Electron 44

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 24101 lines · 5.3K tokens
  3. Electron 4461 lines · 2.4K tokens
Total264 lines · 10.8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 208
  • 209
  • 214
  • 250
  • 295
  • 297
  • 312
  • 319
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 524
  • 532
  • 602
  • 613
  • 653
  • 732
  • 749
  • 770
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 916
  • 918
  • 922
  • 939
  • 942
  • 943
  • 1004
  • 1321
  • 1333

Prompt Preview

Apply the Node.js 24 and JavaScript ES2026 prompts first. These rules cover Electron 44 BrowserWindow isolation, preload bridges, IPC, navigation, permissions, sessions, custom protocols, external content, updates, signing, and deployment.

Apply Node.js APIs and flags only where Electron exposes them: GUI startup ignores the --permission CLI flag, and sandboxed preloads expose only a limited Node.js subset. Check process.versions.node before using patch-specific baseline features.

BrowserWindow isolation

  • Keep the Electron defaults nodeIntegration: false, contextIsolation: true, and renderer sandboxing enabled for every renderer; enabling nodeIntegration or nodeIntegrationInWorker disables the default sandbox unless sandboxing is explicitly forced.
  • Do not disable webSecurity, certificate validation, same-origin controls, or mixed-content protection.
  • Load local application UI from packaged trusted files through a restricted custom protocol, or from a fixed authenticated HTTPS origin.
  • Create separate sessions and partitions for mutually untrusted origins, accounts, and privilege levels.

Preload and context bridges

  • Expose one narrow method per operation through contextBridge.exposeInMainWorld; never bridge ipcRenderer, Electron, Node.js, filesystem, process, or a caller-selected IPC channel.
  • Do not expose general send, invoke, event subscription, command execution, path, or network primitives to renderers; wrap callbacks for allowed subscriptions so they receive only validated payloads, never the IPC event object.
  • Validate every