From 792212e1dc1e6379918cc7cd6b4d5de51e7c7f81 Mon Sep 17 00:00:00 2001 From: Mason Williams Date: Mon, 2 Mar 2026 14:26:13 -0500 Subject: [PATCH] Disable passkey autofill popup in browser VMs The WebAuthn Conditional UI ("Use passkey from another device") overlay appears on login form inputs and blocks CUA click actions during managed auth flows. Disable it via the WebAuthenticationConditionalUI feature flag. - Headless: added to the existing --disable-features list in wrapper.sh - Headful: added to chromium-launcher hardcoded args (headful doesn't set CHROMIUM_FLAGS, so this is the only --disable-features it gets) Made-with: Cursor --- images/chromium-headless/image/wrapper.sh | 2 +- server/cmd/chromium-launcher/main.go | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/images/chromium-headless/image/wrapper.sh b/images/chromium-headless/image/wrapper.sh index 9937e3cf..897fe5e7 100755 --- a/images/chromium-headless/image/wrapper.sh +++ b/images/chromium-headless/image/wrapper.sh @@ -62,7 +62,7 @@ if [ -z "${CHROMIUM_FLAGS:-}" ]; then --disable-crash-reporter \ --disable-crashpad \ --disable-dev-shm-usage \ - --disable-features=AcceptCHFrame,AutoExpandDetailsElement,AvoidUnnecessaryBeforeUnloadCheckSync,CertificateTransparencyComponentUpdater,DeferRendererTasksAfterInput,DestroyProfileOnBrowserClose,DialMediaRouteProvider,ExtensionManifestV2Disabled,GlobalMediaControls,HttpsUpgrades,ImprovedCookieControls,LazyFrameLoading,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Translate \ + --disable-features=AcceptCHFrame,AutoExpandDetailsElement,AvoidUnnecessaryBeforeUnloadCheckSync,CertificateTransparencyComponentUpdater,DeferRendererTasksAfterInput,DestroyProfileOnBrowserClose,DialMediaRouteProvider,ExtensionManifestV2Disabled,GlobalMediaControls,HttpsUpgrades,ImprovedCookieControls,LazyFrameLoading,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,Translate,WebAuthenticationConditionalUI \ --disable-field-trial-config \ --disable-gcm-registration \ --disable-gpu \ diff --git a/server/cmd/chromium-launcher/main.go b/server/cmd/chromium-launcher/main.go index 8c83ece5..6aad6056 100644 --- a/server/cmd/chromium-launcher/main.go +++ b/server/cmd/chromium-launcher/main.go @@ -62,6 +62,7 @@ func main() { "--user-data-dir=/home/kernel/user-data", "--password-store=basic", "--no-first-run", + "--disable-features=WebAuthenticationConditionalUI", } if *headless { chromiumArgs = append([]string{"--headless=new"}, chromiumArgs...)