medium
Electron 41.0.2 no longer receives security fixes
2 major versions behind the oldest supported line (as of 2026-10-22, Electron 43–45 are supported). Its bundled Chromium misses every fix since.
Gallery · App X-Ray
Element 1.12.13
- 0 high
- 1 medium
- 1 low
- 1 info
Findings
low
IPC handlers do not check the sender
18 main-process handlers, and no check of event.senderFrame or event.sender was found. Any page that can send IPC, including an injected one, is trusted.
info
IPC channel names chosen at runtime
2 IPC calls take the channel name from a variable. When a preload script forwards a channel chosen by the page, the page can reach every handler; worth reviewing.
Network addresses
| Host | Address | How | Where |
|---|---|---|---|
| — | autoHideMenuBar | call:store.get | src/electron-main.ts:456 |
| — | disableHardwareAcceleration | call:store.get | src/electron-main.ts:338 |
| — | disableHardwareAcceleration | call:Store.instance.get | src/settings.ts:71 |
| — | enableContentProtection | call:store.get | src/electron-main.ts:471 |
| — | enableContentProtection | call:Store.instance.get | src/settings.ts:84 |
| — | feedUrl | call:fetch | src/updater.ts:37 |
| matrix.org | https://matrix.org/** | call:context.route | playwright/element-desktop-test.ts:105 |
| — | minimizeToTray | call:store.get | src/electron-main.ts:492 |
| — | openAtLoginMinimised | call:Store.instance.get | src/auto-launch.ts:23 |
| — | r.avatarUrl | call:fetch | src/ipc.ts:175 |
| — | safeStorage | call:get | src/store.ts:426 |
| — | safeStorageBackend | call:get | src/store.ts:289 |
| — | safeStorageBackendMigrate | call:delete | src/store.ts:433 |
| — | safeStorageBackendOverride | call:store.get | src/store.ts:161 |
| — | spellCheckerEnabled | call:store.get | src/electron-main.ts:489 |
| — | url | call:fetch | src/webcontents-handler.ts:155 |
| vector | vector://vector/webapp/ | call:global.mainWindow.loadURL | src/electron-main.ts:481 |
| — | warnBeforeExit | call:Store.instance.get | src/settings.ts:31 |
| — | warnBeforeExit | call:store.get | src/electron-main.ts:517 |
Modules
| Module | Used by |
|---|---|
| @playwright/test | playwright.config.ts, playwright/element-desktop-test.ts |
| @sentry/electron/main | src/electron-main.ts |
| auto-launch | src/auto-launch.ts |
| counterpart | src/language-helper.ts |
| electron | src/badge.ts, src/electron-main.ts, src/ipc.ts, src/media-auth.ts, src/preload.cts, src/protocol.ts, src/seshat.ts, src/settings.ts, src/squirrelhooks.ts, src/store.ts, src/tray.ts, src/updater.ts, src/vectormenu.ts, src/webcontents-handler.ts |
| electron-builder | electron-builder.ts |
| electron-devtools-installer | src/electron-main.ts |
| electron-store | src/store.ts |
| electron-window-state | src/electron-main.ts |
| eslint-plugin-matrix-org/.prettierrc.js | .prettierrc.cjs |
| knip | knip.ts |
| matrix-seshat | src/seshat.ts |
| matrix-web-i18n | src/language-helper.ts |
| minimist | src/electron-main.ts |
| node:child_process | hak/matrix-seshat/check.ts, src/squirrelhooks.ts |
| node:crypto | src/protocol.ts, src/utils.ts |
| node:fs | electron-builder.ts, src/electron-main.ts, src/protocol.ts, src/seshat.ts, src/utils.ts, src/webcontents-handler.ts |
| node:fs/promises | hak/matrix-seshat/check.ts, playwright/element-desktop-test.ts, src/tray.ts, src/updater.ts |
| node:os | electron-builder.ts, playwright/element-desktop-test.ts, src/updater.ts |
| node:path | electron-builder.ts, playwright/element-desktop-test.ts, src/build-config.ts, src/electron-main.ts, src/language-helper.ts, src/protocol.ts, src/seshat.ts, src/squirrelhooks.ts, src/tray.ts, src/utils.ts, src/webcontents-handler.ts |
| node:stream | playwright/element-desktop-test.ts |
| node:stream/promises | src/webcontents-handler.ts |
| node:url | playwright/element-desktop-test.ts, src/build-config.ts, src/electron-main.ts, src/language-helper.ts, src/protocol.ts, src/webcontents-handler.ts |
| png-to-ico | src/tray.ts |
| uuid | src/tray.ts |
Windows and IPC
| Window | webPreferences |
|---|---|
| src/electron-main.ts:447 | contextIsolation=true, nodeIntegration=false, preload=?, webgl=true |
| Channel | Side | Operation | Where |
|---|---|---|---|
| app_onAction | main | on | src/ipc.ts:30 |
| check_updates | main | on | src/updater.ts:173 |
| getConfig | renderer | invoke | src/preload.cts:67 |
| getProtocol | main | handle | src/protocol.ts:59 |
| getSettingValue | renderer | invoke | src/preload.cts:77 |
| getSupportedSettings | renderer | invoke | src/preload.cts:68 |
| homeserverUrl | main | once | src/media-auth.ts:42 |
| initialise | main | once | src/ipc.ts:225 |
| install_update | main | on | src/updater.ts:172 |
| ipcCall | main | on | src/ipc.ts:48 |
| loudNotification | main | on | src/ipc.ts:16 |
| serverSupportedVersions | main | once | src/media-auth.ts:16 |
| seshat | main | on | src/seshat.ts:79 |
| setBadgeCount | main | on | src/badge.ts:42 |
| setSettingValue | renderer | invoke | src/preload.cts:74 |
| userAccessToken | main | once | src/media-auth.ts:29 |
| userDownloadAction | main | on | src/webcontents-handler.ts:268 |
Remote pages, data and packaging
No remote pages are loaded into app windows.
No on-device storage calls found.
No packaged executable was found, so Electron fuses were not read.
README badge
Maintainers can show this report in their README:
[](https://Eliot5566.github.io/app-xray/apps/element-desktop/)
What this report cannot see
- Source checkout: 64 test, story, build-tool and minified/generated files were left out. Rerun with --all-files to include them.
- CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.
- Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.
- Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.
- Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.
- Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.
- JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.
- Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.
- Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.
- Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.