CompatHub
Check EOL

Electron 25 lifecycle

Current status

standard supportlow

Electron 25 is currently in standard support.

Security: 15 tracked advisories affecting this line. Details below — lifecycle and vulnerability status are separate.

Official lifecycle source: Electron npm releases

Support phase
standard support
End of life
Not officially published
Latest release
25.2.0
Released
22 Jun 2023

At a glance

Version line
25
Initial release
29 May 2023
Lifecycle phase
standard support
Latest stable
25.2.0
Latest release date
22 Jun 2023
EOL
Not officially published
Risk
low
Releases tracked
26

Lifecycle timeline

Phases from published LifecyclePeriod records. Missing phases are not inferred.

  1. Release

    29 May 2023

  2. standard supportcurrent

    29 May 2023 → —

    Source: Electron npm releases

Electron 25 is currently in standard support.

Upgrade options

Newer supported Electron version lines from CompatHub lifecycle data. Compatibility and security context use existing evidence only.

You are on Electron 25

Supported

Supported upgrade options

Open full upgrade planner for Electron 25 →

Security

Advisories affecting Electron 25 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities
15
Known exploited
0
Highest CVSS
7.2
  • CVE-2026-70608GHSA-9f4c-93c8-jc8g

    Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

    CVSS:
    7.2 (high) · NVD
    CWE:
    CWE-1021, CWE-693
    Affected:
    <39.8.10
    Fixed in:
    39.8.10
    Source:
    OSV source
  • CVE-2026-70609GHSA-4f78-qhmw-8j8m

    Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

    CVSS:
    5.7 (moderate) · NVD
    CWE:
    CWE-116, CWE-94
    Affected:
    <39.8.7
    Fixed in:
    39.8.7
    Source:
    OSV source
  • CVE-2026-70612GHSA-p2rr-rvmm-c5fp

    Electron: Sandboxed iframes can launch external protocol handlers

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70611GHSA-f2r8-jv7c-xqmp

    Electron: DevTools embedder handler executes arbitrary files via shell open

    Affected:
    <39.8.9
    Fixed in:
    39.8.9
    Source:
    OSV source
  • CVE-2026-70610GHSA-ff2p-hmqr-hxm4

    Electron: contextBridge object copy honors prototype setters

    Affected:
    <39.8.9
    Fixed in:
    39.8.9
    Source:
    OSV source
  • CVE-2026-70607GHSA-v93f-fgjr-hjrj

    Electron: window.open features string controls some window options considered privileged

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70605GHSA-v64r-4m7r-3mvq

    Electron: HTTP redirect followed into local file loader

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70604GHSA-v3j7-r9gq-3gjw

    Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

    Affected:
    <39.8.10
    Fixed in:
    39.8.10
    Source:
    OSV source
  • CVE-2026-70602GHSA-m55f-7gqj-fr98

    Electron: Extension tab APIs operate across session boundaries

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70603GHSA-5c9j-mhmv-5xgx

    Electron: shell.openPath path validation bypass via embedded null byte

    Affected:
    <39.8.6
    Fixed in:
    39.8.6
    Source:
    OSV source
  • CVE-2026-70601GHSA-h7rp-cf8h-j98x

    Electron: Context isolation bypass via Function.prototype.bind hijack

    Affected:
    <39.8.9
    Fixed in:
    39.8.9
    Source:
    OSV source
  • CVE-2026-70600GHSA-x8rc-wpg4-grpf

    Electron: Cross-origin iframe can position native autofill popup

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source
  • CVE-2026-70599GHSA-9pf5-hg6p-4pwp

    Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

    Affected:
    <39.8.7
    Fixed in:
    39.8.7
    Source:
    OSV source
  • CVE-2026-70598GHSA-pfmc-3mgc-p6fp

    Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

    Affected:
    <39.8.10
    Fixed in:
    39.8.10
    Source:
    OSV source
  • CVE-2026-70597GHSA-jm7p-cc5g-qwxx

    Electron: Parent process code-sign check is spoofable

    Affected:
    <39.8.8
    Fixed in:
    39.8.8
    Source:
    OSV source

Latest release

25.2.0

Released 22 Jun 2023 · stable

https://registry.npmjs.org/electron/25.2.0

Previous releases

  • 25.3.0

    12 Jul 2023

  • 25.3.1

    20 Jul 2023

  • 25.1.1

    14 Jun 2023

Release history

26 concrete releases tracked for this line.

VersionRelease dateChannelSource
25.1.114 Jun 2023stableSource
25.2.022 Jun 2023stableSource
25.3.012 Jul 2023stableSource
25.3.120 Jul 2023stableSource
25.3.226 Jul 2023stableSource
25.4.02 Aug 2023stableSource
25.5.09 Aug 2023stableSource
25.6.016 Aug 2023stableSource
25.7.023 Aug 2023stableSource
25.8.030 Aug 2023stableSource
25.8.113 Sept 2023stableSource
25.8.220 Sept 2023stableSource
25.8.327 Sept 2023stableSource
25.8.428 Sept 2023stableSource
25.9.05 Oct 2023stableSource
25.9.111 Oct 2023stableSource
25.9.218 Oct 2023stableSource
25.9.325 Oct 2023stableSource
25.9.48 Nov 2023stableSource
25.9.515 Nov 2023stableSource
25.9.622 Nov 2023stableSource
25.9.71 Dec 2023stableSource
25.9.86 Dec 2023stableSource
25.0.029 May 2023stableSource
25.0.131 May 2023stableSource

Release activity

Total releases
26
Last 30 days
0
Last 90 days
0
Avg. interval
~8 days
Most recent
22 Jun 2023

Should I use this version?

Suitable for new deployments

Electron 25 is currently supported (standard support).

Version comparison

Compact comparison against the nearest relevant release lines.

2544
Statusstandard supportstandard support
Latest release25.1.144.1.1
EOLNot publishedNot published
Risklowlow

Sources

Where this information comes from.

Lifecycle sources

Release sources

Data coverage

Last checked = last successful upstream check. Latest source update = when upstream content last changed.

Releases tracked
26
Lifecycle periods
1
EOL
Not officially published
Provenance records
2
Data last checked
2 Sept 2026
Latest source update
2 Sept 2026

EOL: Not officially published

Other Electron versions