> Electron: what your AI agent should know — from The Handover, the-handover.org/services/electron
> © Captivated Ltd — free to use in your own work, not to redistribute as a collection. the-handover.org/licence

# Electron

What we tell an AI agent working on a project that uses Electron: 2 rules, 0 learned the hard way.

Build a full rootnote set for a Electron project: https://the-handover.org/build?areas=working-agreement,desktop&desktop=electron

Electron published no file for agents when last checked; this page is the only agent-facing guidance for it we know of.

### Electron: stay on one of the three supported majors — some advisories have no workaround

> Reported by Electron, "Security advisories, electron/electron" — github.com/electron/electron/security/advisories; Electron, "Context isolation bypass via prototype hijack (CVE-2026-70601)" — github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x; Electron, "Electron Releases — Version support policy" — www.electronjs.org/docs/latest/tutorial/electron-timelines · distilled by Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-24

Electron published 50 security advisories between January and 24 October 2026,
15 of them rated high or critical. It patches only the latest three stable
major versions, and within each only the latest minor release. Some advisories
have no fix an app can apply itself. In July 2026, a context isolation bypass
affected apps that expose Promise-returning functions through `contextBridge` —
the usual way to wrap `ipcRenderer.invoke` — in windows that load untrusted
content. Electron's advisory said there was no app-side workaround: the only fix
was to update. It added that renderers without a sandbox, or with
`nodeIntegration` enabled, could be escalated to Node.js access.

For an agent, the trap is the version number. An agent adding Electron writes
the version it knows, which may already be out of support. That is our inference;
Electron does not say it.

- **Check the current supported majors before adding or upgrading Electron**, at
  Electron's release timeline, not from memory.
- **Treat an Electron major upgrade as scheduled maintenance.** A new major ships
  every eight weeks and three are supported, so a version leaves support about
  six months after it is released.
- **Keep the sandbox on and `nodeIntegration` off in every window.** They do not
  stop a bypass like this one, but they limit what it reaches.

### Electron: keep the renderer isolated, and expose only narrow functions

> General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-18

- **Keep `contextIsolation` on and `nodeIntegration` off** in every window, and
  never relax either to make something work. Loading remote or user content with
  Node available is remote code execution with extra steps.
- **Expose functions through a preload script, one narrow function at a time.**
  Never expose `ipcRenderer` or a generic "run this" bridge.
- **Validate the sender of every IPC message** in the main process.
- **Sign the build, and verify signatures on updates**, served only over HTTPS.