diff --git a/apps/desktop/package-lock.json b/apps/desktop/package-lock.json
index 2971b904..e80b04f6 100644
--- a/apps/desktop/package-lock.json
+++ b/apps/desktop/package-lock.json
@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "license": "MIT",
       "devDependencies": {
-        "electron": "42.11.9",
+        "electron": "42.11.18",
         "electron-builder": "26.15.3"
       }
     },
@@ -1449,9 +1449,9 @@
       }
     },
     "node_modules/electron": {
-      "version": "42.11.9",
-      "resolved": "https://registry.npmjs.org/electron/-/electron-42.11.9.tgz",
-      "integrity": "sha512-vPTlQws45virTh1jb/dSROz6xGkXgtEcdyT5n+0+etCmHqMtvp4Pgs6Sx5bvna+AEDAMeq10uRcjdMKCTk2Gtw==",
+      "version": "42.11.18",
+      "resolved": "https://registry.npmjs.org/electron/-/electron-42.11.18.tgz",
+      "integrity": "sha512-hbzodG06x/l7uq+oeyob5ugv6qZBmJRWC7Uto5QEE99xSHUARz6d+++Rz+79T/ssTYTQkONW4ciTTcJuAbXKIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 7fc4bafd..316a60ab 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -26,7 +26,7 @@
     "dist:linux": "node scripts/prepare-runtime.mjs && node scripts/prepare-build.mjs && electron-builder --config electron-builder.yml --linux --x64 --publish never"
   },
   "devDependencies": {
-    "electron": "42.11.9",
+    "electron": "42.11.18",
     "electron-builder": "26.15.3"
   }
 }
diff --git a/tests/desktop/release-packaging.test.mjs b/tests/desktop/release-packaging.test.mjs
index 272398b1..baf71572 100644
--- a/tests/desktop/release-packaging.test.mjs
+++ b/tests/desktop/release-packaging.test.mjs
@@ -12,6 +12,7 @@ import { resolveLocalesDir } from '../../apps/desktop/src/main/i18n.mjs';
 const here = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(here, '..', '..');
 const desktopPackage = JSON.parse(readFileSync(join(repoRoot, 'apps', 'desktop', 'package.json'), 'utf-8'));
+const desktopLock = JSON.parse(readFileSync(join(repoRoot, 'apps', 'desktop', 'package-lock.json'), 'utf-8'));
 const rootPackage = JSON.parse(readFileSync(join(repoRoot, 'package.json'), 'utf-8'));
 const electronBuilderYaml = readFileSync(join(repoRoot, 'apps', 'desktop', 'electron-builder.yml'), 'utf-8');
 
@@ -168,3 +169,36 @@ describe('R4.2 Debian 元数据契约', () => {
     expect(yamlScalar(linux, 'artifactName')).toBe('Mebular-${version}-${arch}.${ext}');
   });
 });
+
+// R4.3：Electron < 42.11.16 存在高危证书校验 advisory，修复版本 42.11.18；
+// Electron 虽在 devDependencies，但会被 electron-builder 打进安装包，故锁定精确版本并设下限。
+describe('R4.3 Electron 安装包版本下限', () => {
+  const MINIMUM_ELECTRON = '42.11.18';
+
+  function parseVersion(value) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(String(value));
+    return match ? match.slice(1, 4).map(Number) : null;
+  }
+
+  function compareVersions(left, right) {
+    const a = parseVersion(left);
+    const b = parseVersion(right);
+    if (!a || !b) return NaN;
+    for (let i = 0; i < 3; i += 1) {
+      if (a[i] !== b[i]) return a[i] - b[i];
+    }
+    return 0;
+  }
+
+  it('electron 是精确版本且不低于 42.11.18（不含 ^/~ 回退空间）', () => {
+    const electron = desktopPackage.devDependencies?.electron;
+    expect(electron).toMatch(/^\d+\.\d+\.\d+$/);
+    expect(compareVersions(electron, MINIMUM_ELECTRON)).toBeGreaterThanOrEqual(0);
+  });
+
+  it('package-lock 中 electron 与 package.json 一致', () => {
+    const locked = desktopLock.packages?.['node_modules/electron']?.version;
+    expect(locked).toBe(desktopPackage.devDependencies.electron);
+    expect(compareVersions(locked, MINIMUM_ELECTRON)).toBeGreaterThanOrEqual(0);
+  });
+});