# Electron, we have a problem
Many Electron apps auto-update without verifying signatures. Many also still trust the compromised eMudhra certificates. Together, that lets an attacker on your network install malware on your machine.
If you're a user, uninstall affected apps and install patched versions manually. If you're a vendor, please verify signatures on your auto-updates.
## Cypher-SaaS
My hobby this year was breaking the crypto in privacy products like [Proton](https://schaerli.org/weblog/5-proton/), [Internxt](https://schaerli.org/weblog/6-internxt/) and [Filen](https://schaerli.org/weblog/7-filen/). My biggest gripe with these [Cypher-SaaS](https://schaerli.org/weblog/7-filen/#zeroknowledgeencryption) products is that they rarely admit browser crypto doesn't make sense. They [claim](https://web.archive.org/web/20260522105556/https://proton.me/) that nobody, not even the vendor, can access your data. Yet the vendor could serve a malicious script to a few users and backdoor the encryption. It would be trivial and hard to detect.
The usual [advice](https://web.archive.org/web/20260526121017/https://proton.me/blog/cryptographic-architecture-response) is to use desktop app instead, where code can be signed and crypto isn't re-fetched on every page load. Because most Cypher-SaaS started off as websites, a common choice is to build desktop clients with [Electron](https://www.electronjs.org/). This essentially just bundles the website into a local app running inside a customized browser. However, Electron's update ecosystem is [messy](https://blog.doyensec.com/2026/02/16/electron-safe-updater.html) and the mainstream libraries only have partial or no signature support, which leads some vendors to skip it and rely on TLS alone to protect the update channel.
## eMudhra Intermediate CA Compromise
Then in October 2026, [emudhra.we-have-a-problem.com](https://emudhra.we-have-a-problem.com/) showed that a couple eMudhra intermediate CAs, trusted to sign certificates for any website, used tiny private keys that are trivial to recover.
Browsers fixed it quickly, shipping revocation lists within hours, it didn't even require a browser update. But Electron [does not have](https://github.com/electron/electron/pull/7252) Chromium's component updater, which is what delivers those lists, so there was no easy remediation. Electron fixed it by [hardcoding](https://github.com/electron/electron/blob/817c43f925677eb88034bfba4f0b8dfd28e7ad20/patches/chromium/add_entries_to_the_spki_blocklist.patch) distrust of these specific eMudhra certs ([GHSA](https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9)), which requires users to install a full new version of any electron application before the patch lands. This is a one-time bandaid and without revocation list support, the next time something similar happens the patching has to repeat.
## How bad could it be
This year I reported updates without signature verification to [Proton](https://schaerli.org/weblog/5-proton/#unsignedclients), [Bitwarden](https://github.com/bitwarden/clients/pull/19591), [Internxt](https://schaerli.org/weblog/6-internxt/#unverifiedupdates) and [Filen](https://schaerli.org/weblog/7-filen/#cryptodoesntmatter), so I knew they weren't rare. I had my LLM compile a list of notable Electron apps, install them in a lab, and test which still trust the eMudhra certs _(using the new [emudhra option](https://github.com/mitmproxy/mitmproxy/blob/992052ee92d7ff4d240eafbe1afdf87c94b3f080/web/src/js/ducks/_options_gen.ts#L26) in [mitmproxy](https://github.com/mitmproxy/mitmproxy))_. It then read the code to check whether each app allows in-place updates and, if so, whether they require a signature check.
Even if there exists a version that no longer trusts eMudhra, many users still run old versions and without update signatures they patch through an insecure channel which allows remote code execution (RCE) for any attacker on the network.
Here's the full list, a snapshot as of 2026-11-10 with the current state and compiled by an LLM. The landscape is heterogeneous enough that it may have misattributed something, if you spot a mistake I'll fix it but I don't have time to commit and keep it up to date as vendors patch:
| App | [Patched](https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9) | GNU[/](https://www.gnu.org/gnu/incorrect-quotation.html)Linux | macOS | Windows |
| --- | --- | --- | --- | --- |
| [Motrix](https://github.com/agalwood/Motrix) | [≥v2.0.0](https://github.com/agalwood/Motrix/blob/v2.3.0/package.json#L114) | **[unverified electron-updater](https://github.com/agalwood/Motrix/blob/v2.4.1/src/main/index.ts#L2543-L2551)** | [signed Squirrel.Mac](https://github.com/agalwood/Motrix/blob/v2.4.1/scripts/sign-macos.mjs#L24-L25) | **[unverified electron-updater](https://github.com/agalwood/Motrix/blob/v2.4.1/src/main/index.ts#L2509-L2518)** |
| [Joplin](https://github.com/laurent22/joplin) | [≥v3.7.22](https://github.com/laurent22/joplin/blob/v3.7.22/packages/app-desktop/package.json#L188) | [no auto-update](https://github.com/laurent22/joplin/blob/v3.7.22/packages/app-desktop/ElectronAppWrapper.ts#L865) | [signed Squirrel.Mac](https://github.com/laurent22/joplin/blob/v3.7.22/packages/app-desktop/services/autoUpdater/AutoUpdaterService.ts#L143-L144) | [signed electron-updater](https://github.com/laurent22/joplin/blob/v3.7.22/packages/app-desktop/package.json#L57-L59) |
| [Logseq](https://github.com/logseq/logseq) | **[no](https://github.com/logseq/logseq/blob/2.0.2/resources/package.json#L55)** | **[unverified electron-updater](https://github.com/logseq/logseq/blob/2.0.2/src/electron/electron/updater.cljs#L126-L163)** | [signed Squirrel.Mac](https://github.com/logseq/logseq/blob/2.0.2/.github/workflows/build-desktop-release.yml#L550-L555) | [signed electron-updater](https://github.com/logseq/logseq/blob/2.0.2/.github/workflows/build-desktop-release.yml#L390-L394) |
| [Trilium Notes](https://github.com/TriliumNext/Trilium) | [≥v0.107.0](https://github.com/TriliumNext/Trilium/blob/v0.107.0/apps/desktop/package.json#L55) | [no auto-update](https://github.com/TriliumNext/Trilium/blob/v0.107.0/apps/client/src/widgets/buttons/global_menu.tsx#L318-L325) | [no auto-update](https://github.com/TriliumNext/Trilium/blob/v0.107.0/apps/client/src/widgets/buttons/global_menu.tsx#L318-L325) | [no auto-update](https://github.com/TriliumNext/Trilium/blob/v0.107.0/apps/client/src/widgets/buttons/global_menu.tsx#L318-L325) |
| [Ente Photos](https://github.com/ente/ente) | [≥v1.7.31](https://github.com/ente/ente/blob/photos-desktop-v1.7.31/desktop/package.json#L49) | **[unverified electron-updater](https://github.com/ente/ente/blob/photos-desktop-v1.7.31/desktop/src/main/services/app-update.ts#L95-L99)** | [signed Squirrel.Mac](https://github.com/ente/ente/blob/photos-desktop-v1.7.31/.github/workflows/photos-desktop-build.yml#L153-L154) | [signed electron-updater](https://github.com/ente/ente/blob/photos-desktop-v1.7.31/desktop/electron-builder.yml#L17-L18) |
| [Beekeeper Studio](https://github.com/beekeeper-studio/beekeeper-studio) | **[no](https://github.com/beekeeper-studio/beekeeper-studio/blob/v6.2.1/apps/studio/package.json#L213)** | **[unverified electron-updater](https://github.com/beekeeper-studio/beekeeper-studio/blob/v6.2.2/apps/studio/src/background/update_manager.ts#L60-L62)** | [signed Squirrel.Mac](https://github.com/beekeeper-studio/beekeeper-studio/blob/v6.2.2/apps/studio/electron-builder-config.js#L177-L185) | **[unverified electron-updater](https://github.com/beekeeper-studio/beekeeper-studio/blob/v6.2.2/apps/studio/electron-builder-config.js#L281-L289)** |
| [FreeTube](https://github.com/FreeTubeApp/FreeTube) | [≥v0.26.0-beta](https://github.com/FreeTubeApp/FreeTube/blob/v0.26.0-beta/pnpm-lock.yaml#L1918) | [no auto-update](https://github.com/FreeTubeApp/FreeTube/blob/v0.26.0-beta/src/renderer/App.vue#L269-L307) | [no auto-update](https://github.com/FreeTubeApp/FreeTube/blob/v0.26.0-beta/src/renderer/App.vue#L269-L307) | [no auto-update](https://github.com/FreeTubeApp/FreeTube/blob/v0.26.0-beta/src/renderer/App.vue#L269-L307) |
| [Mailspring](https://github.com/Foundry376/Mailspring) | [≥1.26.1](https://github.com/Foundry376/Mailspring/blob/1.26.2/package.json#L52) | [no auto-update](https://github.com/Foundry376/Mailspring/blob/1.26.2/app/src/browser/autoupdate-impl-base.ts#L51) | [signed Squirrel.Mac](https://github.com/Foundry376/Mailspring/blob/1.26.2/app/src/browser/autoupdate-manager.ts#L80-L82) | **[unverified Squirrel.exe](https://github.com/Foundry376/Mailspring/blob/1.26.2/app/src/browser/windows-updater.js#L109-L110)**¹ |
| [Signal](https://github.com/signalapp/Signal-Desktop) | [≥v8.32.0](https://github.com/signalapp/Signal-Desktop/blob/v8.33.0/package.json#L244) | [no auto-update](https://github.com/signalapp/Signal-Desktop/blob/v8.34.0/ts/updater/linux.main.ts#L69-L79) | [signed Squirrel.Mac](https://github.com/signalapp/Signal-Desktop/blob/v8.34.0/ts/updater/macos.main.ts#L134-L138) | [Custom ed25519](https://github.com/signalapp/Signal-Desktop/blob/v8.34.0/ts/updater/common.main.ts#L442) |
| [Notesnook](https://github.com/streetwriters/notesnook) | **[no](https://github.com/streetwriters/notesnook/blob/v3.4.12/apps/desktop/package.json#L61)** | **[unverified electron-updater](https://github.com/streetwriters/notesnook/blob/v3.4.12/apps/desktop/src/utils/autoupdater.ts#L26-L45)** | [signed Squirrel.Mac](https://github.com/streetwriters/notesnook/blob/v3.4.12/apps/desktop/electron-builder.config.js#L116-L121) | **[unverified electron-updater](https://github.com/streetwriters/notesnook/blob/v3.4.12/apps/desktop/electron-builder.config.js#L145-L161)** |
| [Bitwarden](https://github.com/bitwarden/clients) | **[no](https://github.com/bitwarden/clients/blob/desktop-v2026.10.3/package.json#L120)** | [no auto-update](https://github.com/bitwarden/clients/blob/desktop-v2026.10.4/apps/desktop/src/main/updater.main.ts#L50) | [signed Squirrel.Mac](https://github.com/bitwarden/clients/blob/desktop-v2026.10.4/.github/workflows/build-desktop.yml#L1740-L1744) | [signed electron-updater](https://github.com/bitwarden/clients/blob/desktop-v2026.10.4/apps/desktop/electron-builder.json#L101) |
| [Element](https://github.com/element-hq/element-web) | [≥v1.12.33](https://github.com/element-hq/element-web/blob/v1.12.33/apps/desktop/package.json#L83) | [no auto-update](https://github.com/element-hq/element-web/blob/v1.12.33/apps/desktop/src/updater.ts#L125-L129) | [signed Squirrel.Mac](https://github.com/element-hq/element-web/blob/v1.12.33/apps/desktop/src/updater.ts#L86-L89) | **[unverified Squirrel.exe](https://github.com/element-hq/element-web/blob/v1.12.33/apps/desktop/electron-builder.ts#L186-L187)**¹ |
| [KeeWeb](https://github.com/keeweb/keeweb) | **[no](https://github.com/keeweb/keeweb/blob/v1.18.9/package.json#L36)** | [no auto-update](https://github.com/keeweb/keeweb/blob/v1.18.9/app/scripts/comp/launcher/launcher-electron.js#L205-L206) | [Custom RSA](https://github.com/keeweb/keeweb/blob/v1.18.9/app/scripts/comp/app/updater.js#L196-L210) | [Custom RSA](https://github.com/keeweb/keeweb/blob/v1.18.9/app/scripts/comp/app/updater.js#L196-L210) |
| [Anytype](https://github.com/anyproto/anytype-ts) | **[no](https://github.com/anyproto/anytype-ts/blob/v0.57.7/bun.lock#L1181)** | **[unverified electron-updater](https://github.com/anyproto/anytype-ts/blob/v0.57.7/package.json#L1059-L1093)** | [signed Squirrel.Mac](https://github.com/anyproto/anytype-ts/blob/v0.57.7/package.json#L1028) | **[unverified electron-updater](https://github.com/anyproto/anytype-ts/blob/v0.57.7/package.json#L1046-L1058)** |
| [Vesktop](https://github.com/Vencord/Vesktop) | [≥v1.6.8](https://github.com/Vencord/Vesktop/blob/v1.6.8/package.json#L41) | **[unverified electron-updater](https://github.com/Vencord/Vesktop/blob/v1.6.9/package.json#L193-L195)** | [signed Squirrel.Mac](https://github.com/Vencord/Vesktop/blob/v1.6.9/package.json#L146-L147) | **[unverified electron-updater](https://github.com/Vencord/Vesktop/blob/v1.6.9/package.json#L193-L195)** |
| [Tuta](https://github.com/tutao/tutanota) | [≥362.261023.2](https://github.com/tutao/tutanota/blob/tutanota-desktop-release-362.261023.2/package.json#L49) | [Custom RSA](https://github.com/tutao/tutanota/blob/tutanota-desktop-release-366.261105.0/src/applications/common/desktop/ElectronUpdater.ts#L183-L189) | [Custom RSA](https://github.com/tutao/tutanota/blob/tutanota-desktop-release-366.261105.0/src/applications/common/desktop/ElectronUpdater.ts#L183-L189) | [Custom RSA](https://github.com/tutao/tutanota/blob/tutanota-desktop-release-366.261105.0/src/applications/common/desktop/ElectronUpdater.ts#L116-L122) |
| [DbGate](https://github.com/dbgate/dbgate) | **[no](https://github.com/dbgate/dbgate/blob/v7.3.4/app/package.json#L133)** | **[unverified electron-updater](https://github.com/dbgate/dbgate/blob/v7.3.4/app/src/electron.js#L280-L284)** | [signed Squirrel.Mac](https://github.com/dbgate/dbgate/blob/v7.3.4/app/package.json#L26-L44) | **[unverified electron-updater](https://github.com/dbgate/dbgate/blob/v7.3.4/app/package.json#L84-L108)** |
| [Standard Notes](https://github.com/standardnotes/app) | **[no](https://github.com/standardnotes/app/blob/%40standardnotes%2Fdesktop%403.203.0/packages/desktop/package.json#L49)** | **[unverified electron-updater](https://github.com/standardnotes/app/blob/%40standardnotes%2Fdesktop%403.203.0/packages/desktop/package.json#L134)** | [signed Squirrel.Mac](https://github.com/standardnotes/app/blob/%40standardnotes%2Fdesktop%403.203.0/packages/desktop/package.json#L93) | [signed electron-updater](https://github.com/standardnotes/app/blob/%40standardnotes%2Fdesktop%403.203.0/packages/desktop/package.json#L127) |
| [Proton Pass desktop](https://github.com/ProtonMail/WebClients)² | **[no](https://github.com/ProtonMail/WebClients/blob/proton-pass@1.43.0/applications/pass-desktop/package.json#L86)** | [no auto-update](https://github.com/ProtonMail/WebClients/blob/proton-pass@1.43.0/applications/pass-desktop/src/lib/updater/updater.ts#L176-L183) | [signed Squirrel.Mac](https://github.com/ProtonMail/WebClients/blob/proton-pass@1.43.0/applications/pass-desktop/src/lib/updater/updater.ts#L153-L161) | [MSIX](https://github.com/ProtonMail/WebClients/blob/proton-pass@1.43.0/applications/pass-desktop/native/napi/src/updater.rs#L23-L30) |
| [Proton Mail desktop](https://github.com/ProtonMail/WebClients)² | [≥1.16.0](https://github.com/ProtonMail/WebClients/blob/proton-inbox-desktop@1.16.1/applications/inbox-desktop/package.json#L82) | [no auto-update](https://github.com/electron/update-electron-app/blob/v3.3.0/src/index.ts#L185-L190) | [signed Squirrel.Mac](https://github.com/ProtonMail/WebClients/blob/proton-inbox-desktop@1.16.1/applications/inbox-desktop/forge.config.ts#L45-L58) | **[unverified Squirrel.exe](https://github.com/ProtonMail/WebClients/blob/proton-inbox-desktop@1.16.1/applications/inbox-desktop/src/update/update.ts#L153-L161)**¹ |
| [Ferdium](https://github.com/ferdium/ferdium-app) | **[no](https://github.com/ferdium/ferdium-app/blob/v7.2.3/package.json#L169)** | **[unverified electron-updater](https://github.com/ferdium/ferdium-app/blob/v7.2.3/electron-builder.yml#L121-L129)** | [signed Squirrel.Mac](https://github.com/ferdium/ferdium-app/blob/v7.2.3/.github/workflows/builds.yml#L208-L213) | **[unverified electron-updater](https://github.com/ferdium/ferdium-app/blob/v7.2.3/electron-builder.yml#L107-L111)** |
| [Padloc](https://github.com/padloc/padloc) | **[no](https://github.com/padloc/padloc/blob/v4.3.0/packages/electron/package.json#L33)** | no auto-update | no auto-update | [no auto-update](https://github.com/padloc/padloc/blob/v4.3.0/packages/electron/src/main.ts#L79-L83) |
| [OneKey](https://github.com/OneKeyHQ/app-monorepo) | **[no](https://github.com/OneKeyHQ/app-monorepo/blob/v6.6.4/package.json#L518)** | [Custom GPG](https://github.com/OneKeyHQ/app-monorepo/blob/v6.6.4/packages/kit-bg/src/desktopApis/DesktopApiAppUpdate.ts#L662-L668) | [Custom GPG](https://github.com/OneKeyHQ/app-monorepo/blob/v6.6.4/packages/kit-bg/src/desktopApis/DesktopApiAppUpdate.ts#L665-L666) | [Custom GPG](https://github.com/OneKeyHQ/app-monorepo/blob/v6.6.4/packages/kit-bg/src/desktopApis/DesktopApiAppUpdate.ts#L665-L666) |
| [Mattermost Desktop](https://github.com/mattermost/desktop) | [≥v5.13.8](https://github.com/mattermost/desktop/blob/v5.13.8/package.json#L134) | [no auto-update](https://github.com/mattermost/desktop/blob/v6.3.2/src/main/updateNotifier.ts#L214-L228) | [no auto-update](https://github.com/mattermost/desktop/blob/v6.3.2/src/renderer/components/DownloadsDropdown/Update/UpdateAvailable.tsx#L35-L40) | [no auto-update](https://github.com/mattermost/desktop/blob/v6.3.2/src/main/updateNotifier.ts#L191-L207) |
| [ElectronMail](https://github.com/vladimiry/ElectronMail) | **[no](https://github.com/vladimiry/ElectronMail/blob/v5.3.10/package.json#L166)** | [no auto-update](https://github.com/vladimiry/ElectronMail/blob/v5.3.10/src/shared/util/config.ts#L65) | [no auto-update](https://github.com/vladimiry/ElectronMail/blob/v5.3.10/src/shared/util/config.ts#L65) | [no auto-update](https://github.com/vladimiry/ElectronMail/blob/v5.3.10/src/shared/util/config.ts#L65) |
| [Rocket.Chat](https://github.com/RocketChat/Rocket.Chat.Electron) | [≥4.18.4](https://github.com/RocketChat/Rocket.Chat.Electron/blob/4.18.4/package.json#L133) | **[unverified electron-updater](https://github.com/RocketChat/Rocket.Chat.Electron/blob/4.19.1/src/updates/main.ts#L149-L152)** | [signed Squirrel.Mac](https://github.com/RocketChat/Rocket.Chat.Electron/blob/4.19.1/workspaces/desktop-release-action/src/macos.ts#L11-L19) | **[unverified electron-updater](https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/4.19.1/latest.yml)** |
| [Delta Chat](https://github.com/deltachat/deltachat-desktop)³ | **[no](https://github.com/deltachat/deltachat-desktop/blob/v2.65.0/packages/target-electron/package.json#L82)** | no auto-update | no auto-update | no auto-update |
| [Jitsi Meet Desktop](https://github.com/jitsi/jitsi-meet-electron) | [≥v2026.10.0](https://github.com/jitsi/jitsi-meet-electron/blob/v2026.10.0/package-lock.json#L13876) | **[unverified electron-updater](https://github.com/jitsi/jitsi-meet-electron/blob/v2026.10.0/main.ts#L215)** | [signed Squirrel.Mac](https://github.com/jitsi/jitsi-meet-electron/blob/v2026.10.0/.github/workflows/ci.yml#L46-L56) | **[unverified electron-updater](https://github.com/jitsi/jitsi-meet-electron/blob/v2026.10.0/.github/workflows/ci.yml#L70-L83)** |
| [Trezor Suite](https://github.com/trezor/trezor-suite) | **[no](https://github.com/trezor/trezor-suite/blob/v26.10.3/package.json#L110)** | [Custom GPG](https://github.com/trezor/trezor-suite/blob/v26.10.3/packages/suite-desktop-core/src/libs/update-checker.ts#L33-L55) | [Custom GPG](https://github.com/trezor/trezor-suite/blob/v26.10.3/packages/suite-desktop-core/src/modules/auto-updater.ts#L206-L233) | [Custom GPG](https://github.com/trezor/trezor-suite/blob/v26.10.3/packages/suite-desktop-core/src/modules/auto-updater.ts#L206-L233) |
| [Ledger Live](https://github.com/LedgerHQ/ledger-live) | [≥4.24.1](https://github.com/LedgerHQ/ledger-live/blob/%40ledgerhq/live-desktop%404.26.0/pnpm-workspace.yaml#L167) | [Custom PKI](https://github.com/LedgerHQ/ledger-live/blob/%40ledgerhq/live-desktop%404.27.1/apps/ledger-live-desktop/src/main/updater/sslHelper.ts#L12-L16) | [signed Squirrel.Mac](https://github.com/LedgerHQ/ledger-live/blob/%40ledgerhq/live-desktop%404.27.1/apps/ledger-live-desktop/electron-builder.yml#L9-L17) | [Custom PKI](https://github.com/LedgerHQ/ledger-live/blob/%40ledgerhq/live-desktop%404.27.1/apps/ledger-live-desktop/src/main/updater/createAppUpdater.ts#L28-L36) |
| [Session](https://github.com/session-foundation/session-desktop) | **[no](https://github.com/session-foundation/session-desktop/blob/v1.18.3/package.json#L186)** | **[unverified electron-updater](https://github.com/session-foundation/session-desktop/blob/v1.18.3/ts/updater/updater.ts#L246-L266)** | [signed Squirrel.Mac](https://github.com/session-foundation/session-desktop/blob/v1.18.3/build/setup-mac-certificate.sh#L6) | **[unverified electron-updater](https://github.com/session-foundation/session-desktop/blob/v1.18.3/package.json#L270)** |
| [LynavoDrive](https://github.com/Lynavo/lynavo-drive) | **[no](https://github.com/Lynavo/lynavo-drive/blob/v1.0.2/pnpm-lock.yaml#L4031)** | no auto-update | no auto-update | no auto-update |
| [Filen](https://github.com/FilenCloudDienste/filen-desktop) | **[no](https://github.com/FilenCloudDienste/filen-desktop/blob/v3.0.53/package.json#L54)** | **[unverified electron-updater](https://github.com/FilenCloudDienste/filen-desktop/blob/v3.0.53/src/lib/updater.ts#L349-L354)** | [signed Squirrel.Mac](https://github.com/FilenCloudDienste/filen-desktop/blob/v3.0.53/src/lib/updater.ts#L326-L327) | **[unverified electron-updater](https://github.com/FilenCloudDienste/filen-desktop/blob/v3.0.53/package.json#L142)** |
| [Internxt](https://github.com/internxt/drive-desktop) | **[no](https://github.com/internxt/drive-desktop/blob/v2.7.1/package.json#L167)** | **[unverified electron-updater](https://github.com/internxt/drive-desktop-linux/blob/v2.7.0/src/apps/main/auto-update/check-for-updates.ts#L19-L29)** | no public mac build | **[unverified electron-updater](https://github.com/internxt/drive-desktop/blob/v2.7.1/package.json#L89)** |
| [Neuron](https://github.com/nervosnetwork/neuron) | **[no](https://github.com/nervosnetwork/neuron/blob/v0.204.1/packages/neuron-wallet/package.json#L91)** | **[unverified electron-updater](https://github.com/nervosnetwork/neuron/blob/v0.204.1/packages/neuron-wallet/electron-builder.yml#L84-L98)** | [signed Squirrel.Mac](https://github.com/nervosnetwork/neuron/blob/v0.204.1/.github/workflows/package.yml#L110-L121) | **[unverified electron-updater](https://github.com/nervosnetwork/neuron/blob/v0.204.1/packages/neuron-wallet/electron-builder.yml#L39)** |
| [Threema Desktop](https://github.com/threema-ch/threema-desktop)² | **[no](https://github.com/threema-ch/threema-desktop/blob/v2.0-beta67/apps/desktop/package.json#L148)** | [no auto-update](https://github.com/threema-ch/threema-desktop/blob/v2.0-beta67/apps/desktop/src/common/dom/update/index.ts#L71-L78) | [Custom codesign](https://github.com/threema-ch/threema-desktop/blob/v2.0-beta67/apps/desktop/src/rust/helper/src/util/fs.rs#L42-L56) | [MSIX](https://github.com/threema-ch/threema-desktop/blob/v2.0-beta67/apps/desktop/src/rust/launcher/src/update/windows.rs#L143-L159) |
> ¹ Squirrel.exe update traffic does not use the Electron trust store but the OS trust store, so it depends on the OS patch level. Microsoft [disallowed the compromised keys](https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys) in the Windows store in October.
>
> ² Proton's desktop apps and Threema pin the certificates of their main API in the app, meaning the main traffic is limited to a small set of certs and does not trust the eMudhra certs. The pin does not apply to the update traffic.
>
> ³ Delta Chat rejected the chain despite being unpatched, every connection it makes runs through its Rust core and not the Electron stacks the vulnerability lives in.
Proton Mail [patched quickly](https://github.com/ProtonMail/WebClients/blob/proton-inbox-desktop@1.16.1/applications/inbox-desktop/package.json#L82), but on Windows it still updates without a signature check. Proton pins its own certificates for most traffic, but not for updates, which run in a separate [Squirrel.exe](https://github.com/Squirrel/Squirrel.Windows) process that uses the OS trust store. The same goes for any Windows app using Squirrel which relies on the OS trust store, not Electron's, so an up-to-date OS won't trust the eMudhra certs. One thing I missed in my [first review of Proton](https://schaerli.org/weblog/5-proton/) is how the Proton Mail desktop app [fetches](https://github.com/ProtonMail/WebClients/blob/proton-inbox-desktop@1.16.1/applications/inbox-desktop/src/utils/view/viewManagement.ts#L161) its entire UI from [`mail.proton.me`](https://github.com/ProtonMail/WebClients/blob/proton-inbox-desktop@1.16.1/applications/inbox-desktop/src/store/urlStore.ts#L48-L52). This is not ideal for an end-to-end encrypted desktop app, as whoever runs the server has the technical means to serve a backdoored UI to selected users on any launch, even if the app itself is properly signed. The same applies to the [Padloc](https://github.com/padloc/padloc/blob/v4.3.0/packages/electron/src/main.ts#L137-L138) password manager and [Rocket.Chat](https://github.com/RocketChat/Rocket.Chat.Electron/blob/4.19.1/src/ui/components/ServersView/ServerPane.tsx#L158-L164).
If you use an app from this list that still trusts the eMudhra certs, uninstall it for now. If it also updates without signatures, don't patch it through the auto-updater. Download the new version in your browser instead, where the compromised CA is already distrusted.
---
> License: CC BY 4.0. To view a copy of this license, visit