v144 · isolated web apps-specific api

WebRequest.SecurityInfo in Controlled Frame

This feature introduces a WebRequest.SecurityInfo API for [ControlledFrame](https://developer.chrome.com/docs/iwa/controlled-frame). It allows a web app to intercept an HTTPS, WSS, or WebTransport request to a server, retrieve the server's certificate fingerprint (as verified by the browser), and then use that fingerprint to manually verify the certificate o

concepts

  1. TLS Inspector

    Controlled-Frame (IWA) gets the same securityInfo extension data Chrome's webRequest API exposes — useful for building debug overlays in kiosk-style apps.

  2. Certificate Inspector

    The motivating use case: kiosk / embedded-browser scenarios that need to inspect TLS chains for enterprise self-signed certs.

  3. Pinning Workbench

    Paste a pin set; the workbench simulates an incoming request and shows how the onSecurityInfo handler would resolve. Lets you tune your pin policy without a kiosk.

  4. Certificate Pinning Demo

    Step through the full certificate pinning workflow: intercept a request, read the fingerprint from securityInfo, compare it against a stored pin, and see the allow/block decision. Four scenarios — valid pin, fingerprint mismatch, expired cert, and planned rotation.

why it shipped

Web apps sometimes need to establish secure raw TCP/UDP connections (e.g., via Direct Sockets) for custom protocols, often to support legacy servers that cannot be updated to modern alternatives like WebTransport. Unlike standard HTTPS, these raw sockets don't have a built-in mechanism to verify the server's TLS certificate against a trusted root store.

references