v147 · Isolated Web Apps · Security

WebRequest.SecurityInfo in Controlled Frame

Chrome 145 adds SecurityInfo data to the webRequest API inside ControlledFrame — the IWA equivalent of <webview>. An Isolated Web App can now intercept an HTTPS request, retrieve the server's verified TLS certificate fingerprint, and use it to authenticate a parallel raw TCP/UDP connection to the same host.

concepts

  1. API Explorer

    Walkthrough of the webRequest event lifecycle and the documented details.securityInfo shape. Shows why the certificate fingerprint must be captured from onHeadersReceived with the securityInfo extra info key. Available in Isolated Web App context only.

  2. Certificate Flow

    Animated diagram of the two-connection pattern: HTTPS request through ControlledFrame retrieves the cert fingerprint; a Direct Sockets TCP/UDP connection to the same host verifies against that fingerprint. Illustrates why this pattern is needed and where SecurityInfo fits.

  3. TLS Grade Inspector

    Simulates details.securityInfo responses — secure, raw DER requested, missing extraInfoSpec, broken TLS, and weak state — and shows whether an IWA can safely use the browser-verified fingerprint as a Direct Socket trust anchor.

  4. TLS Certificate Audit

    Full audit tool that reads SecurityInfo from chrome.webRequest.onHeadersReceived and grades each documented requirement independently — object presence, secure state, certificate list, SHA-256 fingerprint, and optional raw DER bytes.

  5. Compatibility Lab

    Checks whether the exact Controlled Frame webRequest.onHeadersReceived SecurityInfo hook is available, then exercises documented fallback states for non-IWA pages.

why it shipped

Isolated Web Apps sometimes need to establish raw TCP or UDP connections using the Direct Sockets API — for legacy protocols, proprietary hardware, or low-latency scenarios where HTTP overhead is too high. Unlike HTTPS, raw TCP/UDP connections have no built-in certificate verification. Before Chrome 145, there was no way for an IWA to confirm that the server it connected to via Direct Sockets was the same one it was already talking to over HTTPS. WebRequest.SecurityInfo solves this: intercept the HTTPS preflight through ControlledFrame, obtain the browser-verified certificate fingerprint, then compare it against the raw TLS handshake on the Direct Socket. This gives IWA developers a trust anchor for raw connections without requiring a custom PKI or out-of-band key distribution.

platform scope

This feature is part of the Isolated Web Apps platform, available only to installed IWAs running in standalone mode on ChromeOS. The ControlledFrame API (which hosts the webRequest listener) is not available in regular browser tabs or installed PWAs.

references