v150 · sub apps
Capability & context gate
The Sub Apps API binds to window only inside a secure Isolated Web App that has been granted the sub-apps permission policy, with the SubApps flag enabled. This probe checks each prerequisite live and tells you exactly which one is stopping the API here — instead of blaming your browser version.
To actually run Sub apps: on a ChromeOS device (other desktops work unofficially), enable
#enable-isolated-web-apps, #enable-isolated-web-app-dev-mode and #enable-sub-apps in chrome://flags, then install a signed Isolated Web App via chrome://web-app-internals and grant it the sub-apps permission policy. ChromeStatus (API, updated 2026-07-24) targets default-on at Chrome 152 (status text “Proposed”). Implementation/debug note: --enable-blink-features=SubApps also gates the runtime feature. On this ordinary https:// origin window.subApps is undefined by design.
Run the prerequisite probe
| Prerequisite | Status | What was measured |
|---|---|---|
| Press “Probe this context” to measure each prerequisite. | ||
No probe run yet.
what each gate measures
- Secure context —
window.isSecureContext. Sub apps require HTTPS / a trusted context. - Isolated-Web-App binding —
'subApps' in window. The interface is[IsolatedContext, SecureContext, RuntimeEnabled=SubApps], so its mere presence proves you are in an IWA with the flag on. - Permission policy —
document.featurePolicy.allowsFeature('sub-apps')when that introspection API exists.add()/remove()reject withSecurityErrorwhen the policy is missing. - Live method call — an actual
window.subApps.list(). We surface its resolved value or the exact exception, never a fabricated result.
code path
const secure = window.isSecureContext; // secure context?
const bound = 'subApps' in window; // IWA + SubApps flag?
const policy = document.featurePolicy?.allowsFeature?.('sub-apps');
if (bound && typeof window.subApps.list === 'function') {
try {
const installed = await window.subApps.list(); // the real call
// record<ManifestId, { appName }>
} catch (err) {
// SecurityError, NotSupportedError, OperationError, ...
}
}see also
implementation reference
Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗