ChromiumRTX is an unsupported research prototype that deliberately weakens the normal WebView2 security model. Its opt-in mode disables the GPU-process sandbox, permits a third-party native module, and injects a hook DLL into the Edge WebView2 GPU subprocess. These behaviors would be unacceptable defaults for a production browser.

Run it only on a development machine with work saved and with the bundled local test page. Do not use a personal browser profile, sign in to accounts, navigate to external or untrusted sites, or run it alongside anti-cheat or other software that prohibits process injection. The dedicated profile and navigation policy reduce accidental exposure but do not restore the disabled GPU sandbox.

Expected experimental hazards include:

• WebView2 GPU-process crashes and restarts;
• D3D12 device removal, graphics-driver reset, or lost GPU work;
• breakage after Edge, WebView2, Dawn, driver, or NGX updates;
• endpoint-security alerts caused by DLL injection and API detours; and
• local profile, log, or crash-dump data that may contain machine-specific paths, process identifiers, adapter information, or page content.

Back up important work, keep the test profile disposable, and redact diagnostic artifacts before sharing them.

Security reports are welcome when they concern the protections ChromiumRTX claims for its controlled experiment, including:

• escaping the native navigation allowlist or bundled-page content policy;
• unintended injection into a process other than the selected WebView2 GPU child;
• unsafe handling of the shared-memory protocol or host/page messages;
• memory corruption reachable through repository-supplied test inputs; or
• accidental inclusion or disclosure of credentials, proprietary binaries, or sensitive local files in the repository or release artifacts.

The following are outside the supported scope:

• using ChromiumRTX as a general-purpose browser enhancement or on arbitrary websites;
• bypassing browser, endpoint-security, anti-cheat, DRM, sandbox, or code-signing controls;
• injecting into Microsoft Edge, Chrome, games, or applications other than the repository's dedicated WebView2 experiment;
• attacks that require replacing the executable, hook DLL, bundled page, build dependencies, or local NGX files with attacker-controlled files; and
• the expected fact that administrator-level or same-user native code can tamper with this unsupported local experiment.

Out-of-scope does not mean safe or endorsed. It means the project is not designed for that use and will not accept features that expand into it.

Do not publish exploit details, proof-of-concept code, crash dumps, or sensitive logs in a GitHub issue.

Use GitHub's Security → Report a vulnerability private-reporting flow for this repository. If private vulnerability reporting is not enabled, open a minimal issue asking the maintainer to establish a private contact channel; do not include technical vulnerability details in that issue.

A useful private report includes:

• the affected commit and build configuration;
• Windows, WebView2 Runtime, GPU, and graphics-driver versions;
• whether NVIDIA NGX SDK support was enabled;
• a minimal reproduction using only the bundled page and test profile;
• the impact and the trust boundary crossed; and
• redacted logs or a crash trace, if they are necessary to reproduce the issue.

Please allow the maintainers time to reproduce and address the problem before public disclosure. Reports about an upstream component may need coordinated disclosure to that component's security team.

This repository should not contain NVIDIA runtime DLLs, the NVIDIA NGX SDK, RenoDX/ReShade add-ons, game files, generated build output, or local WebView2 profile data. If any such material appears in the repository or a release, report it privately and identify the path or artifact without redistributing the file.

Vulnerabilities in WebView2, Edge/Chromium, Dawn, D3D12, MinHook, NVIDIA NGX, the NVIDIA driver, ReShade, or RenoDX should also be reported to the appropriate upstream security contact. A ChromiumRTX report is still useful when the issue is caused by this project's integration code.