low integrity process under Win 7/2008R2 - WebView2 creation failure

[szz743]

Hello,

Got a problem with low integrity process creating WebVuew2 object. My low integrity process can create WebView2 objects just fine under all OS-es from Win 8 workstation up to 2022 servers, but fails under Win 7 and 2008 r2 server..
CreateCoreWebView2Controller returns S_OK on those OS-es but the callback later fails with "access is denied" error.
I debugged the problem down to EmbeddedBrowserWebView!base::LaunchNonElevatedProcess which creates ShellWindows COM object.

5fac6711 6800c2be5f      push    offset EmbeddedBrowserWebView!_GUID_85cb6900_4d95_11cf_960c_0080c7f4ee85 (5fbec200)
5fac6716 6a04            push    4
5fac6718 6a00            push    0
5fac671a 68a451bb5f      push    offset EmbeddedBrowserWebView!CLSID_ShellWindows (5fbb51a4)
5fac671f ff1528e5c35f    call    dword ptr [EmbeddedBrowserWebView!_imp__CoCreateInstance (5fc3e528)]
5fac6725 85c0            test    eax,eax
5fac6727 0f88ec010000    js      EmbeddedBrowserWebView!base::LaunchNonElevatedProcess+0x329 (5fac6919)

0:002> dt 5fbec200 _GUID
ole32!_GUID
 {85cb6900-4d95-11cf-960c-0080c7f4ee85}

CoCreateInstance call is the cause of "access is denied" error. which gets propagated up to the callback.
Interesting is that this COM object does not even get created on other OS-es

Changing process to be "medium level" helps resolving the problem but that is not a solution.
ActiveX based IE engine works fine in the same scenarios.

Any advise how to resolve or workaround the problem?
thanks!

[szz743]

EdgeView2 clearly uses different method to start msedgewebview2.exe processes on Win7. If you kill eplorer.exe then EdgeVeiw2 controller creation fails with error "Class not registered", this does not happen on other Windows versions. "Class not registered" comes from the same IShellWindows interface creation failure. Looks like it is hosted in explorer.ee, which now explains "access is denied" error - low integrity process cannot communicate to high integrity explorer.exe process via COM.

It seems there is no any workaround until IShellWidows interface usage is eliminated from EdgeView2.
Am I right?

[LiangTheDev]

On Win7, if the application is in a job that doesn't allow child processes to breakaway, we have to launch webview browser process through explorer so that Chromium's sandboxing for child browser process works. That is why IShellWidows is used. On later Windows version, nested jobs are supported and there is no such restriction.
If you could change the job to allow breakaway (JOB_OBJECT_LIMIT_BREAKAWAY_OK), then WebView2 will not use explorer to launch webview browser process.
WebView2 runs remote webview code in a very locked down sandboxed process, and the need to run the host app with low IL is not as important. Another option would be to run the app with medium IL, if you trust the native code running in the app process.

[szz743]

OK. Thanks! That explains things, going with the medium IL for now.

[ibanvaqe]

Hi,

I have been reading this thread as I have the explorer.exe problem.

In my case, I am working with the webview2 runtime at publication RDP level. As the publication does not work with the explorer.exe, it cannot launch the IShellWindows, giving an unregistered class error. As you say this happens only with this operating system.

Is there any solution to make webview2 work at the RDP publication level?

[sln162]

@ibanvaqe

giving an unregistered class error

I am also concerned about this issue, and would like to ask which of the following error codes does this error refer to?
0x8002801D 0x80040154 0x800401FB 0x80040155

[ibanvaqe]

@ibanvaqe

giving an unregistered class error

I am also concerned about this issue, and would like to ask which of the following error codes does this error refer to? 0x8002801D 0x80040154 0x800401FB 0x80040155

The error I get is class not registered. 0x80040154

[sln162]

@ibanvaqe Thank you for your information, according to our existing error reports, the error 0x80040154 only appears on Win7.

[ibanvaqe]

@sln162 Is there a solution for this issue?

Or is it better to use a superior Windows OS?

[sln162]

@ibanvaqe There is no good way, win7 will stop supporting it as of 109.