chore: cherry-pick 69 changes from angle, chromium, pdfium, skia and v8 by electron-security-backports[bot] · Pull Request #55149 · electron/electron

electron-security-backports · 2026-10-20T23:04:10Z

Description of Change

Warning

Changes outside patches/ — besides the cherry-picks below, this PR edits Electron source directly. These edits were written by the backport automation as ports of upstream fixes (they are not upstream cherry-picks), so review them line by line:

shell/browser/file_system_access/file_system_access_permission_context.cc (modified) — fix: port upstream file system access fix for third-party frame permission requests to Electron's permission context

Backports the following changes:

0b43596f5117 from angle — D3D11: Expand 3D texture depth in MakeValidSize
1efffc95e07e from angle — Vulkan: Fix content-defined tracking for 3D images
2c5e2a5229a7 from angle — Vulkan: Allow staged clears of 3D image slices
386bb0e11d39 from angle — MSL: Correctly identify uint >= 0 condition as an infinite loop
3adcc064145b from angle — HLSL: Fix name collision due to lack of delimiter
3b30b49c041f from angle — Vulkan: Pass vk::LevelIndex to ImageHelper::onWrite
48a16bd63d2d from angle — D3D11: Fix InputLayoutCache key for disabled and multiview attributes
5448925bdda3 from angle — Vulkan: Use Rectangle instead of Box for ClearPartial
5cbd3b1344b5 from angle — GL/D3D11: Clamp multiview-adjusted attribute divisor
67691470653a from angle — D3D11: Fix uniform and structured buffer partial update and zeroing
71141e1e11e3 from angle — Vulkan: Track image "subresources written" by vk::LevelIndex
8988bdf12f3b from angle — D3D11: Fix stale vertex and index buffer pointers
906ad3fd3071 from angle — D3D11: Fix UNPACK_ROW_LENGTH handling in fast PBO unpack
97941c8fa290 from angle — Vulkan: Don't ghost images if base level has changed
b5bab166e6a7 from angle — D3D11: Sync image from storage before CPU CopyTexSubImage
bea9f5ec4d25 from angle — Translator: Fix off-by-one error in variable-size check
d219c4f45f93 from angle — Always robust init all levels of immutable textures
dfeede58b618 from angle — Translator: Fold constant switch statements
e1d22eff1e8f from angle — D3D11: Do not sync incomplete texture images from storage
01430d2a3d7c from chromium — [FSA] Block handle use in third-party contexts
14df19403b03 from chromium — Defer XMLDocumentParser::Finish() while inside ParseChunk
15248c94bc3d from chromium — [a11y] Copy title attribute value in AXNodeObject
01c4bf3467db from chromium — [M156] Fix CHECK_EQ in CachedMetadataSender::Create for unbound writer
28e2d315f844 from chromium — [HiC] Invalidate filters when an element moves into canvas
2ec1ba2211a0 from chromium — [HiC] Invalidate iframe contents correctly on top layer removal
2ed13d0826b0 from chromium — [Net][CPRS] Improve lifetime management in CPRRequest
2f0c9930c59b from chromium — c-v: Harden display locking + VT interactions
3ab9f85874d9 from chromium — Remove redundant IsHidden() check in FrameCaret::PaintCaret()
46d63b00ac54 from chromium — Fix SoftwareImageDecodeCache UAF
519cf27a368e from chromium — Harden ElementSMILAnimations::Apply() against removals during iteration
928928c148a5 from chromium — [M156] Preserve CacheStorageSideDataWriter across response clones
6cd7214ad1aa from chromium — [M152] [ServiceWorker] Defer clone completion callback in SimpleBufferManager
15cfaf3d3261 from chromium — [M152] [canvas2d] Obtain PaintCanvas and state after style resolution in DrawTextInternal
6bc3005112c9 from chromium — [net] Validate server certificate before generating auth token
73c78a52d2b7 from chromium — [HiC] Disallow SVG masks on SVG content in readback-allowed mode
73dd2febfaa5 from chromium — Do not expose pseudo-elements through LargestContentfulPaint API
7f1931770c35 from chromium — Sync separate GL texture content on write access in ExternalVkImageBacking
80a340bf4db5 from chromium — Avoid flat tree traversal when unlocking a display lock
83ce9f18d704 from chromium — [a11y] Mark image dirty directly when removing image map
8b38650ae0b4 from chromium — bluetooth: Fix UAF in BluetoothPairingBlueZ on synchronous cancel
0e25d492d813 from chromium — [M150-LTS] Don't rebuild date-time edit fields when layout parameters are unchanged.
86cca8f0478c from chromium — [M152] gpu: Restore GL context/surface after WrappedSkImageBacking MakeCurrent
97aa60e7d182 from chromium — [Views] Prevent potential UAF in NativeWidgetAura::Show()
6c38d4ec50ea from chromium — [M150-LTS] Do not optimize RTC encoded stream transfer if context is destroyed
b35403786d67 from chromium — [a11y] Validate renderer-provided AXNodeIDs at browser entry points
b7664cfc49cc from chromium — gpu: Reject separate GL texture mode for WebGPU/Vulkan GL interop
c0e830bdda6e from chromium — Prevent cross-frame selection on GestureLongPress
cbbfea7e38d4 from chromium — [ServiceWorker] Defer completion callback in DataPipeConnector::Finish
cc183492c23b from chromium — media: Safely drain promises in CdmPromiseAdapter::Clear
2d04a51fffd0 from chromium — [M152] [FSA] Validate paths in DeserializeHandle
e193ceb7de13 from chromium — Prevent attaching WebRtcAudioRenderer to terminated audio device
e2c5a77f477b from chromium — [FSA] Refactor read permission checks into 'CheckReadAccess()'
8841f4cd2383 from chromium — [M152] Plumb CacheStorageSideDataWriter capability remote for code cache
f8e59690fb80 from chromium — [HiC] Fix IsInCanvasSubtree for pseudo element on shadow host
fa4d1be86a1c from chromium — Don't use a deleted source RenderFrameHost in WebContentsImpl::OpenURL
ac3cf1684db0 from pdfium — CHECK on FFE teardown if embedder is inside a callback.
e764cc088a62 from pdfium — Guard against re-entrant destruction of the CJS_Runtime
02b14267cb02 from skia — [ganesh] Imagination FBO workaround v2
16ff4874adfe from v8 — [maglev] Do not cache the_hole in loaded_context_constants_
243b68bea40f from v8 — [ic] Check access check and array prototype chain in element handlers
2945e2e2966a from v8 — [turbolev] Fix expression invalidation at loop headers
37a6d6f0213e from v8 — [maglev] Mark sloppy eval context extension slot as mutable
49b69c460a6f from v8 — [maglev range analysis] Fix phi ranges in resumable loops
17f229f3ea06 from v8 — [M154][parser] Restore parse restriction when reparsing Function constructor top-level
9f911f052703 from v8 — [scopes] Mark saved class variable as MaybeAssigned
af7d1483a5da from v8 — [interpreter] Initialize private accessors early in BuildClassLiteral
bd5b925e0678 from v8 — [turbolev] Migrations can change maps
c0543d0cbd16 from v8 — [ast] Normalize one-byte content in AstValueFactory and StringTable
e1ac1f641ab1 from v8 — [M154][compiler][objects] Record CompilationKind and outer_language_mode in ScriptFlags

Checklist

I have filled out the PR description
I have reviewed and verified the changes

Release Notes

Notes: Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8.

The windows-x64 build failed to link: lld-link: error: undefined symbol: public: bool __cdecl rx::vk::ImageHelper::SubresourceUpdate::matchesLayerRange(...) const >>> referenced by vk_helpers.cpp:8540 (ImageHelper::removeSingleStagedClearAfterInvalidate) The 44-x-y adaptation of cherry-pick-1efffc95e07e moves matchesLayerRange/intersectsLayerRange/getDestSubresource from SubresourceUpdate onto ImageHelper and deletes the old definitions, but left the old declarations and one caller in removeSingleStagedClearAfterInvalidate. That function was removed upstream before this CL, so the upstream fix had nothing to convert. On this revision it is never called, so the Linux link (section GC) did not trip over it, but lld-link on Windows does. Switch that caller to the ImageHelper helper (as done for removeSingleSubresourceStagedUpdates in the same patch) and drop the stale SubresourceUpdate declarations so any leftover use fails to compile on every platform. The four later Vulkan patches that touch vk_helpers.h are regenerated only for index lines and hunk offsets. Verified the full patches/angle series applies with `git am --3way` and plain `git am` on ANGLE 4f2e7d39252e (DEPS for 152.0.7977.167). Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01S9dadvYp98UrTf4Cy1D5Jc

release-clerk · 2026-10-21T01:38:20Z

Release Notes Persisted

Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8.

…#158) Updates the desktop app's Electron from 44.9.0 to 44.9.3, the latest 44.x patch. - 44.9.1 mitigates the compromised eMudhra intermediate certificates ([GHSA-jr5w-w6x2-84p9](GHSA-jr5w-w6x2-84p9)). Exploiting it needs an attacker-held certificate plus network interception. - 44.9.3 adds backported ANGLE, Chromium, PDFium, Skia and V8 fixes (electron/electron#55149). 44.9.2 has no notable changes. - `bun.lock` changes only Electron's two entries. The registry integrity matches npm's for `[email protected]`. The app picks this up through its usual GitHub Releases feed in the next release. Nothing about the updater, signing or the iPhone pairing flow changes. ## Verified - `bun run lint`, `bun run typecheck`, `bunx tsc -p apps/desktop/tsconfig.json --noEmit` and `bun test` pass locally. CI passes too, including the Linux package and smoke check. - On a dedicated Apple silicon Mac (macOS 27, Xcode 26.6), from this branch: - `bun run package:dir`: the bundled Electron Framework is `44.9.3`, and `process.versions.electron` in the packaged app reports `44.9.3`. - `PONZU_SMOKE=1 …/Ponzu.app/Contents/MacOS/Ponzu` exits 0 after the studio paints. - **iPhone pairing:** the packaged app, launched in full with an isolated home and profile, opens Ponzu › Pair iPhone… from its real app menu. The studio shows the pairing code `ponzu://pair?host=<this Mac's MagicDNS name>&v=1`, and `/api/info` reports `protocol: 1` and the Mac's tailnet name. The shipped 1.39.0 (Electron 44.9.0) gives the same result on the same host. The run's wake LaunchAgent was unloaded afterwards. - **Update feed:** an unsigned `zip` build (the target electron-updater downloads) embeds Electron `44.9.3`. Its `app-update.yml` points at this repo's GitHub releases, and `latest-mac.yml` names the zip with its sha512. The shipped 1.39.0, launched there, found and began downloading the newest published release through the same feed. That's the path this build takes in the next release. - Not run here: signing and notarization. They need the release-signing environment and run in `release.yml` when the release is published, where the signed bundle is codesign-, Gatekeeper- and staple-checked and smoke-tested before going public. ## Release note - Ponzu no longer trusts the compromised eMudhra certificates. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <[email protected]>

- 44.9.3 backports upstream ANGLE, Chromium, PDFium, Skia and V8 fixes, among them a use-after-free in SoftwareImageDecodeCache and hardening of Blink and the file system access permissions, which 44.9.1 lacks - Pinned before the seven-day release-age quarantine by maintainer decision, because the release carries security fixes https://github.com/electron/electron/releases/tag/v44.9.3 electron/electron#55149

##### [v44.9.3](https://github.com/electron/electron/releases/tag/v44.9.3) ### Release Notes for v44.9.3 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8. [#55149](electron/electron#55149) ##### [v44.9.2](https://github.com/electron/electron/releases/tag/v44.9.2) ### Release Notes for v44.9.2 ##### [v44.9.1](https://github.com/electron/electron/releases/tag/v44.9.1) ### Release Notes for v44.9.1 > \[!NOTE] > This release contains the fix for <GHSA-jr5w-w6x2-84p9>, the mitigation for compromised eMudhra intermediate certificates ##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0) ### Release Notes for v44.9.0 #### Features - Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) (Also in [45](https://github.com/electron/electron/pull/55072)) #### Fixes - Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) (Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051)) - Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) (Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045)) ##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0) ### Release Notes for v44.8.0 #### Features - Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) (Also in [45](https://github.com/electron/electron/pull/54889)) #### Fixes - Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987) - Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) (Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910)) - Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) (Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956)) - Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) (Also in [45](https://github.com/electron/electron/pull/55008)) #### Other Changes - Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034) - Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928) - Updated Node.js to v24.22.0. [#55004](electron/electron#55004) ##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2) ### Release Notes for v44.7.2 #### Fixes - Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) (Also in [45](https://github.com/electron/electron/pull/54818)) - Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) (Also in [45](https://github.com/electron/electron/pull/54843)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898) #### Documentation - Documentation changes: [#54880](electron/electron#54880) ##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1) ### Release Notes for v44.7.1 #### Fixes - Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) (Also in [45](https://github.com/electron/electron/pull/54781)) - Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) (Also in [45](https://github.com/electron/electron/pull/54846)) - Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798) - Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) (Also in [45](https://github.com/electron/electron/pull/54848)) - Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) (Also in [45](https://github.com/electron/electron/pull/54864)) #### Other Changes - Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) (Also in [45](https://github.com/electron/electron/pull/54803)) - Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085) ##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0) ### Release Notes for v44.7.0 #### Features - The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204) #### Fixes - Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666) - Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657) ##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0) ### Release Notes for v44.6.0 #### Features - Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) (Also in [45](https://github.com/electron/electron/pull/54521)) #### Fixes - Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596) - Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) (Also in [45](https://github.com/electron/electron/pull/54615)) - Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) (Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585)) - Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623) #### Documentation - Documentation changes: [#54589](electron/electron#54589)

##### [v44.10.1](https://github.com/electron/electron/releases/tag/v44.10.1) ### Release Notes for v44.10.1 #### Fixes - Fixed DevTools "Save" prompting for a location every time instead of reusing the previously chosen file. [#55484](electron/electron#55484) - Fixed DevTools "Save As" using the old file and Linux cancels treated as saved. - Fixed `webContents.adjustSelection()` ignoring the `end` option. [#55461](electron/electron#55461) (Also in [45](electron/electron#55462), [46](https://github.com/electron/electron/pull/55463)) #### Performance Improvements - Improved performance of `net.fetch()` requests without a body. [#55445](electron/electron#55445) (Also in [43](electron/electron#55447), [45](electron/electron#55446), [46](https://github.com/electron/electron/pull/55444)) - Improved performance of repeated `net.fetch()` calls for `file:` URLs. [#55458](electron/electron#55458) (Also in [45](electron/electron#55459), [46](https://github.com/electron/electron/pull/55457)) #### Other Changes - Backported fixes from upstream Chromium, Dawn, Skia and V8. [#55492](electron/electron#55492) ##### [v44.10.0](https://github.com/electron/electron/releases/tag/v44.10.0) ### Release Notes for v44.10.0 #### Features - Added filtering options to `session.registerPreloadScript` - `matches`, `excludeMatches`, `includeGlobs`, `excludeGlobs`, `matchOriginAsFallback`. [#55182](electron/electron#55182) (Also in [45](https://github.com/electron/electron/pull/55181)) #### Fixes - Fixed a crash on Linux when a D-Bus method call was made on a disconnected bus. [#55290](electron/electron#55290) (Also in [45](electron/electron#55292), [46](https://github.com/electron/electron/pull/55289)) - Fixed a main process crash when `onSendHeaders` observed Blob uploads. [#55168](electron/electron#55168) (Also in [45](https://github.com/electron/electron/pull/55169)) - Fixed `app.getLoginItemSettings()` not finding login items on Windows when the executable path contains spaces. [#55207](electron/electron#55207) (Also in [45](https://github.com/electron/electron/pull/54419)) - Fixed Europe/London and Europe/Dublin time zone names showing as "GMT+00:00" in winter by updating ICU to tzdata 2026e. [#55335](electron/electron#55335) - Fixed File System Access blocklist gaps for `.git/hooks` writes and hypervisor UNC shares. [#55330](electron/electron#55330) - Fixed handling of malformed asar archives whose size fields do not match the file length. [#55176](electron/electron#55176) (Also in [43](electron/electron#55179), [45](https://github.com/electron/electron/pull/55175)) - Fixed inconsistent handling of asar archive paths between the main process and child processes. [#55183](electron/electron#55183) (Also in [43](electron/electron#55185), [45](https://github.com/electron/electron/pull/55184)) - Fixed `Menu.popup()` on macOS sometimes not showing a menu after another closed. [#55325](electron/electron#55325) (Also in [45](electron/electron#55326), [46](https://github.com/electron/electron/pull/55324)) - Fixed MV3 extension events not arriving to background service workers. [#55152](electron/electron#55152) (Also in [43](electron/electron#55153), [45](https://github.com/electron/electron/pull/55154)) - Fixed paste hanging indefinitely on Linux X11 until the app was restarted. [#55327](electron/electron#55327) - Fixed `protocol.registerSource` schemes not applying the same fetch rules as `protocol.handle` schemes. [#55177](electron/electron#55177) (Also in [45](https://github.com/electron/electron/pull/55178)) - Fixed `utilityProcess` not emitting an `exit` event when the app quit while the process was still launching. [#55273](electron/electron#55273) (Also in [43](electron/electron#55272), [45](electron/electron#55274), [46](https://github.com/electron/electron/pull/55264)) #### Other Changes - Updated Chromium to 152.0.7977.169. [#55033](electron/electron#55033) - Updated Node.js to v24.22.1. [#55162](electron/electron#55162) ##### [v44.9.3](https://github.com/electron/electron/releases/tag/v44.9.3) ### Release Notes for v44.9.3 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8. [#55149](electron/electron#55149) ##### [v44.9.2](https://github.com/electron/electron/releases/tag/v44.9.2) ### Release Notes for v44.9.2 ##### [v44.9.1](https://github.com/electron/electron/releases/tag/v44.9.1) ### Release Notes for v44.9.1 > \[!NOTE] > This release contains the fix for <GHSA-jr5w-w6x2-84p9>, the mitigation for compromised eMudhra intermediate certificates ##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0) ### Release Notes for v44.9.0 #### Features - Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) (Also in [45](https://github.com/electron/electron/pull/55072)) #### Fixes - Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) (Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051)) - Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) (Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045)) ##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0) ### Release Notes for v44.8.0 #### Features - Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) (Also in [45](https://github.com/electron/electron/pull/54889)) #### Fixes - Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987) - Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) (Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910)) - Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) (Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956)) - Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) (Also in [45](https://github.com/electron/electron/pull/55008)) #### Other Changes - Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034) - Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928) - Updated Node.js to v24.22.0. [#55004](electron/electron#55004) ##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2) ### Release Notes for v44.7.2 #### Fixes - Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) (Also in [45](https://github.com/electron/electron/pull/54818)) - Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) (Also in [45](https://github.com/electron/electron/pull/54843)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898) #### Documentation - Documentation changes: [#54880](electron/electron#54880) ##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1) ### Release Notes for v44.7.1 #### Fixes - Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) (Also in [45](https://github.com/electron/electron/pull/54781)) - Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) (Also in [45](https://github.com/electron/electron/pull/54846)) - Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798) - Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) (Also in [45](https://github.com/electron/electron/pull/54848)) - Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) (Also in [45](https://github.com/electron/electron/pull/54864)) #### Other Changes - Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) (Also in [45](https://github.com/electron/electron/pull/54803)) - Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085) ##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0) ### Release Notes for v44.7.0 #### Features - The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204) #### Fixes - Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666) - Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657) ##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0) ### Release Notes for v44.6.0 #### Features - Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) (Also in [45](https://github.com/electron/electron/pull/54521)) #### Fixes - Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596) - Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) (Also in [45](https://github.com/electron/electron/pull/54615)) - Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) (Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585)) - Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623) #### Documentation - Documentation changes: [#54589](electron/electron#54589)

chore: cherry-pick 69 changes from angle, chromium, pdfium, skia and v8

4a9a204

electron-security-backports Bot added 44-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes labels Oct 20, 2026

claude Bot marked this pull request as ready for review October 21, 2026 00:41

claude Bot requested a review from a team as a code owner October 21, 2026 00:41

dsanders11 approved these changes Oct 21, 2026

View reviewed changes

VerteDinde approved these changes Oct 21, 2026

View reviewed changes

VerteDinde enabled auto-merge (squash) October 21, 2026 01:37

VerteDinde merged commit c542df1 into 44-x-y Oct 21, 2026
68 checks passed

VerteDinde deleted the security-backport/44-x-y/39495350711 branch October 21, 2026 01:38

electron-release-board Bot added this to 44-x-y Oct 21, 2026

TCOTC mentioned this pull request Oct 21, 2026

Upgrade Electron, Go and CA certificates to distrust compromised eMudhra intermediates siyuan-note/siyuan#20780

Closed

scott-r-lindsey mentioned this pull request Oct 21, 2026

chore: update Electron to 44.9.3 scott-r-lindsey/foom#673

Merged

ysitbon mentioned this pull request Oct 21, 2026

[LWD] build(desktop): upgrade electron to 44.9.3 LedgerHQ/ledger-live#23576

Merged

danoli3 mentioned this pull request Oct 22, 2026

projectGenerator dependencies have newer releases openframeworks/projectGenerator#672

Closed

forliHD mentioned this pull request Oct 22, 2026

Electron 44.9.3: Chromium-Sicherheitsfixes und eMudhra-Sperre forliHD/kira-mac#11

Merged

juzser mentioned this pull request Oct 23, 2026

fix(deps): bump Electron to 44.9.3 juzser/vam#574

Open

timche mentioned this pull request Oct 23, 2026

Upgrade Electron to 44.9.3 zoidsh/meru#1215

Merged

brycedbjork mentioned this pull request Oct 23, 2026

fix: update electron to 44.9.3 for the emudhra certificate mitigation north-brook/ponzu#158

Merged

msieurthenardier mentioned this pull request Oct 27, 2026

squawk: turnaround 2026-10-26 — Electron 44.9.3 + transitive audit fixes (0164, 0165) msieurthenardier/goldfinch#272

Merged

SnomeaD mentioned this pull request Nov 10, 2026

[Bug]: Saving an edited PDF form "With your changes" writes a 0-byte file #55251

Open

3 tasks done

Navigation Menu

Repository navigation

chore: cherry-pick 69 changes from angle, chromium, pdfium, skia and v8 - #55149

chore: cherry-pick 69 changes from angle, chromium, pdfium, skia and v8#55149
VerteDinde merged 2 commits into
44-x-yfrom
security-backport/44-x-y/39495350711

electron-security-backports Bot commented Oct 20, 2026

Uh oh!

Uh oh!

release-clerk Bot commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

electron-security-backports Bot commented Oct 20, 2026

Description of Change

Checklist

Release Notes

Uh oh!

Uh oh!

release-clerk Bot commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants