Strict CFG on MS Edge breaks hardware acceleration on Nvidia cards

[benjamasu]

Product

Harden Windows Security Module

Does Your System Meet The Requirements?

• Yes, I acknowledge that I've read the requirements and my system meets them. 👍

Is your Windows Installation Genuine?

• Yes, I acknowledge that the installation media (such as ISO file) of the Windows OS I used was downloaded from the official Microsoft website and I didn't tamper or modify it. 💯

Have you used any other 3rd party tools to modify your Windows installation?

• If you used any other 3rd party tools to modify your Windows installation, they can be causing the problem you're experiencing.

Did You Read The Frequently Asked Questions?

• Yes, I've referred to the FAQs and my issue is not covered/explained in there.

Please Explain The Bug

The enabled by default Strict CFG breaks hardware acceleration in MS Edge. Seems like it affects all Chromium-based browsers, not only Edge.

Error Details

Edge GPU features status and log with Strict CFG enabled:

Graphics Feature Status
=======================
*   Canvas: Software only, hardware acceleration unavailable
*   Direct Rendering Display Compositor: Disabled
*   Compositing: Software only. Hardware acceleration disabled
*   Multiple Raster Threads: Enabled
*   OpenGL: Disabled
*   Rasterization: Software only. Hardware acceleration disabled
*   Raw Draw: Disabled
*   Skia Graphite: Disabled
*   TreesInViz: Disabled
*   Video Decode: Software only. Hardware acceleration disabled
*   Video Encode: Software only. Hardware acceleration disabled
*   Vulkan: Disabled
*   WebGL: Software only, hardware acceleration unavailable
*   WebGL2: Software only, hardware acceleration unavailable
*   WebGPU: Software only, hardware acceleration unavailable
*   WebNN: Software only, hardware acceleration unavailable
 
Log Messages
============
[5720:5908:0629/151955.997:ERROR:ui\gl\gl_display.cc:408] : EGL Driver message (Critical) eglInitialize: No available renderers.
[5720:5908:0629/151955.997:ERROR:ui\gl\gl_display.cc:680] : eglInitialize D3D11 failed with error EGL_NOT_INITIALIZED, trying next display type
[5720:5908:0629/151957.518:ERROR:ui\gl\gl_display.cc:408] : EGL Driver message (Critical) eglInitialize: No available renderers.
[5720:5908:0629/151957.518:ERROR:ui\gl\gl_display.cc:680] : eglInitialize D3D9 failed with error EGL_NOT_INITIALIZED
[5720:5908:0629/151957.518:ERROR:ui\gl\gl_display.cc:715] : Initialization of all EGL display types failed.
[5720:5908:0629/151957.518:ERROR:ui\gl\init\gl_initializer_win.cc:149] : GLDisplayEGL::Initialize failed.
[5720:5908:0629/151957.764:ERROR:ui\gl\gl_display.cc:408] : EGL Driver message (Critical) eglInitialize: No available renderers.
[5720:5908:0629/151957.764:ERROR:ui\gl\gl_display.cc:680] : eglInitialize D3D11 failed with error EGL_NOT_INITIALIZED, trying next display type
[5720:5908:0629/151959.278:ERROR:ui\gl\gl_display.cc:408] : EGL Driver message (Critical) eglInitialize: No available renderers.
[5720:5908:0629/151959.278:ERROR:ui\gl\gl_display.cc:680] : eglInitialize D3D9 failed with error EGL_NOT_INITIALIZED
[5720:5908:0629/151959.278:ERROR:ui\gl\gl_display.cc:715] : Initialization of all EGL display types failed.
[5720:5908:0629/151959.278:ERROR:ui\gl\init\gl_initializer_win.cc:149] : GLDisplayEGL::Initialize failed.
[5720:5908:0629/151959.278:VERBOSE1:gpu\ipc\service\gpu_init.cc:503] : gl::init::InitializeGLNoExtensionsOneOff failed
[5720:5908:0629/151959.279:VERBOSE1:components\viz\service\main\viz_main_impl.cc:86] : VizNullHypothesis is disabled (not a warning)
[5720:5908:0629/151959.279:ERROR:components\viz\service\main\viz_main_impl.cc:184] : Exiting GPU process due to errors during initialization
GpuProcessHost: The GPU process exited normally. Everything is okay.
[11340:16352:0629/151959.406:VERBOSE1:components\viz\service\main\viz_main_impl.cc:86] : VizNullHypothesis is disabled (not a warning)
[11340:1960:0629/152106.691:VERBOSE1:media\capture\content\video_capture_oracle.cc:92] : Capture size auto-throttling is now enabled.
[11340:1960:0629/152106.692:VERBOSE1:media\capture\content\capture_resolution_chooser.cc:205] : Recomputed snapped frame sizes: 529x262
[11340:1960:0629/152106.692:VERBOSE1:media\capture\content\capture_resolution_chooser.cc:157] : Recomputed capture size from 640x360 to 529x262 (100% of ideal size)
[11340:1960:0629/152106.692:VERBOSE1:media\capture\content\video_capture_oracle.cc:121] : Capture size auto-throttling is now disabled.
[11340:1960:0629/152106.693:VERBOSE1:media\capture\content\capture_resolution_chooser.cc:205] : Recomputed snapped frame sizes: 529x262
[11340:16352:0629/152315.697:ERROR:gpu\command_buffer\service\gles2_cmd_decoder_passthrough.cc:1095] : [GroupMarkerNotSet(crbug.com/242999)!:A0C0280084600000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
[11340:16352:0629/152318.003:ERROR:gpu\command_buffer\service\gles2_cmd_decoder_passthrough.cc:1095] : [GroupMarkerNotSet(crbug.com/242999)!:A0C0280084600000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
[11340:16352:0629/152418.623:ERROR:gpu\command_buffer\service\gles2_cmd_decoder_passthrough.cc:1095] : [GroupMarkerNotSet(crbug.com/242999)!:A0C0280084600000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
[11340:16352:0629/152418.863:ERROR:gpu\command_buffer\service\webgpu_decoder_impl.cc:1757] : Failed to query ID3D11Device from ANGLE.
[11340:16352:0629/152426.207:ERROR:gpu\command_buffer\service\gles2_cmd_decoder_passthrough.cc:1095] : [GroupMarkerNotSet(crbug.com/242999)!:A0C0280084600000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.

Edge GPU features status and log with Strict CFG disabled:

Graphics Feature Status
=======================
*   Canvas: Hardware accelerated
*   Direct Rendering Display Compositor: Disabled
*   Compositing: Hardware accelerated
*   Multiple Raster Threads: Enabled
*   OpenGL: Enabled
*   Rasterization: Hardware accelerated
*   Raw Draw: Disabled
*   Skia Graphite: Disabled
*   TreesInViz: Disabled
*   Video Decode: Hardware accelerated
*   Video Encode: Hardware accelerated
*   Vulkan: Disabled
*   WebGL: Hardware accelerated
*   WebGL2: Hardware accelerated
*   WebGPU: Hardware accelerated
*   WebNN: Disabled
 
Log Messages
============
[15276:11748:0629/152926.046:VERBOSE1:components\viz\service\main\viz_main_impl.cc:86] : VizNullHypothesis is disabled (not a warning)
GpuProcessHost: The info collection GPU process exited normally. Everything is okay.

[HotCakeX]

Why is it working on my machine then with all of the Edge exploit mitigations from the module applied?

[benjamasu]

Hmm... Odd. Maybe it's on the driver (vendor) side? I'm using video card from Nvidia. I'll try to gather more information about it.

[HotCakeX]

Hmm... Odd. Maybe it's on the driver (vendor) side? I'm using video card from Nvidia. I'll try to gather more information about it.

I can confirm the problem happens when Nvidia card is selected for the Edge process in the OS settings (by default it is set to Intel IGPU). I'll remove Strict CFG for the MsEdge.exe in the next update (releasing in a couple of days).

Thank you for reporting it 🙏🏻

[HotCakeX]

Btw I'm considering it as a bug because i don't want the policies to cause inconvenience for regular use cases, but Strict CFG is most likely just doing its job as expected and the problem might be with the Nvidia drivers, though since i can't modify Nvidia drivers i'll change the policies to work with it.

[benjamasu]

I created a thread on the Nvidia forum. That seems to be the right place for it, but I'm not sure.

https://www.nvidia.com/en-us/geforce/forums/geforce-graphics-cards/5/568898/strict-cfg-breaks-egl-on-windows-11/