AppYour homeOperatorJournalAlerts
Request an introduction
Advisory

Apps built on Electron 41

Electron 41 stopped getting security fixes on 24 Aug 2026. Since then, Google has fixed 1,451 security fixes in Chromium, the browser engine inside every Electron app, 53 rated critical and 364 high by Google. Two of them are being used in attacks.

Apps built on Electron 41High
What it is
Electron is the framework many Mac apps are built with. Each app carries its own copy of Chromium, the engine inside Chrome, to show its windows
Affected
Any app built on Electron 41, which uses Chromium 146
Support ended
24 Aug 2026, with Electron 41.10.7, whose release notes say Electron 41 has reached end-of-support
Still supported
Electron 45, 44, 43: the newest three, as Electron's policy says
Missing
1,451 security fixes Google has made to Chromium since, 53 rated critical and 364 high by Google
Used in attacks
  • CVE-2026-87491, a memory flaw in Chrome's JavaScript engine that lets a web page run code
  • CVE-2026-85046, a flaw that makes Chrome's JavaScript engine mix up types of data, letting a web page run code
What's missing.Counted from Google’s release notes, the same way the HARD app counts it, checked 23 Oct 2026.

Not every one of those flaws reaches back to the older Chromium 146 inside Electron 41; some are in code that came later. But nobody is checking: Electron's team stopped backporting fixes when support ended, and Google's fixes go into current Chrome, not the Chromium 146 inside Electron 41. That includes the two flaws being used in attacks: nobody has said whether they reach Electron 41.

An Electron app is harder to reach than a browser, because it mostly shows one company’s content. But messaging and email apps show links, previews and files that other people send, which is how a booby-trapped one would get in.

One example: Slack 4.49.89, from 28 Apr 2026, is built on Electron 41.2.2. Slack has released newer versions since; the latest, 4.52.182, came out on 20 Oct 2026. Slack doesn't say which Electron each release uses, so the HARD app reads it from the copy on your Mac.

Being used in attacks

  1. Used in attacks
    CVE-2026-87491

    A memory flaw in Chrome's JavaScript engine that lets a web page run code.

    What it is, and the sources
  2. Used in attacks
    CVE-2026-85046

    A flaw that makes Chrome's JavaScript engine mix up types of data, letting a web page run code.

    What it is, and the sources

What to do

  1. Update the app.Most have Check for Updates in the app menu; apps from the Mac App Store update from there. The HARD app names each one on your Mac that’s on an old Electron.
  2. If it’s already up to date, tell the developer.An app that's current but still on Electron 41 is waiting on its maker. Ask them when they'll move to a supported Electron.
  3. Meanwhile, be careful what you open in it.Links and files from people you don’t know are the way in. Open them in an up-to-date browser instead.

Release by release

ReleaseFixesCriticalHigh
Chrome 156.0.8078.47/48 353 661
Chrome 155.0.8059.84/85 10 16
Chrome 155.0.8059.79/80 37 729
Chrome 155.0.8059.39/40 247 453
Chrome 154.0.8037.97/98 11 19
Chrome 154.0.8037.92/93 32 125
Chrome 154.0.8037.57/58 108 1125
Chrome 153.0.8010.52/53 16 27
Chrome 153.0.8010.47/48 42 328
Chrome 153.0.8010.36/37 · CVE-2026-87491 230 541
Chrome 152.0.7977.82/83 · CVE-2026-85046 12 010
Chrome 152.0.7977.75/76 26 29
Chrome 152.0.7977.64/65 327 1061
Newest first.Every Chrome release since Electron 41's last, with Google's own counts.

Sources

  1. Release notes for v41.10.7The last Electron 41 release, with its end-of-support notice.github.com/electron ·
  2. Electron releases: version support policyOnly the latest three stable majors are supported.electronjs.org
  3. Electron 41 releasesEvery Electron 41 release and the Chromium it's built on.releases.electronjs.org
  4. Slack for Mac release notesSlack's releases, newest first.slack.com ·
  5. Stable Channel Update for Desktop: Chrome 153.0.8010.36/37230 security fixes, 5 rated critical and 41 high by Google.chromereleases.googleblog.com ·
  6. Stable Channel Update for Desktop: Chrome 152.0.7977.82/8312 security fixes, 0 rated critical and 10 high by Google.chromereleases.googleblog.com ·
  7. Known Exploited Vulnerabilities catalog: CVE-2026-87491CVE-2026-87491, added 9 Sep 2026.cisa.gov ·
  8. Known Exploited Vulnerabilities catalog: CVE-2026-85046CVE-2026-85046, added 4 Sep 2026.cisa.gov ·
Every advisoryLook up any app, company or CVEThe HARD Mac app links its warnings here.