Electron

Electron is an open-source framework for building cross-platform desktop applications for macOS, Windows, and Linux with JavaScript, HTML, and CSS. It embeds the Chromium rendering engine and the Node.js runtime in one application, and developers can add native code through native add-ons. It is MIT-licensed, free for commercial and personal use, and maintained as a project of the OpenJS Foundation. Web development teams use it to build desktop clients, including by wrapping an existing web application, and to ship them through standard installers or app stores.

Architecture

Electron inherits Chromium's multi-process architecture.

• Main process: Each app has one main process, which runs in a Node.js environment and is the app's entry point. It creates and manages windows with the BrowserWindow module and controls the application lifecycle through the app module. It also exposes native desktop APIs such as menus, dialogs, tray icons, and notifications.
• Renderer processes: Each window and web embed runs in its own renderer process, which renders web content to web standards. Renderers have no direct Node.js access by default.
• Preload scripts and context isolation: A preload script runs in the renderer context before web content loads and has access to Node.js APIs. Context isolation is on by default, so a preload script exposes only selected APIs to the page through the contextBridge module. Inter-process communication (IPC) between renderer and main runs through ipcRenderer helpers exposed this way.
• Utility processes: The UtilityProcess API forks child processes from the main process for untrusted services, CPU-intensive tasks, or crash-prone components. Unlike Node.js child_process.fork, a utility process can open a MessagePort channel to a renderer.

Native Integration and Distribution

• Window and UI control: Developers customize window appearance, application menus, dialogs, and notifications.
• Automatic updates: The autoUpdater module supports macOS and Windows. It uses Squirrel.Mac on macOS, which requires a signed app, and Squirrel.Windows or MSIX on Windows, chosen automatically by packaging format. Linux has no built-in updater and relies on the distribution's package manager. On macOS, an update entry can declare a SHA-256 digest and size to verify downloads, and can carry a binary patch that is applied instead of the full ZIP archive.
• Crash reporting: The crashReporter module collects JavaScript and native crash data, and can send it to a third-party service or a self-hosted Crashpad server.
• Packaging: Electron Forge is the recommended tooling. Community tooling produces platform installers such as .dmg, .msi, and .rpm. Apps can also be assembled manually from Electron's prebuilt binaries, optionally as an asar archive.
• App stores: Electron supports the Mac App Store, Microsoft Store, and Snap Store.

Platforms and Releases

• Supported platforms: Electron provides macOS binaries for Ventura and later on Intel and Apple silicon, Windows binaries for Windows 10 and later on x64 and arm64, and Linux binaries for x64 and arm64 on distributions still supported by Chromium and the distribution maker.
• Release cadence: Major versions ship every 8 weeks, aligned with even-numbered Chromium releases, with a four-week alpha and a four-week beta before each stable release. The Electron team supports the latest three stable major versions.
• Compatibility: Changed or removed APIs are supported for at least two major versions where possible before removal.
• Tooling and ecosystem: Electron installs through npm and supports TypeScript, with type-definition subpaths per process. Developers can use any npm package and any front-end library or framework, such as React, Vue, or Angular, in the renderer. Electron Fiddle builds, runs, and packages small experiments.

Security

Electron is not a web browser. Its JavaScript can access the file system and user shell, so loading untrusted remote content is a documented risk. The security guide recommends enabling context isolation and process sandboxing, disabling Node.js integration for remote content, defining a Content-Security-Policy, and keeping Electron current. Each application ships its own bundled Chromium and Node.js, so Chromium and Node.js vulnerabilities reach users only through app updates.