# Wails 3.0 reaches stable release with a new Go desktop architecture — mobile remains experimental Wails 3.0 is generally available after years of development, replacing its v2 context-bound runtime with explicit Go services, windows, events and generated bindings. It adds desktop packaging, an updater and an MCP testing service, but migration is a port and iframe bridge limitations remain. The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern. - Status: Active - Published: 2026-10-27T06:12:51+13:00 - Updated: 2026-10-27T06:12:51+13:00 - Categories: Web Development, Frameworks, Developer Tools - Tags: desktop apps, Go, open source, Wails, WebView - Canonical HTML: https://beyondthe.news/dossiers/wails-3-stable-go-desktop-multiwindow-mobile-migration ## What changed On October 26, 2026, the Wails maintainers published v3.0.0 as a stable release. It is a ground-up redesign of the Go-plus-web-frontend desktop framework: multiple independent windows, service objects with lifecycle hooks, typed events, statically generated JS/TS bindings, native menus and tray, desktop signing/packaging, built-in update flow and an MCP service for app testing. Windows, macOS and Linux are in the desktop stability contract; iOS/Android are experimental. The Go minimum is 1.26, GTK4/WebKitGTK 6.0 is the Linux default, and moving from v2 requires a real code port rather than changing the dependency version. The release warns that certain same-origin and HTTP child-frame paths can still reach bound Go methods. ## Why it matters Wails provides a native-WebView alternative to bundling an entire browser for Go-backed desktop applications. Version 3 changes how applications are structured, built, updated and tested, making previously awkward multi-window, tray and service workflows first-class. But it also introduces significant migration work, a newer Go toolchain requirement and security boundaries developers must understand before embedding untrusted content. The experimental mobile support is an opportunity for shared code, not a production stability promise. No independent cross-platform benchmark or reliability study is available to validate all release claims. ## The application and binding model is rewritten Wails v3 applications explicitly register Go services, windows, managers and events. Exported Go methods become callable from web frontends via static-analysis-generated TypeScript or JavaScript bindings, preserving names, comments and enums. A v2 app needs lifecycle and service changes plus regenerated bindings; the old context-bound runtime is not drop-in compatible. ## Desktop features and build distribution Stable targets are Windows amd64/arm64, macOS Intel/Apple Silicon and Linux amd64/arm64. Linux defaults to GTK4/WebKitGTK 6.0, with legacy GTK3 available using -tags gtk3 until v3.1. Features include multiwindow, system tray, native dialogs, keyboard shortcuts, drag-and-drop, notifications, code signing, platform installers and an in-app updater with cryptographic verification and rollback. Taskfile-based builds and wails3 setup/doctor make the toolchain more inspectable. ## Mobile, server and AI testing iOS and Android builds share much application/frontend code but are explicitly experimental and outside the desktop compatibility promise. The same services can also run as a headless HTTP server. An optional MCP service lets AI tooling inspect and drive a running Wails app for testing; this is a testing surface, not a reason to expose an app's privileged methods to untrusted clients. ## Security caveats matter at the WebView boundary The v3.0.0 release fixes several published v3 issues but notes GHSA-2p5f-2gx8-mh8m is only partly addressed. On Linux, same-origin child frames (including srcdoc/about:blank) may reach the native handler through their parent; cross-origin frames are blocked. On experimental Android, the window.wails bridge is exposed to every WebView frame pending a planned fix. Across platforms, bound-method calls from child frames can use /wails/runtime over HTTP; treat any embedded iframe as capable of calling exposed Go methods. Avoid untrusted iframe content and apply least privilege to bindings. ## Migration and maintenance Install with go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0; Go 1.26+ is required, with recent security-patched Go toolchains recommended. The v2 and v3 CLIs/module paths are separate and can coexist; v2 still receives critical updates. v3 will use weekly minor releases, nightly prereleases and patch hotfixes. Pin matching @wailsio/runtime and CLI versions for reproducible production builds. ## Key details - Wails v3.0.0 GA published October 26, 2026 (GitHub Releases). - Stable desktop targets: Windows, macOS, Linux; Android and iOS experimental. - Go 1.26+ required; Linux GTK4/WebKitGTK 6.0 default, GTK3 legacy only through v3.0.x. - Major architectural port from v2: explicit Go services, window lifecycle, event model and generated JS/TS bindings. - Native desktop packaging, signed updater with rollback, multiwindow/tray and MCP test service included. - Known WebView child-frame bridge limits persist; GHSA-2p5f-2gx8-mh8m only partly fixed. ## Builder takeaways - Treat v2-to-v3 as a migration project: port service/lifecycle code, regenerate bindings and test each target OS. - Use recent patched Go 1.26/1.27 versions and pin Wails CLI and @wailsio/runtime versions together. - Keep untrusted HTML and third-party iframes out of privileged Wails windows; bound Go methods may be reachable from child frames. - Do not assume mobile stability from the desktop GA label; test experimental Android/iOS separately. - Review Linux GTK4 dependencies and desktop packaging/updater rollback paths before shipping. ## What to watch - Wails 3.0.1 fix for experimental Android bridge exposure and closure of GHSA-2p5f-2gx8-mh8m. - v3.1 removal of GTK3 legacy path and weekly release compatibility. - Independent production migration and performance reports across Windows/macOS/Linux. - Mobile stabilization and future supported-platform contract. ## Uncertainties - Maintainer release notes are the primary source; independent compatibility/performance testing is not yet established. - Mobile support is experimental and security/feature parity varies by platform. - Certain child-frame native bridge risks remain documented and must be addressed in application design. ## Sources - [Wails v3.0.0 release](https://github.com/wailsapp/wails/releases/tag/v3.0.0) — Wails maintainers · primary_release · 2026-10-26T00:00:00+13:00. Official GA release, platform support, migration and known security limits; verified via GitHub Releases API. - [Wails v3 roadmap and stable desktop compatibility contract](https://wails.io/status/) — Wails · primary_documentation · 2026-10-26T00:00:00+13:00. Official stable target and experimental mobile distinction. - [Wails v3.0.0 release mirror](https://newreleases.io/project/github/wailsapp/wails/release/v3.0.0) — NewReleases · independent_release_mirror · 2026-10-26T00:00:00+13:00. Corroborates tag publication and release text, not independent testing.