fix: don't crash if guest destroyed in select-usb-device handler by trop[bot] · Pull Request #54007 · electron/electron

trop · 2026-09-16T18:10:37Z

Backport of #53940

See that PR for details.

Notes: Fixed a potential UAF when a select-usb-device handler destroys the requesting webContents.

Co-authored-by: David Sanders <[email protected]>

release-clerk · 2026-09-16T20:06:54Z

Release Notes Persisted

Fixed a potential UAF when a select-usb-device handler destroys the requesting webContents.

… 3.19.2 Both are patch-level bumps within the pinned major. No API changes, no source changes, no test changes. electron 43.4.0 (2026-08-11) -> 43.7.3 (2026-09-18) closes 38 days and eight patch releases of Chromium security backports on the 43 line. Among them is a use-after-free when a `select-usb-device` handler destroys the requesting webContents (electron/electron#54007), which is exactly the path src/main/device-select.ts registers. Electron 43 remains a supported line until 2027-01-05, so this is a same-major security catch-up, not the Electron 44 migration. Electron 44 is a separate decision: its breaking surface for this app is close to nil (no clipboard usage in src/, no 32-bit or armv7 targets), but it needs a call on dropping macOS 12 and a packaged-app run against a reporting store for the Chromium 150->152 jump under RxDB/OPFS. @novu/js 3.19.0 -> 3.19.2 is a routine patch bump; the package is pinned exact, so it needed an edit rather than floating. Checked, not assumed: the hardcoded Electron version strings in src/main/cloudflare-challenge.test.ts:184,188 and src/main/http-bridge.test.ts:58 are self-contained fixtures (a stubbed UA asserted against its own literal). Nothing reads the real Electron version, so the bump does not touch them. They are stale-looking but inert, and left alone rather than churned inside a security patch. Validation status: - Unverified locally. `pnpm install`, `pnpm lint`, `pnpm exec tsc` and `pnpm test` cannot run on this machine: rxdb-premium's postinstall downloads licensed code and needs RXDB_LICENSE_KEY, which is a CI secret and is not available locally. - CI is the gate. It runs lint, tsc, the full suite, and `pnpm run rebuild:all` against the new Electron headers. - Inferred, not observed: usb and @serialport/bindings-cpp both build with `prebuildify --napi`, so a 43.x patch bump does not change the Node ABI and should not require a native rebuild. That is read off their build config, not confirmed on a packaged binary. - Not evaluated: the packaged app.

##### [v44.4.5](https://github.com/electron/electron/releases/tag/v44.4.5) ### Release Notes for v44.4.5 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. [#54222](electron/electron#54222) ##### [v44.4.4](https://github.com/electron/electron/releases/tag/v44.4.4) ### Release Notes for v44.4.4 #### Fixes - Fixed a `Cannot read properties of undefined (reading 'startTime')` error thrown in pages while the DevTools Performance panel's live metrics were active. [#54162](electron/electron#54162) - Fixed a crash when calling `setIgnoreMenuShortcuts()` on DevTools. [#54116](electron/electron#54116) (Also in [43](electron/electron#54117), [45](https://github.com/electron/electron/pull/54115)) - Fixed a spurious "`sandboxed_renderer.bundle.js` script failed to run" console error when DevTools attached to a sandboxed frame before its first navigation. [#54155](electron/electron#54155) (Also in [42](electron/electron#54175), [43](https://github.com/electron/electron/pull/54176)) - Fixed alignment of the text label and popup menu in the macOS save dialog. [#54143](electron/electron#54143) (Also in [45](https://github.com/electron/electron/pull/54144)) - Fixed an "Invalid `guestInstanceId`" error when removing a loaded `<webview>` from the DOM. [#54099](electron/electron#54099) (Also in [42](electron/electron#54098), [43](electron/electron#54097), [45](https://github.com/electron/electron/pull/54096)) - Fixed GPU shaders compiled by Skia not being cached between launches. [#54161](electron/electron#54161) (Also in [45](https://github.com/electron/electron/pull/54156)) - Fixed `ready-to-show` never firing for some hidden windows on Windows and Linux. [#54118](electron/electron#54118) (Also in [43](electron/electron#54119), [45](https://github.com/electron/electron/pull/54110)) - Fixed the tray context menu not working for snap-confined apps because AppArmor blocked the `/org/chromium/DbusMenu` path. [#54103](electron/electron#54103) (Also in [45](https://github.com/electron/electron/pull/54102)) ##### [v44.4.3](https://github.com/electron/electron/releases/tag/v44.4.3) ### Release Notes for v44.4.3 #### Fixes - Fixed `net.fetch()` / `net.request()` spending seconds of main-process time buffering large streamed request bodies. [#54061](electron/electron#54061) (Also in [45](https://github.com/electron/electron/pull/54062)) #### Performance Improvements - Improved the performance of `fs` operations and `require()` on files inside asar archives. [#54051](electron/electron#54051) (Also in [45](https://github.com/electron/electron/pull/53951)) #### Other Changes - Backported fixes from upstream Chromium, PDFium, Skia and V8. [#54081](electron/electron#54081) ##### [v44.4.2](https://github.com/electron/electron/releases/tag/v44.4.2) ### Release Notes for v44.4.2 #### Fixes - Fixed a potential UAF when a `select-usb-device` handler destroys the requesting `webContents`. [#54009](electron/electron#54009) (Also in [43](electron/electron#54007), [45](https://github.com/electron/electron/pull/54008)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Skia and V8. [#53985](electron/electron#53985) - Updated Chromium to 152.0.7977.130. [#53778](electron/electron#53778) ##### [v44.4.1](https://github.com/electron/electron/releases/tag/v44.4.1) ### Release Notes for v44.4.1 #### Fixes - Fixed default protocol client APIs falsely returning `true` on Windows. [#53959](electron/electron#53959) (Also in [43](electron/electron#53960), [45](https://github.com/electron/electron/pull/53958)) - Fixed several object lifetime issues in `Debugger`, `Menu`, `Tray`, `Notification`, `globalShortcut`, `utilityProcess`, `ServiceWorkerMain`, `WebFrameMain`, `webFrame`, `sharedTexture`, `systemPreferences`, `netLog`, `MessagePortMain`, `net.request` and `shell.openPath()`. [#53968](electron/electron#53968) (Also in [45](https://github.com/electron/electron/pull/53805)) ##### [v44.4.0](https://github.com/electron/electron/releases/tag/v44.4.0) ### Release Notes for v44.4.0 #### Features - Added `initiatorOrigin` to webRequest and protocol handler requests, `DownloadItem.getInitiatorOrigin()`, and a trailing `frame` argument to the `will-download` and `preconnect` session events. [#53703](electron/electron#53703) (Also in [43](electron/electron#53704), [45](https://github.com/electron/electron/pull/53700)) #### Fixes - Added validation to `protocol.registerSchemesAsPrivileged()` to reject protocol names that do not conform to RFC 3986 URI scheme grammar. [#53743](electron/electron#53743) (Also in [45](https://github.com/electron/electron/pull/53742)) - Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported `chrome.webstorePrivate` API. [#53776](electron/electron#53776) (Also in [45](https://github.com/electron/electron/pull/53775)) - Fixed a main-process crash when an app called `loadURL()` again right after a load failed because the renderer process exited before the page committed. [#53943](electron/electron#53943) (Also in [43](electron/electron#53944), [45](https://github.com/electron/electron/pull/53942)) - Fixed a memory leak on Windows when `app.getPreferredSystemLanguages()` was called. [#53868](electron/electron#53868) (Also in [43](electron/electron#53867), [45](https://github.com/electron/electron/pull/53869)) - Fixed a potential UAF in `app.getPreferredSystemLanguages()` on Windows. [#53865](electron/electron#53865) (Also in [43](electron/electron#53866), [45](https://github.com/electron/electron/pull/53864)) - Fixed a renderer crash that could occur when printing from an iframe. [#53762](electron/electron#53762) (Also in [43](electron/electron#53761), [45](https://github.com/electron/electron/pull/53763)) - Fixed a renderer crash when an iframe was removed right after loading with `nodeIntegrationInSubFrames` enabled and `sandbox` disabled, e.g. on pages that embed Meta Pixel. [#53885](electron/electron#53885) (Also in [42](electron/electron#53886), [43](electron/electron#53884), [45](https://github.com/electron/electron/pull/53883)) - Fixed a Windows renderer crash when no default locale could be determined. [#53947](electron/electron#53947) - Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. [#53749](electron/electron#53749) (Also in [43](electron/electron#53750), [45](https://github.com/electron/electron/pull/53748)) - Fixed helper executables on macOS starting a second app instance when launched without a process type, for example through `child_process.fork()` with the `runAsNode` fuse disabled; `fork()` now throws in that configuration. [#53840](electron/electron#53840) (Also in [45](https://github.com/electron/electron/pull/53839)) - Fixed V8 code caching for https scripts loaded by `file://` and custom-scheme pages. [#53745](electron/electron#53745) (Also in [45](https://github.com/electron/electron/pull/53746)) - Fixed `webContents` emitting `unresponsive` right after the system wakes from sleep on Windows, and emitting `responsive` when a hung window was hidden rather than when it recovered. [#53764](electron/electron#53764) (Also in [45](https://github.com/electron/electron/pull/53760)) - Fixed `webContents.capturePage()` on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's `offscreen.deviceScaleFactor`. [#53816](electron/electron#53816) (Also in [43](electron/electron#53818), [45](https://github.com/electron/electron/pull/53817)) - Fixed Window Controls Overlay CSS environment variables and `navigator.windowControlsOverlay` not being populated for `WebContentsView`s in a `BaseWindow`. [#53812](electron/electron#53812) (Also in [45](https://github.com/electron/electron/pull/53811)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. [#53769](electron/electron#53769) - Updated Node.js to v24.21.0. [#53779](electron/electron#53779) ##### [v44.3.0](https://github.com/electron/electron/releases/tag/v44.3.0) ### Release Notes for v44.3.0 #### Features - Added the `ELECTRON_DEBUG_DRAGGABLE_REGIONS` environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. [#53627](electron/electron#53627) (Also in [43](electron/electron#53633), [45](https://github.com/electron/electron/pull/53626)) #### Fixes - File System Access permission requests and the `file-system-access-restricted` event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. [#53691](electron/electron#53691) (Also in [42](electron/electron#53695), [43](electron/electron#53694), [45](https://github.com/electron/electron/pull/53690)) - Fixed Ctrl+Y not yanking text killed with Ctrl+K in text fields on macOS. [#53714](electron/electron#53714) (Also in [45](https://github.com/electron/electron/pull/53715)) - Fixed `Tray` icons not appearing when running inside Flatpak or Snap sandboxes on Linux. [#53653](electron/electron#53653) (Also in [45](https://github.com/electron/electron/pull/53654)) - Fixed `app.getGPUInfo('complete')` stalling the GPU process for several seconds on some Windows systems. [#53644](electron/electron#53644) (Also in [45](https://github.com/electron/electron/pull/53645)) - Fixed `session.setPermissionCheckHandler` receiving the top-level origin and a null `webContents` for `hid` and `usb` checks made from a subframe. [#53688](electron/electron#53688) (Also in [42](electron/electron#53736), [43](electron/electron#53689), [45](https://github.com/electron/electron/pull/53679)) - Fixed `webContents.on()`, `removeListener()` and `removeAllListeners()` throwing "Object has been destroyed" for `console-message` listeners after the WebContents was destroyed. [#53494](electron/electron#53494) (Also in [42](electron/electron#53497), [43](electron/electron#53496), [45](https://github.com/electron/electron/pull/53495)) - Fixed a crash on Linux when `process.env` was written while another thread was reading the environment, and a memory leak when a worker thread exits. [#53509](electron/electron#53509) (Also in [42](electron/electron#53511), [43](electron/electron#53510), [45](https://github.com/electron/electron/pull/53508)) - Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. [#53583](electron/electron#53583) (Also in [42](electron/electron#53585), [43](electron/electron#53584), [45](https://github.com/electron/electron/pull/53586)) - Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process `window.open()` child whose `contextIsolation` differed from its opener's. [#53539](electron/electron#53539) (Also in [42](electron/electron#53541), [43](electron/electron#53540), [45](https://github.com/electron/electron/pull/53538)) - Fixed a spurious `node_init` error being logged when creating a `ShadowRealm` with Node.js integration enabled. [#53579](electron/electron#53579) (Also in [45](https://github.com/electron/electron/pull/53578)) - Fixed crashes in `setDisplayMediaRequestHandler` when the granted frame had been destroyed or another tab was granted by id. [#53672](electron/electron#53672) (Also in [42](electron/electron#53674), [43](electron/electron#53671), [45](https://github.com/electron/electron/pull/53673)) - Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. [#53630](electron/electron#53630) (Also in [43](electron/electron#53631), [45](https://github.com/electron/electron/pull/53471)) - Fixed window state not being persisted when a window entered or left fullscreen, or was maximized or unmaximized, without also being moved or resized. [#53576](electron/electron#53576) (Also in [45](https://github.com/electron/electron/pull/53577)) - Internal `<webview>`, `window.close()` and `executeJavaScript` reply IPCs are validated against the sending frame. [#53723](electron/electron#53723) (Also in [42](electron/electron#53727), [43](electron/electron#53726), [45](https://github.com/electron/electron/pull/53724)) - `<webview>` without `allowpopups` also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. [#53721](electron/electron#53721) (Also in [42](electron/electron#53719), [43](electron/electron#53718), [45](https://github.com/electron/electron/pull/53717)) - `getUserMedia` with `chromeMediaSource: 'desktop'` no longer accepts WebContents source ids; use `chromeMediaSource: 'tab'` with `webContents.getMediaSourceId()` or `setDisplayMediaRequestHandler` to capture a WebContents. [#53709](electron/electron#53709) (Also in [42](electron/electron#53710), [43](electron/electron#53707), [45](https://github.com/electron/electron/pull/53708)) - `nodeIntegrationInWorker` now applies only to workers created by frames that themselves have Node integration; enable `nodeIntegrationInSubFrames` to keep Node in workers created by subframes. [#53711](electron/electron#53711) (Also in [42](electron/electron#53713), [43](electron/electron#53712), [45](https://github.com/electron/electron/pull/53706)) - `openExternal` permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. [#53699](electron/electron#53699) (Also in [42](electron/electron#53697), [43](electron/electron#53698), [45](https://github.com/electron/electron/pull/53696)) - `pointerLock` and `keyboardLock` permission requests now report the requesting frame, and `execCommand('paste')` requires user activation in the frame that calls it. [#53693](electron/electron#53693) (Also in [42](electron/electron#53702), [43](electron/electron#53701), [45](https://github.com/electron/electron/pull/53692)) #### Other Changes - Fixed the app becoming unresponsive when a page has a very large number of `app-region` draggable elements. [#53597](electron/electron#53597) (Also in [43](electron/electron#53632), [45](https://github.com/electron/electron/pull/53596)) - Updated Chromium to 152.0.7977.78. [#53523](electron/electron#53523)

##### [v44.4.5](https://github.com/electron/electron/releases/tag/v44.4.5) ### Release Notes for v44.4.5 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. [#54222](electron/electron#54222) ##### [v44.4.4](https://github.com/electron/electron/releases/tag/v44.4.4) ### Release Notes for v44.4.4 #### Fixes - Fixed a `Cannot read properties of undefined (reading 'startTime')` error thrown in pages while the DevTools Performance panel's live metrics were active. [#54162](electron/electron#54162) - Fixed a crash when calling `setIgnoreMenuShortcuts()` on DevTools. [#54116](electron/electron#54116) (Also in [43](electron/electron#54117), [45](https://github.com/electron/electron/pull/54115)) - Fixed a spurious "`sandboxed_renderer.bundle.js` script failed to run" console error when DevTools attached to a sandboxed frame before its first navigation. [#54155](electron/electron#54155) (Also in [42](electron/electron#54175), [43](https://github.com/electron/electron/pull/54176)) - Fixed alignment of the text label and popup menu in the macOS save dialog. [#54143](electron/electron#54143) (Also in [45](https://github.com/electron/electron/pull/54144)) - Fixed an "Invalid `guestInstanceId`" error when removing a loaded `<webview>` from the DOM. [#54099](electron/electron#54099) (Also in [42](electron/electron#54098), [43](electron/electron#54097), [45](https://github.com/electron/electron/pull/54096)) - Fixed GPU shaders compiled by Skia not being cached between launches. [#54161](electron/electron#54161) (Also in [45](https://github.com/electron/electron/pull/54156)) - Fixed `ready-to-show` never firing for some hidden windows on Windows and Linux. [#54118](electron/electron#54118) (Also in [43](electron/electron#54119), [45](https://github.com/electron/electron/pull/54110)) - Fixed the tray context menu not working for snap-confined apps because AppArmor blocked the `/org/chromium/DbusMenu` path. [#54103](electron/electron#54103) (Also in [45](https://github.com/electron/electron/pull/54102)) ##### [v44.4.3](https://github.com/electron/electron/releases/tag/v44.4.3) ### Release Notes for v44.4.3 #### Fixes - Fixed `net.fetch()` / `net.request()` spending seconds of main-process time buffering large streamed request bodies. [#54061](electron/electron#54061) (Also in [45](https://github.com/electron/electron/pull/54062)) #### Performance Improvements - Improved the performance of `fs` operations and `require()` on files inside asar archives. [#54051](electron/electron#54051) (Also in [45](https://github.com/electron/electron/pull/53951)) #### Other Changes - Backported fixes from upstream Chromium, PDFium, Skia and V8. [#54081](electron/electron#54081) ##### [v44.4.2](https://github.com/electron/electron/releases/tag/v44.4.2) ### Release Notes for v44.4.2 #### Fixes - Fixed a potential UAF when a `select-usb-device` handler destroys the requesting `webContents`. [#54009](electron/electron#54009) (Also in [43](electron/electron#54007), [45](https://github.com/electron/electron/pull/54008)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Skia and V8. [#53985](electron/electron#53985) - Updated Chromium to 152.0.7977.130. [#53778](electron/electron#53778) ##### [v44.4.1](https://github.com/electron/electron/releases/tag/v44.4.1) ### Release Notes for v44.4.1 #### Fixes - Fixed default protocol client APIs falsely returning `true` on Windows. [#53959](electron/electron#53959) (Also in [43](electron/electron#53960), [45](https://github.com/electron/electron/pull/53958)) - Fixed several object lifetime issues in `Debugger`, `Menu`, `Tray`, `Notification`, `globalShortcut`, `utilityProcess`, `ServiceWorkerMain`, `WebFrameMain`, `webFrame`, `sharedTexture`, `systemPreferences`, `netLog`, `MessagePortMain`, `net.request` and `shell.openPath()`. [#53968](electron/electron#53968) (Also in [45](https://github.com/electron/electron/pull/53805)) ##### [v44.4.0](https://github.com/electron/electron/releases/tag/v44.4.0) ### Release Notes for v44.4.0 #### Features - Added `initiatorOrigin` to webRequest and protocol handler requests, `DownloadItem.getInitiatorOrigin()`, and a trailing `frame` argument to the `will-download` and `preconnect` session events. [#53703](electron/electron#53703) (Also in [43](electron/electron#53704), [45](https://github.com/electron/electron/pull/53700)) #### Fixes - Added validation to `protocol.registerSchemesAsPrivileged()` to reject protocol names that do not conform to RFC 3986 URI scheme grammar. [#53743](electron/electron#53743) (Also in [45](https://github.com/electron/electron/pull/53742)) - Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported `chrome.webstorePrivate` API. [#53776](electron/electron#53776) (Also in [45](https://github.com/electron/electron/pull/53775)) - Fixed a main-process crash when an app called `loadURL()` again right after a load failed because the renderer process exited before the page committed. [#53943](electron/electron#53943) (Also in [43](electron/electron#53944), [45](https://github.com/electron/electron/pull/53942)) - Fixed a memory leak on Windows when `app.getPreferredSystemLanguages()` was called. [#53868](electron/electron#53868) (Also in [43](electron/electron#53867), [45](https://github.com/electron/electron/pull/53869)) - Fixed a potential UAF in `app.getPreferredSystemLanguages()` on Windows. [#53865](electron/electron#53865) (Also in [43](electron/electron#53866), [45](https://github.com/electron/electron/pull/53864)) - Fixed a renderer crash that could occur when printing from an iframe. [#53762](electron/electron#53762) (Also in [43](electron/electron#53761), [45](https://github.com/electron/electron/pull/53763)) - Fixed a renderer crash when an iframe was removed right after loading with `nodeIntegrationInSubFrames` enabled and `sandbox` disabled, e.g. on pages that embed Meta Pixel. [#53885](electron/electron#53885) (Also in [42](electron/electron#53886), [43](electron/electron#53884), [45](https://github.com/electron/electron/pull/53883)) - Fixed a Windows renderer crash when no default locale could be determined. [#53947](electron/electron#53947) - Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. [#53749](electron/electron#53749) (Also in [43](electron/electron#53750), [45](https://github.com/electron/electron/pull/53748)) - Fixed helper executables on macOS starting a second app instance when launched without a process type, for example through `child_process.fork()` with the `runAsNode` fuse disabled; `fork()` now throws in that configuration. [#53840](electron/electron#53840) (Also in [45](https://github.com/electron/electron/pull/53839)) - Fixed V8 code caching for https scripts loaded by `file://` and custom-scheme pages. [#53745](electron/electron#53745) (Also in [45](https://github.com/electron/electron/pull/53746)) - Fixed `webContents` emitting `unresponsive` right after the system wakes from sleep on Windows, and emitting `responsive` when a hung window was hidden rather than when it recovered. [#53764](electron/electron#53764) (Also in [45](https://github.com/electron/electron/pull/53760)) - Fixed `webContents.capturePage()` on offscreen windows returning an image resampled to the display's scale factor instead of rendered at the window's `offscreen.deviceScaleFactor`. [#53816](electron/electron#53816) (Also in [43](electron/electron#53818), [45](https://github.com/electron/electron/pull/53817)) - Fixed Window Controls Overlay CSS environment variables and `navigator.windowControlsOverlay` not being populated for `WebContentsView`s in a `BaseWindow`. [#53812](electron/electron#53812) (Also in [45](https://github.com/electron/electron/pull/53811)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. [#53769](electron/electron#53769) - Updated Node.js to v24.21.0. [#53779](electron/electron#53779) ##### [v44.3.0](https://github.com/electron/electron/releases/tag/v44.3.0) ### Release Notes for v44.3.0 #### Features - Added the `ELECTRON_DEBUG_DRAGGABLE_REGIONS` environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. [#53627](electron/electron#53627) (Also in [43](electron/electron#53633), [45](https://github.com/electron/electron/pull/53626)) #### Fixes - File System Access permission requests and the `file-system-access-restricted` event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. [#53691](electron/electron#53691) (Also in [42](electron/electron#53695), [43](electron/electron#53694), [45](https://github.com/electron/electron/pull/53690)) - Fixed Ctrl+Y not yanking text killed with Ctrl+K in text fields on macOS. [#53714](electron/electron#53714) (Also in [45](https://github.com/electron/electron/pull/53715)) - Fixed `Tray` icons not appearing when running inside Flatpak or Snap sandboxes on Linux. [#53653](electron/electron#53653) (Also in [45](https://github.com/electron/electron/pull/53654)) - Fixed `app.getGPUInfo('complete')` stalling the GPU process for several seconds on some Windows systems. [#53644](electron/electron#53644) (Also in [45](https://github.com/electron/electron/pull/53645)) - Fixed `session.setPermissionCheckHandler` receiving the top-level origin and a null `webContents` for `hid` and `usb` checks made from a subframe. [#53688](electron/electron#53688) (Also in [42](electron/electron#53736), [43](electron/electron#53689), [45](https://github.com/electron/electron/pull/53679)) - Fixed `webContents.on()`, `removeListener()` and `removeAllListeners()` throwing "Object has been destroyed" for `console-message` listeners after the WebContents was destroyed. [#53494](electron/electron#53494) (Also in [42](electron/electron#53497), [43](electron/electron#53496), [45](https://github.com/electron/electron/pull/53495)) - Fixed a crash on Linux when `process.env` was written while another thread was reading the environment, and a memory leak when a worker thread exits. [#53509](electron/electron#53509) (Also in [42](electron/electron#53511), [43](electron/electron#53510), [45](https://github.com/electron/electron/pull/53508)) - Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. [#53583](electron/electron#53583) (Also in [42](electron/electron#53585), [43](electron/electron#53584), [45](https://github.com/electron/electron/pull/53586)) - Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process `window.open()` child whose `contextIsolation` differed from its opener's. [#53539](electron/electron#53539) (Also in [42](electron/electron#53541), [43](electron/electron#53540), [45](https://github.com/electron/electron/pull/53538)) - Fixed a spurious `node_init` error being logged when creating a `ShadowRealm` with Node.js integration enabled. [#53579](electron/electron#53579) (Also in [45](https://github.com/electron/electron/pull/53578)) - Fixed crashes in `setDisplayMediaRequestHandler` when the granted frame had been destroyed or another tab was granted by id. [#53672](electron/electron#53672) (Also in [42](electron/electron#53674), [43](electron/electron#53671), [45](https://github.com/electron/electron/pull/53673)) - Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. [#53630](electron/electron#53630) (Also in [43](electron/electron#53631), [45](https://github.com/electron/electron/pull/53471)) - Fixed window state not being persisted when a window entered or left fullscreen, or was maximized or unmaximized, without also being moved or resized. [#53576](electron/electron#53576) (Also in [45](https://github.com/electron/electron/pull/53577)) - Internal `<webview>`, `window.close()` and `executeJavaScript` reply IPCs are validated against the sending frame. [#53723](electron/electron#53723) (Also in [42](electron/electron#53727), [43](electron/electron#53726), [45](https://github.com/electron/electron/pull/53724)) - `<webview>` without `allowpopups` also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. [#53721](electron/electron#53721) (Also in [42](electron/electron#53719), [43](electron/electron#53718), [45](https://github.com/electron/electron/pull/53717)) - `getUserMedia` with `chromeMediaSource: 'desktop'` no longer accepts WebContents source ids; use `chromeMediaSource: 'tab'` with `webContents.getMediaSourceId()` or `setDisplayMediaRequestHandler` to capture a WebContents. [#53709](electron/electron#53709) (Also in [42](electron/electron#53710), [43](electron/electron#53707), [45](https://github.com/electron/electron/pull/53708)) - `nodeIntegrationInWorker` now applies only to workers created by frames that themselves have Node integration; enable `nodeIntegrationInSubFrames` to keep Node in workers created by subframes. [#53711](electron/electron#53711) (Also in [42](electron/electron#53713), [43](electron/electron#53712), [45](https://github.com/electron/electron/pull/53706)) - `openExternal` permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. [#53699](electron/electron#53699) (Also in [42](electron/electron#53697), [43](electron/electron#53698), [45](https://github.com/electron/electron/pull/53696)) - `pointerLock` and `keyboardLock` permission requests now report the requesting frame, and `execCommand('paste')` requires user activation in the frame that calls it. [#53693](electron/electron#53693) (Also in [42](electron/electron#53702), [43](electron/electron#53701), [45](https://github.com/electron/electron/pull/53692)) #### Other Changes - Fixed the app becoming unresponsive when a page has a very large number of `app-region` draggable elements. [#53597](electron/electron#53597) (Also in [43](electron/electron#53632), [45](https://github.com/electron/electron/pull/53596)) - Updated Chromium to 152.0.7977.78. [#53523](electron/electron#53523) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

trop Bot and others added 2 commits September 16, 2026 18:10

test: add test for guest destruction in select-usb-device handler

a8fc7c8

Co-authored-by: David Sanders <[email protected]>

fix: don't crash if guest destroyed in select-usb-device handler

e50164c

Co-authored-by: David Sanders <[email protected]>

trop Bot requested a review from dsanders11 September 16, 2026 18:10

trop Bot mentioned this pull request Sep 16, 2026

fix: don't crash if guest destroyed in select-usb-device handler #53940

Merged

4 tasks done

trop Bot added 43-x-y backport This is a backport PR semver/none labels Sep 16, 2026

dsanders11 approved these changes Sep 16, 2026

View reviewed changes

dsanders11 merged commit 07518b4 into 43-x-y Sep 16, 2026
96 checks passed

dsanders11 deleted the trop/43-x-y-bp-fix-don-t-crash-if-guest-destroyed-in-select-usb-device-handler-1789582220645 branch September 16, 2026 20:06

kilbot mentioned this pull request Sep 21, 2026

chore(deps): electron 43.4.0 -> 43.7.3 (security backports), @novu/js 3.19.2 wcpos/electron#468

Merged

Navigation Menu

Repository navigation

fix: don't crash if guest destroyed in select-usb-device handler - #54007

fix: don't crash if guest destroyed in select-usb-device handler#54007
dsanders11 merged 2 commits into
43-x-yfrom
trop/43-x-y-bp-fix-don-t-crash-if-guest-destroyed-in-select-usb-device-handler-1789582220645

trop Bot commented Sep 16, 2026

Uh oh!

Uh oh!

release-clerk Bot commented Sep 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

trop Bot commented Sep 16, 2026

Uh oh!

Uh oh!

release-clerk Bot commented Sep 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant