Windows: Remove WebView2-specific logic

[seldoff]

Asana Task/Github Issue: https://app.asana.com/1/137249556945/project/72649045549333/task/1213744797153210?focus=true

Description

Windows: Remove WebView2-specific logic from injected/src/features/ua-ch-brands.js and injected/src/features/windows-permission-usage.js.

Testing Steps

N/A

Checklist

Please tick all that apply:

• I have tested this change locally
• I have tested this change locally in all supported browsers
• This change will be visible to users
• I have added automated tests that cover this change
• I have ensured the change is gated by config
• This change was covered by a ship review
• This change was covered by a tech design
• Any dependent config has been merged

---

Note

Medium Risk
Changes UA-CH brand spoofing and Windows permission instrumentation behavior by removing WebView2-specific filtering/deny paths, which could affect UA-CH output and nested-iframe permission handling on Windows. Risk is moderate because it alters runtime overrides of browser APIs used for privacy/permission signaling.

Overview
Removes WebView2-specific conditionals in Windows injected features.

ua-ch-brands is simplified to always append the configured brandName (default DuckDuckGo) using the Chromium version, and no longer supports the filterWebView2/overrideEdge settings or Edge/WebView2 brand filtering/replacement logic.

windows-permission-usage drops the isDdgWebView-based nested-iframe detection and stops denying geolocation.watchPosition / mediaDevices.getUserMedia in that scenario.

Related integration coverage for the overrideEdge: disabled scenario is removed (test page/config and Playwright spec case).

^{Written by Cursor Bugbot for commit b3af1f9. This will update automatically on new commits. Configure here.}

[github-actions]

[Beta] Generated file diff

Time updated: Mon, 30 Mar 2026 11:30:24 GMT

Android

    - android/adsjsContentScope.js

• android/autofillImport.js
• android/brokerProtection.js
• android/contentScope.js
• android/duckAiChatHistory.js
• android/duckAiDataClearing.js

File has changed

Apple

    - apple/contentScope.js

• apple/contentScopeIsolated.js
• apple/duckAiChatHistory.js
• apple/duckAiDataClearing.js

File has changed

Chrome-mv3

    - chrome-mv3/inject.js

File has changed

Firefox

    - firefox/inject.js

File has changed

Integration

    - integration/contentScope.js

File has changed

Windows

    - windows/contentScope.js

File has changed

[github-actions]

⚠️ Cursor review was not successful.

This PR requires a manual review and approval from a member of one of the following teams:

• @duckduckgo/content-scope-scripts-owners
• @duckduckgo/apple-devs
• @duckduckgo/android-devs
• @duckduckgo/team-windows-development
• @duckduckgo/extension-owners
• @duckduckgo/config-aor
• @duckduckgo/breakage-aor
• @duckduckgo/breakage

[cursor]

Web Compatibility Assessment

• injected/src/features/ua-ch-brands.js (init() and brand mutation path around shimUserAgentDataBrands() / applyBrandMutationsToList()), severity: warning

  • The PR removes overrideEdge and filterWebView2 setting checks and always applies brand mutation for enabled uaChBrands. This removes a per-site/per-config rollback lever and changes behavior even when config previously set overrideEdge: disabled.
  • This is a compatibility risk because domain-level config can no longer suppress brand modification without fully disabling the feature.

• injected/src/features/ua-ch-brands.js (brand append logic in applyBrandMutationsToList() and getHighEntropyValues fullVersionList mutation), severity: warning

  • Behavior changed from conditional replace/append to unconditional append when Chromium is present.
  • This can change list cardinality/order and can introduce duplicates for some custom brandName values, which is detectable by strict UA-CH parsers and anti-tamper logic.

• injected/integration-test/ua-ch-brands.spec.js (removed override-edge-disabled case), severity: info

  • The test that verified the disabled-override path was removed, so there is no integration coverage for backwards-compat handling of legacy config toggles.

Security Assessment

• injected/src/features/windows-permission-usage.js (removed nested-iframe guard in Geolocation.watchPosition and MediaDevices.getUserMedia proxy paths), severity: error

  • The previous explicit deny-path for nested frames was a defense for environments where nested iframe mediation was not possible.
  • Removing it broadens permission execution in nested frames. If any WebView2-like embedding path still exists, nested third-party frames may keep camera/mic/geolocation access without the native control guarantees that motivated the original guard.

• injected/src/features/ua-ch-brands.js, severity: info

  • No direct new message-bridge/origin-validation/global-capture vulnerabilities introduced in this diff.

Risk Level

High Risk — this PR changes runtime behavior of injected API overrides (userAgentData and permission proxies) and removes a prior nested-frame permission safety guard, with reduced rollback/test coverage.

Recommendations

1. Reintroduce a capability-gated nested-frame permission guard in windows-permission-usage unless runtime can prove nested frame mediation is supported.
2. Preserve backward-compatible config control for UA-CH mutation (e.g., temporary alias/migration for overrideEdge semantics) so problematic domains can be rolled back quickly.
3. Add dedupe/order guarantees in applyBrandMutationsToList() to avoid duplicate brands and keep deterministic UA-CH output contract.
4. Add integration coverage for nested iframe watchPosition/getUserMedia behavior and for legacy config compatibility scenarios removed in this PR.

  

_{Sent by Cursor Automation: Web compat and sec}

[laghee]

LGTM