How old can the Chromium inside your Electron app safely be?

Your Electron app ships its own copy of Chromium, so it is only as current as the Electron version you last released. Electron supports the latest three stable major versions, with a new major roughly every 8 weeks, so an app more than about six months behind is likely outside support.

What the support policy says

From the Electron timelines documentation:

• The latest three stable major versions are supported by the Electron team, and only the latest minor release in each series is supported.
• The oldest supported line gets only security fixes.
• The cadence between major releases is 8 weeks. Each major spends four weeks in alpha and four weeks in beta before it reaches stable.
• Electron targets Chromium even numbered versions, releasing every 8 weeks to match Chromium's 4 week schedule. The page's example: Electron 26 uses Chromium 116.

Browsers fix security bugs quickly and publicly. When a bug in a bundled Chromium is fixed upstream, your users stay exposed until you ship a new Electron.

Do the arithmetic

Three supported majors at 8 weeks each gives a window of roughly 24 weeks from a major reaching stable to it falling off the supported list. That is a planning estimate from the documented cadence, not a promise. Check the current schedule page before relying on a date.

Find out what you ship

Every packaged app knows its own versions. In the main process or developer tools, process.versions.electron and process.versions.chrome report them. Put both numbers in your release notes and your inventory so support and security teams can answer a customer question quickly.

An upgrade routine that fits

1. Subscribe to Electron release notes and check them every sprint.
2. Upgrade on a fixed rhythm, such as every second major, instead of waiting for a crisis.
3. Keep a branch that builds against the next major, so the real upgrade is small.
4. Run your end to end tests on the new version early.
5. Treat a dropped support line as a deadline.

What upgrading does not fix

Updating Electron refreshes Chromium and Node, not the npm packages in your app. Those need their own review. Keep both in the same inventory so one list shows what is old.

Try it yourself

Open the vulnerability management demo and look at how findings are sorted and tracked over time. An out of support runtime is one more item on that kind of list.

Click through it at your own pace, or open it full screen.

Quick check

Safeguard's SBOM and dependency scanning can list the runtime and packages inside a desktop app. A free scan is at gold.safeguard.sh/scan.

Sources

• Electron release timelines and support policy

Last reviewed: 19 October 2026.