Electron 3 lifecycle

Current status

standard supportlow

Electron 3 is currently in standard support.

Security: 15 tracked advisories affecting this line · 1 in CISA KEV. Details below — lifecycle and vulnerability status are separate.

Official lifecycle source: Electron npm releases

Support phase: standard support
End of life: Not officially published
Latest release: 3.1.7
Released: 21 Mar 2019

At a glance

Version line: 3
Initial release: 18 Sept 2018
Lifecycle phase: standard support
Latest stable: 3.1.7
Latest release date: 21 Mar 2019
EOL: Not officially published
Risk: low
Releases tracked: 31

Lifecycle timeline

Phases from published LifecyclePeriod records. Missing phases are not inferred.

Release
18 Sept 2018
standard supportcurrent
18 Sept 2018 → —
Source: Electron npm releases

Electron 3 is currently in standard support.

Upgrade options

Newer supported Electron version lines from CompatHub lifecycle data. Compatibility and security context use existing evidence only.

You are on Electron 3

Supported

Supported upgrade options

Electron 44
Supported· 41 major versions newer
Upgrade planner →
Electron 43
Supported· 40 major versions newer
Upgrade planner →
Electron 42
Supported· 39 major versions newer
Upgrade planner →

Open full upgrade planner for Electron 3 →

Known exploited vulnerabilities

CVE entries that CISA lists in the Known Exploited Vulnerabilities catalogue, including due dates and ransomware use when published. CVSS shown when NVD enrichment is available.

CVE-2023-5217GHSA-qqvq-6xgj-jw8gKnown exploited
Google Chromium libvpx Heap Buffer Overflow Vulnerability
Electron affected by libvpx's heap buffer overflow in vp8 encoding
CISA KEV:
listed · added 2023-10-02 · due 2023-10-23
Required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS:
8.8 (high) · NVD
CWE:
CWE-787
Affected:
<22.3.25
Fixed in:
22.3.25
Source:
OSV source · Advisory · CISA KEV

Security

Advisories affecting Electron 3 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities: 15
Known exploited: 1
Highest CVSS: 8.8

CVE-2023-5217GHSA-qqvq-6xgj-jw8gKnown exploited
Google Chromium libvpx Heap Buffer Overflow Vulnerability
Electron affected by libvpx's heap buffer overflow in vp8 encoding
CISA KEV:
listed · added 2023-10-02 · due 2023-10-23
Required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS:
8.8 (high) · NVD
CWE:
CWE-787
Affected:
<22.3.25
Fixed in:
22.3.25
Source:
OSV source · Advisory · CISA KEV
CVE-2026-70608GHSA-9f4c-93c8-jc8g
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
CVSS:
7.2 (high) · NVD
CWE:
CWE-1021, CWE-693
Affected:
<39.8.10
Fixed in:
39.8.10
Source:
OSV source
CVE-2026-70609GHSA-4f78-qhmw-8j8m
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
CVSS:
5.7 (moderate) · NVD
CWE:
CWE-116, CWE-94
Affected:
<39.8.7
Fixed in:
39.8.7
Source:
OSV source
CVE-2026-70612GHSA-p2rr-rvmm-c5fp
Electron: Sandboxed iframes can launch external protocol handlers
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70611GHSA-f2r8-jv7c-xqmp
Electron: DevTools embedder handler executes arbitrary files via shell open
Affected:
<39.8.9
Fixed in:
39.8.9
Source:
OSV source
CVE-2026-70610GHSA-ff2p-hmqr-hxm4
Electron: contextBridge object copy honors prototype setters
Affected:
<39.8.9
Fixed in:
39.8.9
Source:
OSV source
CVE-2026-70607GHSA-v93f-fgjr-hjrj
Electron: window.open features string controls some window options considered privileged
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70605GHSA-v64r-4m7r-3mvq
Electron: HTTP redirect followed into local file loader
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70604GHSA-v3j7-r9gq-3gjw
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Affected:
<39.8.10
Fixed in:
39.8.10
Source:
OSV source
CVE-2026-70602GHSA-m55f-7gqj-fr98
Electron: Extension tab APIs operate across session boundaries
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70603GHSA-5c9j-mhmv-5xgx
Electron: shell.openPath path validation bypass via embedded null byte
Affected:
<39.8.6
Fixed in:
39.8.6
Source:
OSV source
CVE-2026-70601GHSA-h7rp-cf8h-j98x
Electron: Context isolation bypass via Function.prototype.bind hijack
Affected:
<39.8.9
Fixed in:
39.8.9
Source:
OSV source
CVE-2026-70600GHSA-x8rc-wpg4-grpf
Electron: Cross-origin iframe can position native autofill popup
Affected:
<39.8.8
Fixed in:
39.8.8
Source:
OSV source
CVE-2026-70599GHSA-9pf5-hg6p-4pwp
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Affected:
<39.8.7
Fixed in:
39.8.7
Source:
OSV source
CVE-2026-70598GHSA-pfmc-3mgc-p6fp
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
Affected:
<39.8.10
Fixed in:
39.8.10
Source:
OSV source

Latest release

3.1.7

Released 21 Mar 2019 · stable

https://registry.npmjs.org/electron/3.1.7

Previous releases

3.1.8
28 Mar 2019
3.1.9
1 May 2019
3.1.6
8 Mar 2019

Release history

31 concrete releases tracked for this line.

Version	Release date	Channel	Source
3.1.6	8 Mar 2019	stable	Source
3.1.7	21 Mar 2019	stable	Source
3.1.8	28 Mar 2019	stable	Source
3.1.9	1 May 2019	stable	Source
3.1.10	29 May 2019	stable	Source
3.1.11	6 Jun 2019	stable	Source
3.1.12	11 Jul 2019	stable	Source
3.1.13	31 Jul 2019	stable	Source
3.0.0	18 Sept 2018	stable	Source
3.0.1	27 Sept 2018	stable	Source
3.0.2	27 Sept 2018	stable	Source
3.0.3	7 Oct 2018	stable	Source
3.0.4	11 Oct 2018	stable	Source
3.0.5	19 Oct 2018	stable	Source
3.0.6	24 Oct 2018	stable	Source
3.0.7	1 Nov 2018	stable	Source
3.0.8	5 Nov 2018	stable	Source
3.0.9	13 Nov 2018	stable	Source
3.0.10	19 Nov 2018	stable	Source
3.0.11	11 Dec 2018	stable	Source
3.0.12	14 Dec 2018	stable	Source
3.0.13	17 Dec 2018	stable	Source
3.0.14	4 Jan 2019	stable	Source
3.0.15	31 Jan 2019	stable	Source
3.0.16	8 Mar 2019	stable	Source

Release activity

Total releases: 31
Last 30 days: 0
Last 90 days: 0
Avg. interval: ~11 days
Most recent: 21 Mar 2019

Should I use this version?

Suitable for new deployments

Electron 3 is currently supported (standard support).

Version comparison

Compact comparison against the nearest relevant release lines.

	3	44
Status	standard support	standard support
Latest release	3.1.6	44.1.1
EOL	Not published	Not published
Risk	low	low

Sources

Where this information comes from.

Lifecycle sources

Electron npm releasesfirst party · high confidence
Official source: https://www.npmjs.com/package/electron
Last verified 2 Sept 2026
OSV.devfirst party
Official source: https://osv.dev
Verification time not recorded
NVD (NIST)first party
Official source: https://nvd.nist.gov
Verification time not recorded
CISA Known Exploited Vulnerabilitiesfirst party
Official source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Verification time not recorded

Release sources

Electron npm releasesfirst party · high confidence
Official source: https://www.npmjs.com/package/electron
Last verified 2 Sept 2026

Data coverage

Last checked = last successful upstream check. Latest source update = when upstream content last changed.

Releases tracked: 31
Lifecycle periods: 1
EOL: Not officially published
Provenance records: 2
Data last checked: 2 Sept 2026
Latest source update: 2 Sept 2026

EOL: Not officially published