[GH-ISSUE #23] Electron is very out of date #7

New issue

Open

opened 2026-10-30 22:07:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-30 22:07:17 +00:00

Owner

Originally created by @hayleox on GitHub (Jun 24, 2025).
Original GitHub issue: https://github.com/lutris/web-runner/issues/23

This repository currently installs Electron 4.2.12, based on Chromium 69 which released in September 2018. This is good for Flash games (as this is the last Electron version with Pepper Flash support), but it is very bad for security and for playing HTML5 games.

This version of Electron has many unpatched vulnerabilities, which is particularly concerning given that Lutris allows it to load content from any URL. CVE-2019-5786 is a particularly nasty one. Obviously it's somewhat well known that Flash Player has security issues, but someone using the web runner to load HTML5 games might not expect that mere JavaScript could compromise their system.

Besides the security concerns, any newly written games are increasingly likely to use new web features not supported by this ancient build. Here is a list comparing the latest stable Electron's feature to Electron 4.2.12. For example, the games 368 Chickens and Connect 3 cannot be played in this version of Electron. They require the CSS property aspect-ratio, which was added to Chromium in January 2021 and is supported on >93% of devices browsing the web today, but is not available in this version of Electron.

Perhaps the solution is to split the web runner in two. There could be a main version that is regularly updated to the latest Electron, and one version solely for running Flash games that stays on 4.2.12, but is sandboxed to have no access to the internet or any files outside the game directory (perhaps using Flatpak or Docker?).

Originally created by @hayleox on GitHub (Jun 24, 2025). Original GitHub issue: https://github.com/lutris/web-runner/issues/23 This repository currently installs Electron 4.2.12, based on Chromium 69 which released in September 2018. This is good for Flash games (as this is the last Electron version with Pepper Flash support), but it is very bad for security and for playing HTML5 games. This version of Electron has [many unpatched vulnerabilities](https://security.snyk.io/package/npm/electron), which is particularly concerning given that Lutris allows it to load content from any URL. [CVE-2019-5786](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/) is a particularly nasty one. Obviously it's somewhat well known that Flash Player has security issues, but someone using the web runner to load HTML5 games might not expect that mere JavaScript could compromise their system. Besides the security concerns, any newly written games are increasingly likely to use new web features not supported by this ancient build. [Here is a list comparing the latest stable Electron's feature to Electron 4.2.12.](https://caniuse.com/?compare=chrome+69,chrome+138&compareCats=all) For example, the games [368 Chickens](https://368chickens.com/) and [Connect 3](https://connect3.org/) cannot be played in this version of Electron. They require the CSS property `aspect-ratio`, which was added to Chromium in January 2021 and is [supported on >93% of devices browsing the web today](https://caniuse.com/mdn-css_properties_aspect-ratio), but is not available in this version of Electron. Perhaps the solution is to split the web runner in two. There could be a main version that is regularly updated to the latest Electron, and one version solely for running Flash games that stays on 4.2.12, but is sandboxed to have no access to the internet or any files outside the game directory (perhaps using Flatpak or Docker?).

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

lutris/web-runner#7

No description provided.

Rows
Columns