f78-qhmw-8j8m

  Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

  CVSS:

  5.7 (moderate) · NVD

  CWE:

  CWE-116, CWE-94

  Affected:

  <39.8.7

  Fixed in:

  39.8.7

  Source:

  OSV source

• CVE-2026-70612GHSA-p2rr-rvmm-c5fp

  Electron: Sandboxed iframes can launch external protocol handlers

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70611GHSA-f2r8-jv7c-xqmp

  Electron: DevTools embedder handler executes arbitrary files via shell open

  Affected:

  <39.8.9

  Fixed in:

  39.8.9

  Source:

  OSV source

• CVE-2026-70610GHSA-ff2p-hmqr-hxm4

  Electron: contextBridge object copy honors prototype setters

  Affected:

  <39.8.9

  Fixed in:

  39.8.9

  Source:

  OSV source

• CVE-2026-70607GHSA-v93f-fgjr-hjrj

  Electron: window.open features string controls some window options considered privileged

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70605GHSA-v64r-4m7r-3mvq

  Electron: HTTP redirect followed into local file loader

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70604GHSA-v3j7-r9gq-3gjw

  Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

  Affected:

  <39.8.10

  Fixed in:

  39.8.10

  Source:

  OSV source

• CVE-2026-70602GHSA-m55f-7gqj-fr98

  Electron: Extension tab APIs operate across session boundaries

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70603GHSA-5c9j-mhmv-5xgx

  Electron: shell.openPath path validation bypass via embedded null byte

  Affected:

  <39.8.6

  Fixed in:

  39.8.6

  Source:

  OSV source

• CVE-2026-70601GHSA-h7rp-cf8h-j98x

  Electron: Context isolation bypass via Function.prototype.bind hijack

  Affected:

  <39.8.9

  Fixed in:

  39.8.9

  Source:

  OSV source

• CVE-2026-70600GHSA-x8rc-wpg4-grpf

  Electron: Cross-origin iframe can position native autofill popup

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

• CVE-2026-70599GHSA-9pf5-hg6p-4pwp

  Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

  Affected:

  <39.8.7

  Fixed in:

  39.8.7

  Source:

  OSV source

• CVE-2026-70598GHSA-pfmc-3mgc-p6fp

  Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

  Affected:

  <39.8.10

  Fixed in:

  39.8.10

  Source:

  OSV source

• CVE-2026-70597GHSA-jm7p-cc5g-qwxx

  Electron: Parent process code-sign check is spoofable

  Affected:

  <39.8.8

  Fixed in:

  39.8.8

  Source:

  OSV source

Total releases

29

Last 30 days

0

Last 90 days

0

Avg. interval

~7 days

Most recent

11 Oct 2023

Releases tracked

29

Lifecycle periods

1

EOL

Not officially published

Provenance records

2

Data last checked

2 Sept 2026

Latest source update

2 Sept 2026

EOL: Not officially published

• Previous

  Electron 23

  unknown

• Next

  Electron 25

  unknown