You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: specs/IsEnhancedSecurityModeEnabled.md
+36-21Lines changed: 36 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,45 +1,60 @@
1
-
EnhancedSecurityMode
1
+
IsEnhancedSecurityModeEnabled
2
2
===
3
3
4
4
# Background
5
5
6
-
Enhanced Security Mode (ESM) is a Microsoft Edge security feature that reduces the risk of memory-related vulnerabilities by disabling JavaScript Just-in-Time (JIT) compilation and enabling additional operating system protections.
6
+
Enhanced Security Mode (ESM) is a Microsoft Edge security feature that reduces
7
+
the risk of memory-related vulnerabilities by disabling JavaScript Just-in-Time
8
+
(JIT) compilation and enabling additional operating system protections.
7
9
8
-
In WebView2, ESM is off by default to avoid performance impact. Host applications can enable ESM for stricter security when rendering untrusted or sensitive content. While this improves security, it may reduce JavaScript performance.
10
+
In WebView2, ESM is off by default to avoid performance impact. You can enable
11
+
ESM for stricter security when rendering untrusted sites. While this improves
12
+
security, it may reduce JavaScript performance.
9
13
10
14
In Microsoft Edge, ESM offers two levels:
11
15
12
-
- Balanced – Enabled only for unfamiliar sites based on browser usage patterns.
13
-
- Strict – Always enabled for all sites.
16
+
- Balanced – Enhanced security is used for unfamiliar sites based on browser usage patterns.
17
+
- Strict – Enhanced security is used for all sites.
Unlike Edge browser, WebView2 does not support heuristic-based "Balanced" level. Only two options are available: Off and Strict.
21
+
Unlike Microsoft Edge, WebView2 does not support the heuristic-based "Balanced"
22
+
level; only Off and Strict are available.
18
23
19
-
Currently, ESM level can only be configured via the `--sdsm-state` browser flag([see for more details](https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/webview-features-flags?tabs=dotnetcsharp)) at environment creation, applying globally to all profiles. There is no flexibility to modify the level at runtime.
24
+
Today, the ESM level in WebView2 can be set only at environment creation by using
25
+
the `--sdsm-state` browser feature flag ([webview2 browser flag docs](https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/webview-features-flags?tabs=dotnetcsharp)).
26
+
The setting applies globally to all profiles and cannot be changed at runtime.
20
27
21
-
This proposal introduces an API to enable or disable ESM and persist the configuration for a WebView2 profile within the user data folder.
28
+
This proposal introduces an API to enable or disable ESM and persist the configuration
29
+
for a WebView2 profile within the user data folder.
22
30
23
-
## CoreWebView2Profile.EnhancedSecurityMode
24
-
Enables or disables Enhanced Security Mode (ESM) for all WebView2 instances sharing the same profile. This property value is persisted for a WebView2 profile in the user data folder. The default value is false.
0 commit comments