Release Notes for v43.7.0

Features

• Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #53704 ^{(Also in 44, 45)}
• Added the ELECTRON_DEBUG_DRAGGABLE_REGIONS environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. #53633 ^{(Also in 44, 45)}

Fixes

• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53694 ^{(Also in 42, 44, 45)}
• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53689 ^{(Also in 42, 44, 45)}
• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53496 ^{(Also in 42, 44, 45)}
• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53510 ^{(Also in 42, 44, 45)}
• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53584 ^{(Also in 42, 44, 45)}
• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53540 ^{(Also in 42, 44, 45)}
• Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #53750 ^{(Also in 44, 45)}
• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53671 ^{(Also in 42, 44, 45)}
• Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. #53631 ^{(Also in 44, 45)}
• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53726 ^{(Also in 42, 44, 45)}
• <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53718 ^{(Also in 42, 44, 45)}
• getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53707 ^{(Also in 42, 44, 45)}
• nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53712 ^{(Also in 42, 44, 45)}
• openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53698 ^{(Also in 42, 44, 45)}
• pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53701 ^{(Also in 42, 44, 45)}

Other Changes

• Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. #53766
• Fixed a renderer crash that could occur when printing from an iframe. #53761 ^{(Also in 44, 45)}
• Fixed the app becoming unresponsive when a page has a very large number of app-region draggable elements. #53632 ^{(Also in 44, 45)}
• Updated Node.js to v24.21.0. #53777