Releases · edrlab/thorium-reader

This is the first Release Candidate of Thorium Desktop reader version 3.5.0, built automatically by GitHub servers (for Windows, Mac, Linux operating systems, and for Intel and ARM hardware), and released on 13 August 2026.

The release notes / changelog will be published here soon...watch this space!

Expand the 'Assets' below to reveal the download links.

(build job: https://github.com/edrlab/thorium-reader/actions/runs/31718451257)

Assets 10

Thorium Desktop Reader v3.4.0 Latest

Latest

danielweck released this 09 Apr 00:20

v3.4.0

4744916

Summary

Version 3.4.0 was released on 08 April 2026.

This release includes the following (notable) new features, improvements and bug fixes:

Upgraded to Electron v41, Chromium v146, NodeJS v24
Updated translations
Fixed accessibility issues with screen reader heading hierarchy and keyboard tab cycling order
New feature: filtering and sorting directly in the publication "grid" mode of the library window (complements existing "table" view functionality)
New feature: favorite OPDS feed sorting
New feature: keyboard shortcut "export to HTML" function
Updated feature: the LCP passphrase input text field can now show unmasked clear text
Fixed OPDS "breadcrumb" user interface affordance
Fixed MathML support, MathJax could not be activated
Fixed a zoom issue with "fixed layout" / pre-paginated EPUBs
Fix in TTS readaloud and EPUB Media Overlays, the temporary disabling of popup footnotes wasn't being restored properly, as well as the notes highlights (annotations and bookmarks)
Fixed MacOS issue when bringing re-activating the application to bring the reader window into the foreground (over the library window)
Fixed "customization profiles" (new feature which was broken on Windows in version 3.3.0). Reminder: this feature offers an alternative to forking the Thorium Desktop codebase, via a plugin mechanism that declaratively expresses modifications to "vanilla" Thorium Desktop reader (color themes, bundled publications and feeds, application logo, etc.)
Fixed notification toasts which were sometimes incorrectly terminated
Fix: LCP passphrase prompt was incorrectly displayed when imported protected publications (directly as EPUB or via LCPL) were added and non-already existing in the bookshelf (but with an existing cached valid passphrase based on provider mapping)
Fix: network requests at application launch (i.e. telemetry ping and version check) could potentially delay the boot process and compromise the application "ready" state
Fixed bookshelf table layour, translated column headers.
Fix: in version 3.3.0 a more performant filesystem persistence of "notes" (i.e. annotations and bookmarks) was introduced, using a dedicated SQLite database separate from other scopes of application state. Backward compatibility with the JSON format of older versions of the application was preserved but this caused application shutdown to be very slow (sometimes even hanging and ultimately crashing). In version 3.4.0, the backward compatibility is removed and consequently users are advised to manually backup their notes when they wish to revert to an older version of Thorium Desktop reader
Fix: under the hood, further changes to filesystem persistence (i.e. preservation of application state) were introduced in order to improve performance and hopefully address rare data loss issues experienced by some Windows users. The user interface indicates missing publications and additional logging is now available for remote troubleshooting (user-accessible text files created in Thorium Desktop's application data folder). This is groundwork for a planned future feature that will allow users to store publications inside an arbitrary folder (this might be useful to address filesystem storage limitations, notably on Windows where a large amount of ebooks / audiobooks could cause the operating system to interfere with application data and potentially corrupt Thorium Desktop's internal database)

Assets 10

Thorium Desktop Reader v3.3.0

danielweck released this 09 Dec 23:28

v3.3.0

c45e2ac

Summary

Version 3.3.0 was released on 09 December 2025.

THIS RELEASE FIXES A CRITICAL SECURITY BUG. There is no known exploit in the wild, but the risk does exist and must be taken seriously. It is therefore extremely recommended to update Thorium Desktop reader and to stop using previous releases. The bugfix will not be "backported" to earlier versions.

This is a high-severity vulnerability in the sense that a successful attack would require no user interaction other than opening and reading an EPUB file containing malicious Javascript (for example by double-clicking on the EPUB from the file explorer, or by clicking on a web link associated with Thorium Desktop reader). If such hypothetical attack occured, it would likely be silent and hard to detect.

The security hole would allow malicious Javascript to escape the web browser sandbox and to run programs on the victim's computer. This type of attack is known as RCE "Remote Code Execution", which could potentially result in personal information being exfiltrated, backdoors being installed, files being deleted, etc.

The security hole was first discovered by Thorium Desktop developers, immediately followed by a wider audit of the potential attack surface across the application's software stack. This led to further security fixes listed in the itemized changelog below.

The vulnerability was also reported by security researchers who provided an example script to demonstrate the method. This will be documented and the reporters will be credited for their input. A detailed technical report will be published and kept up-to-date directly in the source code repository. Maintainers of Thorium Desktop forks will be strongly encouraged to integrate fixes in their own codebase.

Note that when EPUB publications are distributed by trusted publishers, it is unlikely that users might fall victims of such malicious EPUBs / Javascript. However, many e-books are distributed via alternative channels that could be targeted by ill-intentioned actors to exploit the vulnerabilities present in older Thorium Desktop releases. For this reason, it is strongly recommended to update the application.

This release includes the following (notable) new features, improvements and bug fixes:

Upgraded to Electron v38
Updated translations
New feature: "customization profiles". This offers an alternative to forking the Thorium Desktop codebase, via a plugin mechanism that declaratively expresses modifications to "vanilla" Thorium Desktop reader (color themes, bundled publications and feeds, application logo, etc.).
Fix: more performant filesystem persistence of "notes" (annotations and bookmarks) via a dedicated SQLite database, backward compatibility with the JSON format of older versions of the application (this currently causes a delay when the software closes, but this will be fixed in a near-future revision)
Fix: improved integration of OPDS with the local bookshelf, ability to navigate to the downloaded publication.
Fix: HTML tables that are constrained by the viewport height now take into account the zoom / font size.
Fix: pages.xml pagemap support, handling of encrypted resources (does not crash XML parser anymore)
Fix: page list GUI was crashing because of missing link title (page break name).
Fix(internationalization): locale-dependent date display.
Fix(OPDS): filter buy/borrow/subscribe links based on supported content type.
Fix(OPDS): authentication NONCE and ID handled identically, i.e. both present triggers the match check, any missing means that the check is skipped.
Fix(PDF): persistent user configuration for zoom level, layout, etc.
Feature(PDF): 2-page spread with even/odd user-configurable option.
Feature(TTS): faster speech rates are now available.
Fix(LCP): persisted hashed passphrase was not resolved correctly when importing from OPDS feeds due to lack of license provider information. Also fixed asynchronous filesystem input/output which was causing race conditions.
Fix(TTS): readaloud voice selection was broken when no language was specified in the HTML markup.
Fix(filesystem): cross-platform file naming rules / filename sanitization, was slugification which is for URLs and eliminates useful information (affects OPDS temporary file download, annotations and bookmarks notes export, publication save-as).
Fix(notes): annotations and bookmark import/export, handling of CSSSelector and ProgressionSelector.
Fix(OPDS): improved user interface, better catalog navigation experience.
Feature(OPDS): added login/logout button in catalog entries.
Fix(accessibility): screen reader detection was resulting in false positives because of keyboard utility apps (for example) so now assisitive technology continues to be automatically detected but users must explicitely activate support in global application settings.
Fix(regression): password-protected PDF files are now supported again (Mozilla PDF.js integration).
Fix(supply chain security): NPM packages now checked via Socket Firewall more regularly to verify direct and transitive dependencies. Also disabled package.json NPM install pre/post scripts execution to protect developer environments.
Fix(security): Electron Fuses cookie encrypt-on-write (Chromium store) and ASAR integrity check (Windows and Mac, no Linux support)
Fix(security): stricter permissions for notifications, clipboard, fullscreen, etc. in HTML webview renderer.
Fix(security): HTTP requests safeguard fence with isURL utility which explicitly prevents non-HTTP(S) links.
Fix(security): some type of hyperlink activation was causing the external web browser to open (keyboard modifiers).
Fix(security): stricter Electron webview partionning to manage individual browsing sessions.
Fix(security): disabled Javascript entirely in PDF files (Mozilla PDF.js integration).
Fix(security): additional downstream safeguards to prevent filesystem access above root folder for protocol handlers of ReadiumCSS and PDF.js (URL syntax is already implicitly normalised upstream to prevent ../../ backpaths, but better include some explicit redundancy)
Fix(security): serve publication UUID to webview instead of base64-encoded filesystem path in order to avoid leaking user home folder name in scripted contexts such as EPUB HTML documents (window.location).
Fix(security): more secure extraction of PDF cover images, via an Electron sandboxed webview and a context-isolated preload script.
Fix(security): OPDS feed authentication now defaults to the user's installed web browser instead of the internal webview (which remains available as a less-secure alternative fallback authentication flow, just in case operating-system integration of OPDS callback URL from external web browser into Thorium Desktop does not work as intended).
Fix(security): added redundant safeguards for Electron shell.openExternal() in application code, to prevent injection of unwanted behaviour from third-party content (e.g. publication metadata).

Assets 10

Thorium Reader v3.2.2

danielweck released this 19 Aug 09:42

v3.2.2

e4bd3c8

PLEASE DO NOT USE THIS OLD VERSION OF THORIUM - VERSION 3.3.0 (OR NEWER) IS HIGHLY RECOMMENDED AS THE RELEASE INCLUDES CRITICAL SECURITY FIXES (SEE THE CHANGELOG OF VERSION 3.3.0 FOR DETAILS).

Summary

Version 3.2.2 was released on 19 August 2025

This release includes the following (notable) new features, improvements and bug fixes:

Upgraded to the Electron v37 revision which fixes the screen reader detection regression introduced in Thorium v3.2.1
Fixed accessibility issues related to previous/next backward/forward GUI buttons (labelling and semantic region containers for screen readers, and inert/disabled commands)
Updated translations

Assets 10

Uh oh!

Releases: edrlab/thorium-reader

Release list

latest-windows-intel automated test build

Uh oh!

latest-windows-arm automated test build

Uh oh!

latest-macos-intel automated test build

Uh oh!

latest-macos-arm automated test build

Uh oh!

latest-linux-intel automated test build

Uh oh!

latest-linux-arm automated test build

Uh oh!

Thorium Desktop reader v3.5.0-rc.1

Uh oh!

Thorium Desktop Reader v3.4.0

Summary

Uh oh!

Thorium Desktop Reader v3.3.0

Summary

Uh oh!

Thorium Reader v3.2.2

Summary

Uh oh!