20getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents.#53707 <sup>(Also in 42, 44, 45)</sup>
21nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes.#53712 <sup>(Also in 42, 44, 45)</sup>
=help: Enable nodeIntegrationInSubFrames to keep Node in workers created by subframes.
key points
note[1]:Adds initiatorOrigin to webRequest and protocol handler requests, plus DownloadItem.getInitiatorOrigin().release-notes:5
note[2]:File System Access permission requests and grants are now scoped to the requesting document, and write access works in in-memory sessions.release-notes:9
note[3]:Adds ELECTRON_DEBUG_DRAGGABLE_REGIONS to visualize and log draggable regions in unpackaged apps.release-notes:6
note[4]:Fixes session.setPermissionCheckHandler passing the top-level origin and a null webContents for subframe hid and usb checks.release-notes:10
* Added `initiatorOrigin` to webRequest and protocol handler requests, `DownloadItem.getInitiatorOrigin()`, and a trailing `frame` argument to the `will-download` and `preconnect` session events. [#53704](https://github.com/electron/electron/pull/53704) <sup>(Also in [44](https://github.com/electron/electron/pull/53703), [45](https://github.com/electron/electron/pull/53700))</sup>
* Added the `ELECTRON_DEBUG_DRAGGABLE_REGIONS` environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. [#53633](https://github.com/electron/electron/pull/53633) <sup>(Also in [44](https://github.com/electron/electron/pull/53627), [45](https://github.com/electron/electron/pull/53626))</sup>
## Fixes
* File System Access permission requests and the `file-system-access-restricted` event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. [#53694](https://github.com/electron/electron/pull/53694) <sup>(Also in [42](https://github.com/electron/electron/pull/53695), [44](https://github.com/electron/electron/pull/53691), [45](https://github.com/electron/electron/pull/53690))</sup>
* Fixed `session.setPermissionCheckHandler` receiving the top-level origin and a null `webContents` for `hid` and `usb` checks made from a subframe. [#53689](https://github.com/electron/electron/pull/53689) <sup>(Also in [42](https://github.com/electron/electron/pull/53736), [44](https://github.com/electron/electron/pull/53688), [45](https://github.com/electron/electron/pull/53679))</sup>
* Fixed `webContents.on()`, `removeListener()` and `removeAllListeners()` throwing "Object has been destroyed" for `console-message` listeners after the WebContents was destroyed. [#53496](https://github.com/electron/electron/pull/53496) <sup>(Also in [42](https://github.com/electron/electron/pull/53497), [44](https://github.com/electron/electron/pull/53494), [45](https://github.com/electron/electron/pull/53495))</sup>
* Fixed a crash on Linux when `process.env` was written while another thread was reading the environment, and a memory leak when a worker thread exits. [#53510](https://github.com/electron/electron/pull/53510) <sup>(Also in [42](https://github.com/electron/electron/pull/53511), [44](https://github.com/electron/electron/pull/53509), [45](https://github.com/electron/electron/pull/53508))</sup>
* Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. [#53584](https://github.com/electron/electron/pull/53584) <sup>(Also in [42](https://github.com/electron/electron/pull/53585), [44](https://github.com/electron/electron/pull/53583), [45](https://github.com/electron/electron/pull/53586))</sup>
* Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process `window.open()` child whose `contextIsolation` differed from its opener's. [#53540](https://github.com/electron/electron/pull/53540) <sup>(Also in [42](https://github.com/electron/electron/pull/53541), [44](https://github.com/electron/electron/pull/53539), [45](https://github.com/electron/electron/pull/53538))</sup>
* Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. [#53750](https://github.com/electron/electron/pull/53750) <sup>(Also in [44](https://github.com/electron/electron/pull/53749), [45](https://github.com/electron/electron/pull/53748))</sup>
* Fixed crashes in `setDisplayMediaRequestHandler` when the granted frame had been destroyed or another tab was granted by id. [#53671](https://github.com/electron/electron/pull/53671) <sup>(Also in [42](https://github.com/electron/electron/pull/53674), [44](https://github.com/electron/electron/pull/53672), [45](https://github.com/electron/electron/pull/53673))</sup>
* Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. [#53631](https://github.com/electron/electron/pull/53631) <sup>(Also in [44](https://github.com/electron/electron/pull/53630), [45](https://github.com/electron/electron/pull/53471))</sup>
* Internal `<webview>`, `window.close()` and `executeJavaScript` reply IPCs are validated against the sending frame. [#53726](https://github.com/electron/electron/pull/53726) <sup>(Also in [42](https://github.com/electron/electron/pull/53727), [44](https://github.com/electron/electron/pull/53723), [45](https://github.com/electron/electron/pull/53724))</sup>
* `<webview>` without `allowpopups` also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. [#53718](https://github.com/electron/electron/pull/53718) <sup>(Also in [42](https://github.com/electron/electron/pull/53719), [44](https://github.com/electron/electron/pull/53721), [45](https://github.com/electron/electron/pull/53717))</sup>
* `getUserMedia` with `chromeMediaSource: 'desktop'` no longer accepts WebContents source ids; use `chromeMediaSource: 'tab'` with `webContents.getMediaSourceId()` or `setDisplayMediaRequestHandler` to capture a WebContents. [#53707](https://github.com/electron/electron/pull/53707) <sup>(Also in [42](https://github.com/electron/electron/pull/53710), [44](https://github.com/electron/electron/pull/53709), [45](https://github.com/electron/electron/pull/53708))</sup>
* `nodeIntegrationInWorker` now applies only to workers created by frames that themselves have Node integration; enable `nodeIntegrationInSubFrames` to keep Node in workers created by subframes. [#53712](https://github.com/electron/electron/pull/53712) <sup>(Also in [42](https://github.com/electron/electron/pull/53713), [44](https://github.com/electron/electron/pull/53711), [45](https://github.com/electron/electron/pull/53706))</sup>
* `openExternal` permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. [#53698](https://github.com/electron/electron/pull/53698) <sup>(Also in [42](https://github.com/electron/electron/pull/53697), [44](https://github.com/electron/electron/pull/53699), [45](https://github.com/electron/electron/pull/53696))</sup>
* `pointerLock` and `keyboardLock` permission requests now report the requesting frame, and `execCommand('paste')` requires user activation in the frame that calls it. [#53701](https://github.com/electron/electron/pull/53701) <sup>(Also in [42](https://github.com/electron/electron/pull/53702), [44](https://github.com/electron/electron/pull/53693), [45](https://github.com/electron/electron/pull/53692))</sup>
## Other Changes
* Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. [#53766](https://github.com/electron/electron/pull/53766)
* Fixed a renderer crash that could occur when printing from an iframe. [#53761](https://github.com/electron/electron/pull/53761) <sup>(Also in [44](https://github.com/electron/electron/pull/53762), [45](https://github.com/electron/electron/pull/53763))</sup>
* Fixed the app becoming unresponsive when a page has a very large number of `app-region` draggable elements. [#53632](https://github.com/electron/electron/pull/53632) <sup>(Also in [44](https://github.com/electron/electron/pull/53597), [45](https://github.com/electron/electron/pull/53596))</sup>
* Updated Node.js to v24.21.0. [#53777](https://github.com/electron/electron/pull/53777)