- Block cross‑origin fetch() and XHR for custom protocols unless `corsEnabled:true`, with opaque responses for no‑cors mode;
- Fix several crashes—including invalid HTTP header names in webRequest, PDF generation after a rejected call, autofill popups during window close, and hidden WebContentsView drag regions;
- Backport security patches and upstream fixes for GPU command buffer validation, Skia, ANGLE, and WebRTC
electron v40.9.3
Official Electron changelog summary with source attribution, release tags, and community reactions.
Track this Electron release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Electron release note into a weekly digest for the tools you actually use.
Create digestMore Electron changelog updates
Fixed numerous crashes and stability issues (DevTools popup, promptTouchID, malformed ASAR, login item settings, sharedTexture GPU, main process exit, etc.).
Fixed Linux frameless window drop‑shadow glitch and a memory leak when creating BrowserWindows.
Fixed registerFileProtocol and registerHttpProtocol to return opaque responses for cross-origin no‑CORS fetches.