Electron 42

Apply the Node.js 24 and JavaScript ES2026 prompts first. Electron 42 pairs Chromium 148 and V8 14.8 with a Node.js 24 main process. It is the oldest line still receiving security fixes and drops out of the three-line support window when Electron 45 ships in October 2026.

Use operating-system controls to restrict Electron's main process: normal Electron startup filters Node.js CLI permission flags, and packaged applications restrict NODE_OPTIONS. Apply the baseline's permission-model launch instructions only to separately launched Node.js processes that support them.

Process model and renderer defaults

• Leave contextIsolation: true, nodeIntegration: false, and the renderer sandbox at their Electron 42 defaults; keep nodeIntegrationInWorker and nodeIntegrationInSubFrames disabled, and never launch production with --no-sandbox.
• Reject changes that set webSecurity: false, allowRunningInsecureContent: true, experimentalFeatures: true, or enableBlinkFeatures on a window that loads anything from outside the application bundle.
• Load application UI over a registered custom scheme instead of file:, so renderer pages never receive the extra privileges Electron grants that scheme.
• Separate accounts, tenants, and privilege levels into distinct session partitions rather than reusing the default session for every window.
• Apply the same webPreferences security controls to offscreen and visible windows.

Preload bridges and renderer API surface

• Publish a small fixed set of named operations through contextBridge.exposeInMainWorld, keeping