fix: don't expose chrome.webstorePrivate to web pages by trop[bot] · Pull Request #53776 · electron/electron

trop · 2026-09-09T13:00:27Z

Backport of #53752

See that PR for details.

Notes: Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported chrome.webstorePrivate API.

Since the webstorePrivate API moved to //extensions (CL 7874276), the core feature files expose it to web pages on the Chrome Web Store origin and the core provider registers its functions. Electron does not provide a WebstorePrivateAPIDelegate, so a webContents that navigated to chromewebstore.google.com got chrome.webstorePrivate bindings and calling into them dereferenced a null delegate in the browser process. Override the core "webstorePrivate" feature so it is unavailable in every context, and replace the core-registered functions with ones that respond with an error so a stray request cannot crash the browser. Co-authored-by: Keeley Hammond <[email protected]>

randomUUID from node:crypto is not imported in extensions-spec.ts on this branch; match the surrounding tests instead.

release-clerk · 2026-09-12T20:42:46Z

Release Notes Persisted

Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported chrome.webstorePrivate API.

…s Freedom (solardev-xyz#346) Electron 44.3.0 (Chromium 152) registers the `webstorePrivate` extension API and ships the core `_api_features.json` entry exposing it to ordinary web pages on `https://chromewebstore.google.com/*`, with no WebstorePrivateAPIDelegate behind it. The store calls `chrome.webstorePrivate.getReferrerChain()` as soon as a detail page renders, which is a null-pointer method call on CrBrowserMain — SIGSEGV, whole app gone. Fixed upstream in electron/electron#53752, backported to 44-x-y in electron/electron#53776, shipped in v44.4.0: "Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported chrome.webstorePrivate API. #53776" 44.4.1 is the newest 44.x patch, so the pin goes there. Also: - test-e2e/live/chrome-webstore.spec.js — live regression test (the exposure is keyed on the real store origin, so no fixture can stand in for it): asserts `typeof chrome.webstorePrivate === 'undefined'` on the store front page, and that navigating to the issue's detail URL leaves the main process answering IPC for 30s afterwards. Clicks through Google's consent wall and the "switch to Chrome" promo, and pins `process.versions.electron` from inside the app. Wired into a new `e2e-chrome-webstore` CI job next to `e2e-ant`. - scripts/check-electron-version.js (+ test, + a check in check-binaries.js) — closes the Linux non-repro trap: node_modules/electron was 43.4.1 while the lockfile pinned 44.3.0, and electron-builder packages the node_modules copy (app-builder-lib's computeElectronVersion reads its package.json), so a stale tree ran and shipped a different Electron from the one CI described. - licenses-audit.json / LICENSE_AUDIT.md record the new lockfile-resolved version (licenses-audit.test.js enforces this), and comments claiming 44.3.0 is "the Electron this repo ships" are reworded to say what it shipped then.

##### [v44.4.5](https://github.com/electron/electron/releases/tag/v44.4.5) ### Release Notes for v44.4.5 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. [#54222](electron/electron#54222) ##### [v44.4.4](https://github.com/electron/electron/releases/tag/v44.4.4) ### Release Notes for v44.4.4 #### Fixes - Fixed a `Cannot read properties of undefined (reading 'startTime')` error thrown in pages while the DevTools Performance panel's live metrics were active. [#54162](electron/electron#54162) - Fixed a crash when calling `setIgnoreMenuShortcuts()` on DevTools. [#54116](electron/electron#54116) (Also in [43](electron/electron#54117), [45](https://github.com/electron/electron/pull/54115)) - Fixed a spurious "`sandboxed_renderer.bundle.js` script failed to run" console error when DevTools attached to a sandboxed frame before its first navigation. [#54155](electron/electron#54155) (Also in [42](electron/electron#54175), [43](https://github.com/electron/electron/pull/54176)) - Fixed alignment of the text label and popup menu in the macOS save dialog. [#54143](electron/electron#54143) (Also in [45](https://github.com/electron/electron/pull/54144)) - Fixed an "Invalid `guestInstanceId`" error when removing a loaded `<webview>` from the DOM. [#54099](electron/electron#54099) (Also in [42](electron/electron#54098), [43](electron/electron#54097), [45](https://github.com/electron/electron/pull/54096)) - Fixed GPU shaders compiled by Skia not being cached between launches. [#54161](electron/electron#54161) (Also in [45](https://github.com/electron/electron/pull/54156)) - Fixed `ready-to-show` never firing for some hidden windows on Windows and Linux. [#54118](electron/electron#54118) (Also in [43](electron/electron#54119), [45](https://github.com/electron/electron/pull/54110)) - Fixed the tray context menu not working for snap-confined apps because AppArmor blocked the `/org/chromium/DbusMenu` path. [#54103](electron/electron#54103) (Also in [45](https://github.com/electron/electron/pull/54102)) ##### [v44.4.3](https://github.com/electron/electron/releases/tag/v44.4.3) ### Release Notes for v44.4.3 #### Fixes - Fixed `net.fetch()` / `net.request()` spending seconds of main-process time buffering large streamed request bodies. [#54061](electron/electron#54061) (Also in [45](https://github.com/electron/electron/pull/54062)) #### Performance Improvements - Improved the performance of `fs` operations and `require()` on files inside asar archives. [#54051](electron/electron#54051) (Also in [45](https://github.com/electron/electron/pull/53951)) #### Other Changes - Backported fixes from upstream Chromium, PDFium, Skia and V8. [#54081](electron/electron#54081) ##### [v44.4.2](https://github.com/electron/electron/releases/tag/v44.4.2) ### Release Notes for v44.4.2 #### Fixes - Fixed a potential UAF when a `select-usb-device` handler destroys the requesting `webContents`. [#54009](electron/electron#54009) (Also in [43](electron/electron#54007), [45](https://github.com/electron/electron/pull/54008)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Skia and V8. [#53985](electron/electron#53985) - Updated Chromium to 152.0.7977.130. [#53778](electron/electron#53778) ##### [v44.4.1](https://github.com/electron/electron/releases/tag/v44.4.1) ### Release Notes for v44.4.1 #### Fixes - Fixed default protocol client APIs falsely returning `true` on Windows. [#53959](electron/electron#53959) (Also in [43](electron/electron#53960), [45](https://github.com/electron/electron/pull/53958)) - Fixed several object lifetime issues in `Debugger`, `Menu`, `Tray`, `Notification`, `globalShortcut`, `utilityProcess`, `ServiceWorkerMain`, `WebFrameMain`, `webFrame`, `sharedTexture`, `systemPreferences`, `netLog`, `MessagePortMain`, `net.request` and `shell.openPath()`. [#53968](electron/electron#53968) (Also in [45](https://github.com/electron/electron/pull/53805)) ##### [v44.4.0](https://github.com/electron/electron/releases/tag/v44.4.0) ### Release Notes for v44.4.0 #### Features - Added `initiatorOrigin` to webRequest and protocol handler requests, `DownloadItem.getInitiatorOrigin()`, and a trailing `frame` argument to the `will-download` and `preconnect` session events. [#53703](electron/electron#53703) (Also in [43](electron/electron#53704), [45](https://github.com/electron/electron/pull/53700)) #### Fixes - Added validation to `protocol.registerSchemesAsPrivileged()` to reject protocol names that do not conform to RFC 3986 URI scheme grammar. [#53743](electron/electron#53743) (Also in [45](https://github.com/electron/electron/pull/53742)) - Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported `chrome.webstorePrivate` API. [#53776](electron/electron#53776) (Also in [45](https://github.com/electron/electron/pull/53775)) - Fixed a main-process crash when an app called `loadURL()` again right after a load failed because the renderer process exited before the page committed. [#53943](electron/electron#53943) (Also in [43](electron/electron#53944), [45](https://github.com/electron/electron/pull/53942)) - Fixed a memory leak on Windows when `app.getPreferredSystemLanguages()` was called. [#53868](electron/electron#53868) (Also in [43](electron/electron#53867), [45](https://github.com/electron/electron/pull/53869)) - Fixed a potential UAF in `app.getPreferredSystemLanguages()` on Windows. [#53865](electron/electron#53865) (Also in [43](electron/electron#53866), [45](https://github.com/electron/electron/pull/53864)) - Fixed a renderer crash that could occur when printing from an iframe. [#53762](electron/electron#53762) (Also in [43](electron/electron#53761), [45](https://github.com/electron/electron/pull/53763)) - Fixed a renderer crash when an iframe was removed right after loading with `nodeIntegrationInSubFrames` enabled and `sandbox` disabled, e.g. on pages that embed Meta Pixel. [#53885](electron/electron#53885) (Also in [42](electron/electron#53886), [43](electron/electron#53884), [45](https://github.com/electron/electron/pull/53883)) - Fixed a Windows renderer crash when no default locale could be determined. [#53947](electron/electron#53947) - Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. [#53749](electron/electron#53749) (Also in [43](electron/electron#53750), [45](https://github.com/electron/electron/pull/53748)) - Fixed helper executables on macOS starting a second app instance when launched without a process type, for example through `child_process.fork()` with the `runAsNode` fuse disabled; `fork()` now throws in that configuration. [#53840](electron/electron#53840) (Also in [45](https://github.com/electron/electron/pull/53839)) - Fixed V8 code caching for https scripts loaded by `file://` and custom-scheme pages. [#53745](electron/electron#53745) (Also in [45](https://github.com/electron/electron/pull/53746)) - Fixed `webContents` emitting `unresponsive` right after the system wakes from sleep on Windows, and emitting `responsive` when a hung window was hidden rather than when it recovered. [#53764](electron/electron#53764) (Also in [45](https://github.com/electron/electron/pull/53760)) - Fixed `webContents.capturePage()` on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's `offscreen.deviceScaleFactor`. [#53816](electron/electron#53816) (Also in [43](electron/electron#53818), [45](https://github.com/electron/electron/pull/53817)) - Fixed Window Controls Overlay CSS environment variables and `navigator.windowControlsOverlay` not being populated for `WebContentsView`s in a `BaseWindow`. [#53812](electron/electron#53812) (Also in [45](https://github.com/electron/electron/pull/53811)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. [#53769](electron/electron#53769) - Updated Node.js to v24.21.0. [#53779](electron/electron#53779) ##### [v44.3.0](https://github.com/electron/electron/releases/tag/v44.3.0) ### Release Notes for v44.3.0 #### Features - Added the `ELECTRON_DEBUG_DRAGGABLE_REGIONS` environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. [#53627](electron/electron#53627) (Also in [43](electron/electron#53633), [45](https://github.com/electron/electron/pull/53626)) #### Fixes - File System Access permission requests and the `file-system-access-restricted` event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. [#53691](electron/electron#53691) (Also in [42](electron/electron#53695), [43](electron/electron#53694), [45](https://github.com/electron/electron/pull/53690)) - Fixed Ctrl+Y not yanking text killed with Ctrl+K in text fields on macOS. [#53714](electron/electron#53714) (Also in [45](https://github.com/electron/electron/pull/53715)) - Fixed `Tray` icons not appearing when running inside Flatpak or Snap sandboxes on Linux. [#53653](electron/electron#53653) (Also in [45](https://github.com/electron/electron/pull/53654)) - Fixed `app.getGPUInfo('complete')` stalling the GPU process for several seconds on some Windows systems. [#53644](electron/electron#53644) (Also in [45](https://github.com/electron/electron/pull/53645)) - Fixed `session.setPermissionCheckHandler` receiving the top-level origin and a null `webContents` for `hid` and `usb` checks made from a subframe. [#53688](electron/electron#53688) (Also in [42](electron/electron#53736), [43](electron/electron#53689), [45](https://github.com/electron/electron/pull/53679)) - Fixed `webContents.on()`, `removeListener()` and `removeAllListeners()` throwing "Object has been destroyed" for `console-message` listeners after the WebContents was destroyed. [#53494](electron/electron#53494) (Also in [42](electron/electron#53497), [43](electron/electron#53496), [45](https://github.com/electron/electron/pull/53495)) - Fixed a crash on Linux when `process.env` was written while another thread was reading the environment, and a memory leak when a worker thread exits. [#53509](electron/electron#53509) (Also in [42](electron/electron#53511), [43](electron/electron#53510), [45](https://github.com/electron/electron/pull/53508)) - Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. [#53583](electron/electron#53583) (Also in [42](electron/electron#53585), [43](electron/electron#53584), [45](https://github.com/electron/electron/pull/53586)) - Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process `window.open()` child whose `contextIsolation` differed from its opener's. [#53539](electron/electron#53539) (Also in [42](electron/electron#53541), [43](electron/electron#53540), [45](https://github.com/electron/electron/pull/53538)) - Fixed a spurious `node_init` error being logged when creating a `ShadowRealm` with Node.js integration enabled. [#53579](electron/electron#53579) (Also in [45](https://github.com/electron/electron/pull/53578)) - Fixed crashes in `setDisplayMediaRequestHandler` when the granted frame had been destroyed or another tab was granted by id. [#53672](electron/electron#53672) (Also in [42](electron/electron#53674), [43](electron/electron#53671), [45](https://github.com/electron/electron/pull/53673)) - Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. [#53630](electron/electron#53630) (Also in [43](electron/electron#53631), [45](https://github.com/electron/electron/pull/53471)) - Fixed window state not being persisted when a window entered or left fullscreen, or was maximized or unmaximized, without also being moved or resized. [#53576](electron/electron#53576) (Also in [45](https://github.com/electron/electron/pull/53577)) - Internal `<webview>`, `window.close()` and `executeJavaScript` reply IPCs are validated against the sending frame. [#53723](electron/electron#53723) (Also in [42](electron/electron#53727), [43](electron/electron#53726), [45](https://github.com/electron/electron/pull/53724)) - `<webview>` without `allowpopups` also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. [#53721](electron/electron#53721) (Also in [42](electron/electron#53719), [43](electron/electron#53718), [45](https://github.com/electron/electron/pull/53717)) - `getUserMedia` with `chromeMediaSource: 'desktop'` no longer accepts WebContents source ids; use `chromeMediaSource: 'tab'` with `webContents.getMediaSourceId()` or `setDisplayMediaRequestHandler` to capture a WebContents. [#53709](electron/electron#53709) (Also in [42](electron/electron#53710), [43](electron/electron#53707), [45](https://github.com/electron/electron/pull/53708)) - `nodeIntegrationInWorker` now applies only to workers created by frames that themselves have Node integration; enable `nodeIntegrationInSubFrames` to keep Node in workers created by subframes. [#53711](electron/electron#53711) (Also in [42](electron/electron#53713), [43](electron/electron#53712), [45](https://github.com/electron/electron/pull/53706)) - `openExternal` permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. [#53699](electron/electron#53699) (Also in [42](electron/electron#53697), [43](electron/electron#53698), [45](https://github.com/electron/electron/pull/53696)) - `pointerLock` and `keyboardLock` permission requests now report the requesting frame, and `execCommand('paste')` requires user activation in the frame that calls it. [#53693](electron/electron#53693) (Also in [42](electron/electron#53702), [43](electron/electron#53701), [45](https://github.com/electron/electron/pull/53692)) #### Other Changes - Fixed the app becoming unresponsive when a page has a very large number of `app-region` draggable elements. [#53597](electron/electron#53597) (Also in [43](electron/electron#53632), [45](https://github.com/electron/electron/pull/53596)) - Updated Chromium to 152.0.7977.78. [#53523](electron/electron#53523)

##### [v44.4.5](https://github.com/electron/electron/releases/tag/v44.4.5) ### Release Notes for v44.4.5 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. [#54222](electron/electron#54222) ##### [v44.4.4](https://github.com/electron/electron/releases/tag/v44.4.4) ### Release Notes for v44.4.4 #### Fixes - Fixed a `Cannot read properties of undefined (reading 'startTime')` error thrown in pages while the DevTools Performance panel's live metrics were active. [#54162](electron/electron#54162) - Fixed a crash when calling `setIgnoreMenuShortcuts()` on DevTools. [#54116](electron/electron#54116) (Also in [43](electron/electron#54117), [45](https://github.com/electron/electron/pull/54115)) - Fixed a spurious "`sandboxed_renderer.bundle.js` script failed to run" console error when DevTools attached to a sandboxed frame before its first navigation. [#54155](electron/electron#54155) (Also in [42](electron/electron#54175), [43](https://github.com/electron/electron/pull/54176)) - Fixed alignment of the text label and popup menu in the macOS save dialog. [#54143](electron/electron#54143) (Also in [45](https://github.com/electron/electron/pull/54144)) - Fixed an "Invalid `guestInstanceId`" error when removing a loaded `<webview>` from the DOM. [#54099](electron/electron#54099) (Also in [42](electron/electron#54098), [43](electron/electron#54097), [45](https://github.com/electron/electron/pull/54096)) - Fixed GPU shaders compiled by Skia not being cached between launches. [#54161](electron/electron#54161) (Also in [45](https://github.com/electron/electron/pull/54156)) - Fixed `ready-to-show` never firing for some hidden windows on Windows and Linux. [#54118](electron/electron#54118) (Also in [43](electron/electron#54119), [45](https://github.com/electron/electron/pull/54110)) - Fixed the tray context menu not working for snap-confined apps because AppArmor blocked the `/org/chromium/DbusMenu` path. [#54103](electron/electron#54103) (Also in [45](https://github.com/electron/electron/pull/54102)) ##### [v44.4.3](https://github.com/electron/electron/releases/tag/v44.4.3) ### Release Notes for v44.4.3 #### Fixes - Fixed `net.fetch()` / `net.request()` spending seconds of main-process time buffering large streamed request bodies. [#54061](electron/electron#54061) (Also in [45](https://github.com/electron/electron/pull/54062)) #### Performance Improvements - Improved the performance of `fs` operations and `require()` on files inside asar archives. [#54051](electron/electron#54051) (Also in [45](https://github.com/electron/electron/pull/53951)) #### Other Changes - Backported fixes from upstream Chromium, PDFium, Skia and V8. [#54081](electron/electron#54081) ##### [v44.4.2](https://github.com/electron/electron/releases/tag/v44.4.2) ### Release Notes for v44.4.2 #### Fixes - Fixed a potential UAF when a `select-usb-device` handler destroys the requesting `webContents`. [#54009](electron/electron#54009) (Also in [43](electron/electron#54007), [45](https://github.com/electron/electron/pull/54008)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Skia and V8. [#53985](electron/electron#53985) - Updated Chromium to 152.0.7977.130. [#53778](electron/electron#53778) ##### [v44.4.1](https://github.com/electron/electron/releases/tag/v44.4.1) ### Release Notes for v44.4.1 #### Fixes - Fixed default protocol client APIs falsely returning `true` on Windows. [#53959](electron/electron#53959) (Also in [43](electron/electron#53960), [45](https://github.com/electron/electron/pull/53958)) - Fixed several object lifetime issues in `Debugger`, `Menu`, `Tray`, `Notification`, `globalShortcut`, `utilityProcess`, `ServiceWorkerMain`, `WebFrameMain`, `webFrame`, `sharedTexture`, `systemPreferences`, `netLog`, `MessagePortMain`, `net.request` and `shell.openPath()`. [#53968](electron/electron#53968) (Also in [45](https://github.com/electron/electron/pull/53805)) ##### [v44.4.0](https://github.com/electron/electron/releases/tag/v44.4.0) ### Release Notes for v44.4.0 #### Features - Added `initiatorOrigin` to webRequest and protocol handler requests, `DownloadItem.getInitiatorOrigin()`, and a trailing `frame` argument to the `will-download` and `preconnect` session events. [#53703](electron/electron#53703) (Also in [43](electron/electron#53704), [45](https://github.com/electron/electron/pull/53700)) #### Fixes - Added validation to `protocol.registerSchemesAsPrivileged()` to reject protocol names that do not conform to RFC 3986 URI scheme grammar. [#53743](electron/electron#53743) (Also in [45](https://github.com/electron/electron/pull/53742)) - Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported `chrome.webstorePrivate` API. [#53776](electron/electron#53776) (Also in [45](https://github.com/electron/electron/pull/53775)) - Fixed a main-process crash when an app called `loadURL()` again right after a load failed because the renderer process exited before the page committed. [#53943](electron/electron#53943) (Also in [43](electron/electron#53944), [45](https://github.com/electron/electron/pull/53942)) - Fixed a memory leak on Windows when `app.getPreferredSystemLanguages()` was called. [#53868](electron/electron#53868) (Also in [43](electron/electron#53867), [45](https://github.com/electron/electron/pull/53869)) - Fixed a potential UAF in `app.getPreferredSystemLanguages()` on Windows. [#53865](electron/electron#53865) (Also in [43](electron/electron#53866), [45](https://github.com/electron/electron/pull/53864)) - Fixed a renderer crash that could occur when printing from an iframe. [#53762](electron/electron#53762) (Also in [43](electron/electron#53761), [45](https://github.com/electron/electron/pull/53763)) - Fixed a renderer crash when an iframe was removed right after loading with `nodeIntegrationInSubFrames` enabled and `sandbox` disabled, e.g. on pages that embed Meta Pixel. [#53885](electron/electron#53885) (Also in [42](electron/electron#53886), [43](electron/electron#53884), [45](https://github.com/electron/electron/pull/53883)) - Fixed a Windows renderer crash when no default locale could be determined. [#53947](electron/electron#53947) - Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. [#53749](electron/electron#53749) (Also in [43](electron/electron#53750), [45](https://github.com/electron/electron/pull/53748)) - Fixed helper executables on macOS starting a second app instance when launched without a process type, for example through `child_process.fork()` with the `runAsNode` fuse disabled; `fork()` now throws in that configuration. [#53840](electron/electron#53840) (Also in [45](https://github.com/electron/electron/pull/53839)) - Fixed V8 code caching for https scripts loaded by `file://` and custom-scheme pages. [#53745](electron/electron#53745) (Also in [45](https://github.com/electron/electron/pull/53746)) - Fixed `webContents` emitting `unresponsive` right after the system wakes from sleep on Windows, and emitting `responsive` when a hung window was hidden rather than when it recovered. [#53764](electron/electron#53764) (Also in [45](https://github.com/electron/electron/pull/53760)) - Fixed `webContents.capturePage()` on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's `offscreen.deviceScaleFactor`. [#53816](electron/electron#53816) (Also in [43](electron/electron#53818), [45](https://github.com/electron/electron/pull/53817)) - Fixed Window Controls Overlay CSS environment variables and `navigator.windowControlsOverlay` not being populated for `WebContentsView`s in a `BaseWindow`. [#53812](electron/electron#53812) (Also in [45](https://github.com/electron/electron/pull/53811)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. [#53769](electron/electron#53769) - Updated Node.js to v24.21.0. [#53779](electron/electron#53779) ##### [v44.3.0](https://github.com/electron/electron/releases/tag/v44.3.0) ### Release Notes for v44.3.0 #### Features - Added the `ELECTRON_DEBUG_DRAGGABLE_REGIONS` environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. [#53627](electron/electron#53627) (Also in [43](electron/electron#53633), [45](https://github.com/electron/electron/pull/53626)) #### Fixes - File System Access permission requests and the `file-system-access-restricted` event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. [#53691](electron/electron#53691) (Also in [42](electron/electron#53695), [43](electron/electron#53694), [45](https://github.com/electron/electron/pull/53690)) - Fixed Ctrl+Y not yanking text killed with Ctrl+K in text fields on macOS. [#53714](electron/electron#53714) (Also in [45](https://github.com/electron/electron/pull/53715)) - Fixed `Tray` icons not appearing when running inside Flatpak or Snap sandboxes on Linux. [#53653](electron/electron#53653) (Also in [45](https://github.com/electron/electron/pull/53654)) - Fixed `app.getGPUInfo('complete')` stalling the GPU process for several seconds on some Windows systems. [#53644](electron/electron#53644) (Also in [45](https://github.com/electron/electron/pull/53645)) - Fixed `session.setPermissionCheckHandler` receiving the top-level origin and a null `webContents` for `hid` and `usb` checks made from a subframe. [#53688](electron/electron#53688) (Also in [42](electron/electron#53736), [43](electron/electron#53689), [45](https://github.com/electron/electron/pull/53679)) - Fixed `webContents.on()`, `removeListener()` and `removeAllListeners()` throwing "Object has been destroyed" for `console-message` listeners after the WebContents was destroyed. [#53494](electron/electron#53494) (Also in [42](electron/electron#53497), [43](electron/electron#53496), [45](https://github.com/electron/electron/pull/53495)) - Fixed a crash on Linux when `process.env` was written while another thread was reading the environment, and a memory leak when a worker thread exits. [#53509](electron/electron#53509) (Also in [42](electron/electron#53511), [43](electron/electron#53510), [45](https://github.com/electron/electron/pull/53508)) - Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. [#53583](electron/electron#53583) (Also in [42](electron/electron#53585), [43](electron/electron#53584), [45](https://github.com/electron/electron/pull/53586)) - Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process `window.open()` child whose `contextIsolation` differed from its opener's. [#53539](electron/electron#53539) (Also in [42](electron/electron#53541), [43](electron/electron#53540), [45](https://github.com/electron/electron/pull/53538)) - Fixed a spurious `node_init` error being logged when creating a `ShadowRealm` with Node.js integration enabled. [#53579](electron/electron#53579) (Also in [45](https://github.com/electron/electron/pull/53578)) - Fixed crashes in `setDisplayMediaRequestHandler` when the granted frame had been destroyed or another tab was granted by id. [#53672](electron/electron#53672) (Also in [42](electron/electron#53674), [43](electron/electron#53671), [45](https://github.com/electron/electron/pull/53673)) - Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. [#53630](electron/electron#53630) (Also in [43](electron/electron#53631), [45](https://github.com/electron/electron/pull/53471)) - Fixed window state not being persisted when a window entered or left fullscreen, or was maximized or unmaximized, without also being moved or resized. [#53576](electron/electron#53576) (Also in [45](https://github.com/electron/electron/pull/53577)) - Internal `<webview>`, `window.close()` and `executeJavaScript` reply IPCs are validated against the sending frame. [#53723](electron/electron#53723) (Also in [42](electron/electron#53727), [43](electron/electron#53726), [45](https://github.com/electron/electron/pull/53724)) - `<webview>` without `allowpopups` also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. [#53721](electron/electron#53721) (Also in [42](electron/electron#53719), [43](electron/electron#53718), [45](https://github.com/electron/electron/pull/53717)) - `getUserMedia` with `chromeMediaSource: 'desktop'` no longer accepts WebContents source ids; use `chromeMediaSource: 'tab'` with `webContents.getMediaSourceId()` or `setDisplayMediaRequestHandler` to capture a WebContents. [#53709](electron/electron#53709) (Also in [42](electron/electron#53710), [43](electron/electron#53707), [45](https://github.com/electron/electron/pull/53708)) - `nodeIntegrationInWorker` now applies only to workers created by frames that themselves have Node integration; enable `nodeIntegrationInSubFrames` to keep Node in workers created by subframes. [#53711](electron/electron#53711) (Also in [42](electron/electron#53713), [43](electron/electron#53712), [45](https://github.com/electron/electron/pull/53706)) - `openExternal` permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. [#53699](electron/electron#53699) (Also in [42](electron/electron#53697), [43](electron/electron#53698), [45](https://github.com/electron/electron/pull/53696)) - `pointerLock` and `keyboardLock` permission requests now report the requesting frame, and `execCommand('paste')` requires user activation in the frame that calls it. [#53693](electron/electron#53693) (Also in [42](electron/electron#53702), [43](electron/electron#53701), [45](https://github.com/electron/electron/pull/53692)) #### Other Changes - Fixed the app becoming unresponsive when a page has a very large number of `app-region` draggable elements. [#53597](electron/electron#53597) (Also in [43](electron/electron#53632), [45](https://github.com/electron/electron/pull/53596)) - Updated Chromium to 152.0.7977.78. [#53523](electron/electron#53523) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Electron 44.0.0 gives chrome.webstorePrivate to pages on chromewebstore.google.com, but has no delegate for it. The first call from the store page stops the main process (SIGSEGV on macOS, EXCEPTION_ACCESS_VIOLATION on Windows). A saved store tab makes the crash occur at each start. Electron 44.4.0 removes the API (electron/electron#53776). 44.5.1 is the newest 44.x release that the minimum release age allows. Fixes #1637 Co-authored-by: Claude Opus 5.5 <[email protected]>

trop Bot requested a review from VerteDinde September 9, 2026 13:00

trop Bot mentioned this pull request Sep 9, 2026

fix: don't expose chrome.webstorePrivate to web pages #53752

Merged

6 tasks done

trop Bot added 44-x-y backport This is a backport PR semver/patch backwards-compatible bug fixes labels Sep 9, 2026

MarshallOfSound approved these changes Sep 9, 2026

View reviewed changes

MarshallOfSound enabled auto-merge (squash) September 9, 2026 13:02

test: use uuid.v4() for the webstore test partition

6ba3e0a

randomUUID from node:crypto is not imported in extensions-spec.ts on this branch; match the surrounding tests instead.

MarshallOfSound approved these changes Sep 9, 2026

View reviewed changes

MarshallOfSound disabled auto-merge September 9, 2026 21:44

MarshallOfSound assigned VerteDinde Sep 10, 2026

ckerr approved these changes Sep 10, 2026

View reviewed changes

meinharrd mentioned this pull request Sep 11, 2026

crash: chromewebstore.google.com detail page → SIGSEGV in browser process (Electron 44 exposes chrome.webstorePrivate without a delegate) solardev-xyz/freedom-browser#346

Closed

bnfy mentioned this pull request Sep 11, 2026

Prevent Chrome Web Store browser crashes bnfy/blanc#333

Merged

MarshallOfSound merged commit 39806be into 44-x-y Sep 12, 2026
119 of 121 checks passed

MarshallOfSound deleted the trop/44-x-y-bp-fix-don-t-expose-chrome-webstoreprivate-to-web-pages-1788958809169 branch September 12, 2026 20:42

electron-release-board Bot added this to 44-x-y Sep 12, 2026

meinharrd mentioned this pull request Sep 17, 2026

fix: bump Electron to 44.4.1 so a Chrome Web Store page no longer crashes the browser process (#346) solardev-xyz/freedom-browser#384

Merged

emah-maker mentioned this pull request Sep 28, 2026

Fix a crash when adding an extension from the Chrome Web Store emah-maker/lumen#10

Merged

Sniezka1927 mentioned this pull request Oct 9, 2026

Update Electron to 44.5.1 to stop the Chrome Web Store crash nightly-labs/openbot#1645

Merged

4 tasks done

Navigation Menu

Repository navigation

fix: don't expose chrome.webstorePrivate to web pages - #53776

fix: don't expose chrome.webstorePrivate to web pages#53776
MarshallOfSound merged 2 commits into
44-x-yfrom
trop/44-x-y-bp-fix-don-t-expose-chrome-webstoreprivate-to-web-pages-1788958809169

trop Bot commented Sep 9, 2026

Uh oh!

Uh oh!

release-clerk Bot commented Sep 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

trop Bot commented Sep 9, 2026

Uh oh!

Uh oh!

release-clerk Bot commented Sep 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants