Skip to content

Enable the CEF sandbox for Windows browser subprocesses #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
summeroff wants to merge 2 commits into from
Closed

Enable the CEF sandbox for Windows browser subprocesses #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9377dc1
Enable the CEF sandbox for Windows browser subprocesses
summeroff Sep 18, 2026
f44c9c1
Harden CEF sandbox initialization paths
summeroff Sep 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/pr-pull.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ on:
pull_request:
paths-ignore:
- '**.md'
branches: [master]
branches: [master, streamlabs]
types: [ opened, synchronize, reopened ]
permissions:
contents: read
Expand Down
26 changes: 11 additions & 15 deletions browser-app.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,16 +80,14 @@ void BrowserApp::OnBeforeChildProcessLaunch(CefRefPtr<CefCommandLine> command_li
std::lock_guard<std::mutex> guard(flag_mutex);
if (this->media_flag != -1) {
if (this->media_flag) {
command_line->AppendSwitchWithValue(
"enable-media-stream", "1");
command_line->AppendSwitchWithValue("enable-media-stream", "1");
}
this->media_flag = -1;
} else if (this->media_flags.size()) {
bool flag = media_flags.front();
media_flags.pop();
if (flag) {
command_line->AppendSwitchWithValue(
"enable-media-stream", "1");
command_line->AppendSwitchWithValue("enable-media-stream", "1");
}
}
}
Expand Down Expand Up @@ -131,16 +129,14 @@ void BrowserApp::OnBeforeCommandLineProcessing(const CefString &, CefRefPtr<CefC
std::lock_guard<std::mutex> guard(flag_mutex);
if (this->media_flag != -1) {
if (this->media_flag) {
command_line->AppendSwitchWithValue(
"enable-media-stream", "1");
command_line->AppendSwitchWithValue("enable-media-stream", "1");
}
this->media_flag = -1;
} else if (this->media_flags.size()) {
bool flag = media_flags.front();
media_flags.pop();
if (flag) {
command_line->AppendSwitchWithValue(
"enable-media-stream", "1");
command_line->AppendSwitchWithValue("enable-media-stream", "1");
}
}
command_line->AppendSwitchWithValue("remote-debugging-port", "9222");
Expand All @@ -152,13 +148,13 @@ void BrowserApp::OnBeforeCommandLineProcessing(const CefString &, CefRefPtr<CefC
#endif
}

std::vector<std::string> exposedFunctions = {"getControlLevel", "getCurrentScene", "getStatus",
"startRecording", "stopRecording", "startStreaming",
"stopStreaming", "pauseRecording", "unpauseRecording",
"startReplayBuffer", "stopReplayBuffer", "saveReplayBuffer",
"startVirtualcam", "stopVirtualcam", "getScenes",
"setCurrentScene", "getTransitions", "getCurrentTransition",
"setCurrentTransition","messageFromApp", "messageToApp"};
std::vector<std::string> exposedFunctions = {"getControlLevel", "getCurrentScene", "getStatus",
"startRecording", "stopRecording", "startStreaming",
"stopStreaming", "pauseRecording", "unpauseRecording",
"startReplayBuffer", "stopReplayBuffer", "saveReplayBuffer",
"startVirtualcam", "stopVirtualcam", "getScenes",
"setCurrentScene", "getTransitions", "getCurrentTransition",
"setCurrentTransition", "messageFromApp", "messageToApp"};

void BrowserApp::OnContextCreated(CefRefPtr<CefBrowser> browser, CefRefPtr<CefFrame>, CefRefPtr<CefV8Context> context)
{
Expand Down
4 changes: 3 additions & 1 deletion browser-app.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,9 @@ class BrowserApp : public CefApp, public CefRenderProcessHandler, public CefBrow

public:
#if defined(__APPLE__) || defined(_WIN32)
inline BrowserApp(bool shared_texture_available_ = false) : shared_texture_available(shared_texture_available_), media_flag(-1)
inline BrowserApp(bool shared_texture_available_ = false)
: shared_texture_available(shared_texture_available_),
media_flag(-1)
#else
inline BrowserApp(bool shared_texture_available_ = false, bool wayland_ = false)
: shared_texture_available(shared_texture_available_),
Expand Down
3 changes: 2 additions & 1 deletion browser-client.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,7 +290,8 @@ bool BrowserClient::OnProcessMessageReceived(CefRefPtr<CefBrowser> browser, CefR
json = (int)webpage_control_level;
} else if (name == "messageToApp") {
const std::string message = input_args->GetString(1).ToString();
blog(LOG_INFO, "[BrowserMessage] messageToApp called: arguments %zu, arg2 %s", input_args->GetSize(), message.c_str());
blog(LOG_INFO, "[BrowserMessage] messageToApp called: arguments %zu, arg2 %s",
input_args->GetSize(), message.c_str());
std::lock_guard<std::mutex> lock(bs->messagesToAppMutex);
bs->messagesToApp.push_back(message);
}
Expand Down
42 changes: 37 additions & 5 deletions cmake/os-windows.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
target_compile_options(obs-browser PRIVATE $<IF:$<CONFIG:DEBUG>,/MTd,/MT>)
target_compile_definitions(obs-browser PRIVATE ENABLE_BROWSER_SHARED_TEXTURE)
set_property(TARGET obs-browser PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
target_compile_definitions(
obs-browser
PRIVATE ENABLE_BROWSER_SHARED_TEXTURE $<$<CONFIG:Debug>:NDEBUG>
$<$<CONFIG:Debug>:_HAS_ITERATOR_DEBUGGING=0>)
target_compile_options(obs-browser PRIVATE $<$<CONFIG:Debug>:/U_DEBUG>)

target_link_libraries(obs-browser PRIVATE CEF::Wrapper CEF::Library d3d11 dxgi)
target_link_options(obs-browser PRIVATE /IGNORE:4099)
Expand All @@ -10,14 +14,24 @@ add_executable(OBS::browser-helper ALIAS obs-browser-helper)
target_sources(
obs-browser-helper
PRIVATE # cmake-format: sortable
browser-app.cpp browser-app.hpp cef-headers.hpp obs-browser-page.manifest
browser-app.cpp browser-app.hpp cef-headers.hpp obs-browser-page.manifest obs-browser-sandbox.h
obs-browser-subprocess-win.cpp obs-browser-subprocess-win.hpp
obs-browser-page/obs-browser-page-main.cpp)

target_sources(obs-browser PRIVATE obs-browser-sandbox.h obs-browser-subprocess-win.cpp
obs-browser-subprocess-win.hpp obs-browser-sandbox-selection.cpp
obs-browser-sandbox-selection.hpp)

target_include_directories(obs-browser-helper PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}/deps"
"${CMAKE_CURRENT_SOURCE_DIR}/obs-browser-page")

target_compile_options(obs-browser-helper PRIVATE $<IF:$<CONFIG:DEBUG>,/MTd,/MT>)
target_compile_definitions(obs-browser-helper PRIVATE ENABLE_BROWSER_SHARED_TEXTURE)
target_compile_features(obs-browser-helper PRIVATE cxx_std_17)
set_property(TARGET obs-browser-helper PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
target_compile_definitions(
obs-browser-helper
PRIVATE ENABLE_BROWSER_SHARED_TEXTURE $<$<CONFIG:Debug>:NDEBUG>
$<$<CONFIG:Debug>:_HAS_ITERATOR_DEBUGGING=0>)
target_compile_options(obs-browser-helper PRIVATE $<$<CONFIG:Debug>:/U_DEBUG>)

target_link_libraries(obs-browser-helper PRIVATE CEF::Wrapper CEF::Library nlohmann_json::nlohmann_json)
target_link_options(obs-browser-helper PRIVATE /IGNORE:4099 /SUBSYSTEM:WINDOWS)
Expand All @@ -34,3 +48,21 @@ set_target_properties_obs(

#make it dependence for obs-browser
add_dependencies(obs-browser obs-browser-helper)

if(BUILD_TESTING)
include(CTest)

add_executable(obs-browser-sandbox-selection-test)
target_sources(
obs-browser-sandbox-selection-test
PRIVATE obs-browser-sandbox-selection.cpp obs-browser-sandbox-selection.hpp
tests/obs-browser-sandbox-selection-test.cpp)
target_include_directories(obs-browser-sandbox-selection-test PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}")
target_compile_features(obs-browser-sandbox-selection-test PRIVATE cxx_std_17)
set_property(TARGET obs-browser-sandbox-selection-test PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded")
target_compile_definitions(
obs-browser-sandbox-selection-test
PRIVATE $<$<CONFIG:Debug>:NDEBUG> $<$<CONFIG:Debug>:_HAS_ITERATOR_DEBUGGING=0>)
target_compile_options(obs-browser-sandbox-selection-test PRIVATE $<$<CONFIG:Debug>:/U_DEBUG>)
add_test(NAME obs-browser-sandbox-selection-test COMMAND obs-browser-sandbox-selection-test)
endif()
65 changes: 4 additions & 61 deletions obs-browser-page/obs-browser-page-main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,21 +18,17 @@

#include "cef-headers.hpp"
#include "browser-app.hpp"
#include "obs-browser-subprocess-win.hpp"

#ifdef _WIN32
#include <windows.h>
#include <string>
#include <thread>

// GPU hint exports for AMD/NVIDIA laptops
#ifdef _MSC_VER
extern "C" __declspec(dllexport) DWORD NvOptimusEnablement = 1;
extern "C" __declspec(dllexport) int AmdPowerXpressRequestHighPerformance = 1;
#endif

static HANDLE shutdown_event = nullptr;
static bool thread_initialized = false;

DECLARE_HANDLE(OBS_DPI_AWARENESS_CONTEXT);
#define OBS_DPI_AWARENESS_CONTEXT_UNAWARE ((OBS_DPI_AWARENESS_CONTEXT)-1)
#define OBS_DPI_AWARENESS_CONTEXT_SYSTEM_AWARE ((OBS_DPI_AWARENESS_CONTEXT)-2)
Expand All @@ -51,55 +47,15 @@ static bool SetHighDPIv2Scaling()
return !!func(OBS_DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2);
}

static void shutdown_check_thread(DWORD parent_pid, DWORD main_thread_id)
{
HANDLE parent = OpenProcess(SYNCHRONIZE, false, parent_pid);
if (!parent) {
return;
}

HANDLE handles[2] = {parent, shutdown_event};

DWORD ret = WaitForMultipleObjects(2, handles, false, INFINITE);
if (ret == WAIT_OBJECT_0) {
PostThreadMessage(main_thread_id, WM_QUIT, 0, 0);
ret = WaitForSingleObject(shutdown_event, 5000);
if (ret != WAIT_OBJECT_0) {
TerminateProcess(GetCurrentProcess(), (UINT)-1);
}
}

CloseHandle(parent);
}

int CALLBACK WinMain(HINSTANCE, HINSTANCE, LPSTR, int)
{
PROCESS_POWER_THROTTLING_STATE PowerThrottling;
PowerThrottling.Version = PROCESS_POWER_THROTTLING_CURRENT_VERSION;
PowerThrottling.ControlMask = PROCESS_POWER_THROTTLING_IGNORE_TIMER_RESOLUTION;
PowerThrottling.StateMask = 0;

SetProcessInformation(GetCurrentProcess(), ProcessPowerThrottling, &PowerThrottling, sizeof(PowerThrottling));

std::thread shutdown_check;

CefMainArgs mainArgs(nullptr);
#if CHROME_VERSION_BUILD < 5615
if (!SetHighDPIv2Scaling())
CefEnableHighDPISupport();
#endif

CefRefPtr<CefCommandLine> command_line = CefCommandLine::CreateCommandLine();
command_line->InitFromString(::GetCommandLineW());

std::string parent_pid_str = command_line->GetSwitchValue("parent_pid");
std::string current_pid = std::to_string(GetCurrentProcessId());
if (!parent_pid_str.empty()) {
shutdown_event = CreateEvent(nullptr, true, false, nullptr);
DWORD parent_pid = (DWORD)std::stoi(parent_pid_str);
shutdown_check = std::thread(shutdown_check_thread, parent_pid, GetCurrentThreadId());
thread_initialized = true;
}
return ExecuteBrowserSubprocess(nullptr);
}

#else
#if defined(NO_STACK_PROTECTOR)
Expand All @@ -113,22 +69,9 @@ int main(int argc, char *argv[])
return 1;
#endif
CefMainArgs mainArgs(argc, argv);
#endif
CefRefPtr<BrowserApp> mainApp(new BrowserApp());

int ret = CefExecuteProcess(mainArgs, mainApp.get(), NULL);

#ifdef _WIN32
/* chromium browser subprocesses actually have TerminateProcess called
* on them for whatever reason, so it's unlikely this code will ever
* get called, but better to be safe than sorry */
if (thread_initialized) {
SetEvent(shutdown_event);
shutdown_check.join();
}
if (shutdown_event) {
CloseHandle(shutdown_event);
}
#endif
return ret;
}
#endif
Loading
Loading