v145 · Web APIs · Controlled Frame

WebRequest.SecurityInfo in Controlled Frame

Chrome 145 exposes WebRequest.SecurityInfo inside Controlled Frame (the successor to the deprecated Chrome Apps WebView), giving isolated web content inspectors access to TLS certificate details for requests made within the frame.

background

Controlled Frame is a Chrome API for enterprise applications that need to embed and control arbitrary web content — similar to WebView in native apps. The WebRequest API intercepts network requests inside the frame. SecurityInfo was previously available only in the Chrome Extensions WebRequest API; Chrome 145 brings it to Controlled Frame, allowing host apps to inspect TLS state for embedded content.

concepts

  1. Security Info Demo

    Shows the structure of WebRequest.SecurityInfo — certificate chain, TLS version, cipher suite, and validity state — for requests intercepted within a Controlled Frame.

  2. Controlled Frame Context

    What Controlled Frame is, how it differs from iframes and service workers, and the enterprise use cases that motivate SecurityInfo access.

  3. Cert Inspector

    Pick a real-world or pathological endpoint (self-signed, expired, weak TLS) and view how a controlled-frame integration would surface securityInfo — protocol, cipher suite, cert validity, CT.

  4. SecurityInfo Explorer

    Load one of four realistic presets (TLS 1.3, TLS 1.2 downgrade, broken/self-signed, expired cert) or paste any WebRequest.SecurityInfo JSON to explore every field — state, cipher suite, key exchange group, CT compliance, and the full certificate chain with expiry warnings.

the change

// Inside a Controlled Frame host app (Chrome 145+):
const frame = document.querySelector('controlledframe');

frame.request.onCompleted.addListener(
  async (details) => {
    if (details.url.startsWith('https:')) {
      // SecurityInfo now available in Controlled Frame (Chrome 145+)
      const secInfo = await frame.request.getSecurityInfo(
        details.requestId,
        { certificateInfo: 'full' }
      );

      console.log('TLS version:', secInfo.protocol);     // 'TLS 1.3'
      console.log('Cipher:', secInfo.cipherSuite);        // 'AES_128_GCM'
      console.log('Certificate:', secInfo.certificates[0].subject);
      console.log('Valid:', secInfo.state);               // 'secure' | 'broken' | 'insecure'
    }
  },
  { urls: ['<all_urls>'] }
);

references