[Problem/Bug]: Access violation reading location (Microsoft.Web.WebView2.Core.dll)

[elibroftw]

What happened?

Exception thrown at 0x00007FF9F8FC4058 in Obscura VPN.exe: 0xC0000005: Access violation reading location 0x00007DF5EF1C0000.

Exception thrown at 0x00007FF9F48E2CC4 in Obscura VPN.exe: Microsoft C++ exception: winrt::hresult_error at memory location 0x00000076CB57D540.

Stack

 	[winrt::hresult_error thrown]	
 	[External Code]	
 	Microsoft.Web.WebView2.Core.dll!00007ff8f7415dbc()	Unknown
 	Microsoft.Web.WebView2.Core.dll!00007ff8f7387acc()	Unknown
 	Microsoft.Web.WebView2.Core.dll!00007ff8f741a284()	Unknown
 	Microsoft.Web.WebView2.Core.dll!00007ff8f73fb3e8()	Unknown
 	EmbeddedBrowserWebView.dll!base::internal::Invoker<base::internal::FunctorTraits<`lambda at ..\..\edge_embedded_browser\client\win\current\embedded_browser_webview_environment.cc:1719:11' &&,ICoreWebView2CreateCoreWebView2CompositionControllerCompletedHandler *>,base::internal::BindState<0,0,0,`lambda at ..\..\edge_embedded_browser\client\win\current\embedded_browser_webview_environment.cc:1719:11',Microsoft::WRL::ComPtr<ICoreWebView2CreateCoreWebView2CompositionControllerCompletedHandler>>,void (long, embedded_browser_webview_current::Controller *)>::RunOnce()	Unknown
 	EmbeddedBrowserWebView.dll!embedded_browser_webview_current::internal::EBWebViewEnvironment::RetryCreateWebView()	Unknown
 	EmbeddedBrowserWebView.dll!base::internal::Invoker<base::internal::FunctorTraits<void (embedded_browser_webview_current::internal::EBWebViewEnvironment::*&&)(Microsoft::WRL::ComPtr<embedded_browser_webview_current::Controller>, std::__Cr::unique_ptr<embedded_browser_webview_current::WebViewCreationParams,std::__Cr::default_delete<embedded_browser_webview_current::WebViewCreationParams>>),embedded_browser_webview_current::internal::EBWebViewEnvironment *,embedded_browser_webview_current::Controller *>,base::internal::BindState<1,1,0,void (embedded_browser_webview_current::internal::EBWebViewEnvironment::*)(Microsoft::WRL::ComPtr<embedded_browser_webview_current::Controller>, std::__Cr::unique_ptr<embedded_browser_webview_current::WebViewCreationParams,std::__Cr::default_delete<embedded_browser_webview_current::WebViewCreationParams>>),base::internal::RetainedRefWrapper<embedded_browser_webview_current::internal::EBWebViewEnvironment>,Microsoft::WRL::ComPtr<embedded_browser_webview_current::Controller>>,void (std::__Cr::unique_ptr<embedded_browser_webview_current::WebViewCreationParams,std::__Cr::default_delete<embedded_browser_webview_current::WebViewCreationParams>>)>::RunOnce()	Unknown
 	EmbeddedBrowserWebView.dll!base::OnceCallback<void (std::__Cr::unique_ptr<embedded_browser_webview_current::WebViewCreationParams,std::__Cr::default_delete<embedded_browser_webview_current::WebViewCreationParams>>)>::Run()	Unknown
 	EmbeddedBrowserWebView.dll!embedded_browser_webview_current::EmbeddedBrowserWebView::CloseInternal(long,bool,enum embedded_browser_webview::WebViewCloseReason)	Unknown
 	EmbeddedBrowserWebView.dll!base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &)	Unknown
 	EmbeddedBrowserWebView.dll!base::TaskAnnotator::RunTask<>()	Unknown
 	EmbeddedBrowserWebView.dll!embedded_browser_webview::internal::AppTaskRunner::DoWork(void)	Unknown
 	EmbeddedBrowserWebView.dll!embedded_browser_webview::internal::AppTaskRunner::MessageCallback()	Unknown
 	EmbeddedBrowserWebView.dll!base::RepeatingCallback<bool (unsigned int, unsigned long long, long long, long long *)>::Run()	Unknown
 	EmbeddedBrowserWebView.dll!base::win::MessageWindow::WindowProc()	Unknown
 	EmbeddedBrowserWebView.dll!base::win::WrappedWindowProc<&base::win::MessageWindow::WindowProc>()	Unknown
 	user32.dll!UserCallWinProcCheckWow(struct _ACTIVATION_CONTEXT *,__int64 (*)(struct tagWND *,unsigned int,unsigned __int64,__int64),struct HWND__ *,enum _WM_VALUE,unsigned __int64,__int64,void *,int)	Unknown
 	user32.dll!DispatchMessageWorker()	Unknown
 	[Inline Frame] Microsoft.ui.xaml.dll!DirectUI::FrameworkApplication::RunDesktopWindowMessageLoop() Line 1334	C++
 	[Inline Frame] Microsoft.ui.xaml.dll!DirectUI::FrameworkApplication::StartDesktop() Line 235	C++
 	[Inline Frame] Microsoft.ui.xaml.dll!DirectUI::FrameworkApplicationFactory::StartImpl(ABI::Microsoft::UI::Xaml::IApplicationInitializationCallback *) Line 182	C++
 	Microsoft.ui.xaml.dll!DirectUI::FrameworkApplicationFactory::Start(ABI::Microsoft::UI::Xaml::IApplicationInitializationCallback * pCallback) Line 843	C++
 	[External Code]	
 	[Inline Frame] hostpolicy.dll!coreclr_t::execute_assembly(int) Line 108	C++
>	[Inline Frame] hostpolicy.dll!run_app_for_context(const hostpolicy_context_t &) Line 250	C++
 	hostpolicy.dll!run_app(const int argc, const wchar_t * * argv) Line 285	C++
 	hostpolicy.dll!corehost_main(const int argc, const wchar_t * * argv) Line 426	C++
 	[Inline Frame] hostfxr.dll!execute_app(const std::wstring &) Line 146	C++
 	[Inline Frame] hostfxr.dll!?A0x36711b34::read_config_and_execute(const std::wstring &) Line 533	C++
 	hostfxr.dll!fx_muxer_t::handle_exec_host_command(const std::wstring & host_command, const host_startup_info_t & host_info, const std::wstring & app_candidate, const std::unordered_map<enum known_options,std::vector<std::wstring,std::allocator<std::wstring>>,known_options_hash,std::equal_to<enum known_options>,std::allocator<std::pair<enum known_options const ,std::vector<std::wstring,std::allocator<std::wstring>>>>> & opts, int argc, const wchar_t * * argv, int argoff, host_mode_t mode, const bool is_sdk_command, wchar_t * result_buffer, int buffer_size, int * required_buffer_size) Line 1008	C++
 	hostfxr.dll!fx_muxer_t::execute(const std::wstring host_command, const int argc, const wchar_t * * argv, const host_startup_info_t & host_info, wchar_t * result_buffer, int buffer_size, int * required_buffer_size) Line 579	C++
 	hostfxr.dll!hostfxr_main_startupinfo(const int argc, const wchar_t * * argv, const wchar_t * host_path, const wchar_t * dotnet_root, const wchar_t * app_path) Line 63	C++
 	Obscura VPN.exe!exe_start(const int argc, const wchar_t * * argv) Line 269	C++
 	Obscura VPN.exe!wmain(const int argc, const wchar_t * * argv) Line 332	C++
 	[External Code]	

// Execute the application
unsigned int exit_code;
auto hr = context.coreclr->execute_assembly(
    (int32_t)argv_local.size(),
    argv_local.data(),
    managed_app.data(),
    &exit_code);

Importance

Blocking. My app's basic functions are not working due to this issue.

Runtime Channel

Stable release (WebView2 Runtime)

Runtime Version

No response

SDK Version

No response

Framework

WinUI3/WinAppSDK

Operating System

Windows 11 ARM64

OS Version

No response

Repro steps

WebView.CoreWebView2.GetDevToolsProtocolEventReceiver("Runtime.consoleAPICalled").DevToolsProtocolEventReceived += (s, e) => OnWebviewConsoleApiCall(e.ParameterObjectAsJson);

Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

Maybe.

Last working version (if regression)

Friday May 16th 😭

[elibroftw]

Exception 1

onecoreuap\windows\moderncore\inputv2\components\attachableinputobject\lifted\coreinputobjects\client\inputnonclientpointersourcewinrt.cpp(1763)\Microsoft.UI.Input.dll!00007FF8AE6BBB74: (caller: 00007FF81E3FBCA8) ReturnHr(1) tid(aa88) 80070057 The parameter is incorrect.
    Msg:[There is no HWND associated with the provided WindowId.] 
Exception thrown at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: WinRT originate error - 0x80070057 : 'The parameter is incorrect.'.
Exception thrown at 0x00007FF9F48E2CC4 in Obscura VPN.exe: Microsoft C++ exception: winrt::hresult_invalid_argument at memory location 0x000000B19D17C5A0.
onecoreuap\windows\moderncore\inputv2\components\attachableinputobject\lifted\coreinputobjects\client\inputnonclientpointersourcewinrt.cpp(1763)\Microsoft.UI.Input.dll!00007FF8AE6BBB74: (caller: 00007FF81E3FBCA8) ReturnHr(2) tid(aa88) 80070057 The parameter is incorrect.
    Msg:[There is no HWND associated with the provided WindowId.] 
Exception thrown at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: WinRT originate error - 0x80070057 : 'The parameter is incorrect.'.
Exception thrown at 0x00007FF9F48E2CC4 in Obscura VPN.exe: Microsoft C++ exception: winrt::hresult_invalid_argument at memory location 0x000000B19D17C640.
Webview: {"date":"2026-05-19T17:42:41.0904841-04:00","level":"INFO","appname":"Obscura VPN","logger":"Webview","thread":"2","ndc":"(null)","message":"invoked FFI command getStatus"}
Obscura_Client.InvokeCommand: {"date":"2026-05-19T17:42:41.1580898-04:00","level":"WARN","appname":"Obscura VPN","logger":"Obscura_Client.InvokeCommand","thread":"2","ndc":"(null)","message":"Unknown command: {\"checkForUpdates\":{}}"}
Exception thrown: 'System.NotSupportedException' in Obscura VPN.dll
Exception thrown at 0x00007FF821AB04DC (Microsoft.Web.WebView2.Core.dll) in Obscura VPN.exe: 0xC0000005: Access violation reading location 0x0000000000000000.

---

Exception 2

pal::hresult_t coreclr_t::execute_assembly(
    int argc,
    const char** argv,
    const char* managed_assembly_path,
    unsigned int* exit_code)
{
    assert(coreclr_contract.coreclr_execute_assembly != nullptr);

    return coreclr_contract.coreclr_execute_assembly(
        _host_handle,
        _domain_id,
        argc,
        argv,
        managed_assembly_path,
        exit_code);
}

Exception thrown at 0x00007FF82D82488C (Microsoft.Web.WebView2.Core.dll) in Obscura VPN.exe: 0x80000002: Datatype misalignment.
Exception thrown at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: 0x80000002: Datatype misalignment.
Unhandled exception at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: 0x80000002: Datatype misalignment.

[elibroftw]

Unhandled exception at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: 0xC00000AA: An attempt was made to execute an instruction at an unaligned address and the host system does not support unaligned instruction references.

[elibroftw]

Release Build

System.ExecutionEngineException
HResult=0x80131506
Source=
StackTrace:

[System.ExecutionEngineException unhandled]	
[Managed to Native Transition]	

Microsoft.WinUI.dll!ABI.Microsoft.UI.Xaml.IApplicationStaticsMethods.Start(WinRT.IObjectReference _obj, Microsoft.UI.Xaml.ApplicationInitializationCallback callback) Line 33 C#
Microsoft.WinUI.dll!Microsoft.UI.Xaml.Application.Start(Microsoft.UI.Xaml.ApplicationInitializationCallback callback) Line 254 C#
Obscura VPN.dll!Obscura_Client.Program.Main(string[] args) Unknown

[elibroftw]

Also getting "There is no HWND associated with the provided WindowId", but could be my fault.

onecoreuap\windows\moderncore\inputv2\components\attachableinputobject\lifted\coreinputobjects\client\inputnonclientpointersourcewinrt.cpp(1763)\Microsoft.UI.Input.dll!00007FF8AE6BBB74: (caller: 00007FF96AD5BCA8) ReturnHr(1) tid(4310) 80070057 The parameter is incorrect.
    Msg:[There is no HWND associated with the provided WindowId.] 
Exception thrown at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: WinRT originate error - 0x80070057 : 'The parameter is incorrect.'.
Exception thrown at 0x00007FF9F48E2CC4 in Obscura VPN.exe: Microsoft C++ exception: winrt::hresult_invalid_argument at memory location 0x000000B6D5B7C620.
onecoreuap\windows\moderncore\inputv2\components\attachableinputobject\lifted\coreinputobjects\client\inputnonclientpointersourcewinrt.cpp(1763)\Microsoft.UI.Input.dll!00007FF8AE6BBB74: (caller: 00007FF96AD5BCA8) ReturnHr(2) tid(4310) 80070057 The parameter is incorrect.
    Msg:[There is no HWND associated with the provided WindowId.] 
Exception thrown at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: WinRT originate error - 0x80070057 : 'The parameter is incorrect.'.
Exception thrown at 0x00007FF9F48E2CC4 in Obscura VPN.exe: Microsoft C++ exception: winrt::hresult_invalid_argument at memory location 0x000000B6D5B7C6C0.
Exception thrown at 0x00007FF9F8FC4058 in Obscura VPN.exe: 0xC0000005: Access violation reading location 0x00007DF59B1C0000.

Microsoft.UI.Xaml.dll!00007FF88B108EB0: 80070057 - E_INVALIDARG
Microsoft.UI.Xaml.dll!00007FF88B108EB0: 80070057 - E_INVALIDARG
Microsoft.UI.Xaml.dll!00007FF88B108EB0: 80070057 - E_INVALIDARG
'Obscura VPN.exe' (Win32): Loaded 'C:\Windows\System32\MrmCoreR.dll'. Symbol loading disabled by Include/Exclude setting.
onecoreuap\windows\moderncore\inputv2\components\attachableinputobject\lifted\coreinputobjects\client\inputnonclientpointersourcewinrt.cpp(1763)\Microsoft.UI.Input.dll!00007FF8AE6BBB74: (caller: 00007FF89D15BCA8) ReturnHr(1) tid(4d34) 80070057 The parameter is incorrect.
    Msg:[There is no HWND associated with the provided WindowId.] 
onecoreuap\windows\moderncore\inputv2\components\attachableinputobject\lifted\coreinputobjects\client\inputnonclientpointersourcewinrt.cpp(1763)\Microsoft.UI.Input.dll!00007FF8AE6BBB74: (caller: 00007FF89D15BCA8) ReturnHr(2) tid(4d34) 80070057 The parameter is incorrect.
    Msg:[There is no HWND associated with the provided WindowId.] 
Exception thrown at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: WinRT originate error - 0x80070057 : 'The parameter is incorrect.'.
Exception thrown at 0x00007FF9F48E2CC4 in Obscura VPN.exe: Microsoft C++ exception: winrt::hresult_invalid_argument at memory location 0x0000000641D7CB70.
Exception thrown at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: WinRT originate error - 0x80070057 : 'The parameter is incorrect.'.
Exception thrown at 0x00007FF9F48E2CC4 in Obscura VPN.exe: Microsoft C++ exception: winrt::hresult_invalid_argument at memory location 0x0000000641D7CC10.
Obscura_Client.DevServer: {"date":"2026-05-25T13:42:07.1702318-04:00","level":"ERROR","appname":"Obscura VPN","logger":"Obscura_Client.DevServer","thread":"8","ndc":"(null)","message":"[baseline-browser-mapping] The data in this module is over two months old.  To ensure accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D`"}
Exception thrown at 0x00007FF9AC59F018 (coreclr.dll) in Obscura VPN.exe: 0xC0000005: Access violation reading location 0xB940214D10000422.

[elibroftw]

ALso this

Building Menu
Exception thrown at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: WinRT originate error - 0x80070057 : 'This element does not have a XamlRoot. Either set the XamlRoot property or add the element to a tree.'.
Microsoft.UI.Xaml.dll!00007FF88B009C9C: 80070057 - E_INVALIDARG
Unhandled exception at 0x00007FF9F48E2CC4 (KernelBase.dll) in Obscura VPN.exe: 0xC000041D: An unhandled exception was encountered during a user callback.

[elibroftw]

I used Claude and without seeing my code, it suspected that the problem could be providing Lambdas to WebvView2 Events on ARM64.

This is a garbage-collected delegate. Somewhere in the code, a WebView2 event was subscribed with a delegate that the GC has now collected. The native WebView2 code still holds the raw function pointer to the JIT-compiled thunk for that delegate. When the event fires, it calls through the dangling pointer → no module → AV.

The "address with high garbage bits" pattern from earlier (0x001C7DF59B1C0000) is consistent: the freed JIT memory has been overwritten with something else, and reading from offsets into it produces nonsense.

Why ARM64 specifically? Two reasons:

• ARM64 .NET tends to JIT thunks into smaller code-heap regions that get reclaimed more aggressively.
• ARM64 has slightly different GC behavior around small/short-lived objects than x64.

This is a bug that would have been latent on x64 — probably "working" because the freed memory happened to still contain valid-looking thunk code most of the time.

I commented out the following lines of my code and my app has not crashed !

// var logEventReceiver = WebView.CoreWebView2.GetDevToolsProtocolEventReceiver("Log.entryAdded");
// logEventReceiver.DevToolsProtocolEventReceived += (s, e) => OnWebviewLogEntry(e.ParameterObjectAsJson);

// var consoleReceiver = WebView.CoreWebView2.GetDevToolsProtocolEventReceiver("Runtime.consoleAPICalled");
// consoleReceiver.DevToolsProtocolEventReceived += (s, e) => OnWebviewConsoleApiCall(e.ParameterObjectAsJson);

// var exceptionReceiver = WebView.CoreWebView2.GetDevToolsProtocolEventReceiver("Runtime.exceptionThrown");
// exceptionReceiver.DevToolsProtocolEventReceived += (s, e) => OnWebviewException(e.ParameterObjectAsJson);
``

[elibroftw]

This works

// Hold DevTools event receivers as fields.
    private CoreWebView2DevToolsProtocolEventReceiver? _logEventReceiver;
    private CoreWebView2DevToolsProtocolEventReceiver? _consoleReceiver;
    private CoreWebView2DevToolsProtocolEventReceiver? _exceptionReceiver;
_logEventReceiver = WebView.CoreWebView2.GetDevToolsProtocolEventReceiver("Log.entryAdded");
        _logEventReceiver.DevToolsProtocolEventReceived += OnWebviewLogEntry;

        _consoleReceiver = WebView.CoreWebView2.GetDevToolsProtocolEventReceiver("Runtime.consoleAPICalled");
        _consoleReceiver.DevToolsProtocolEventReceived += OnWebviewConsoleApiCall;

        _exceptionReceiver = WebView.CoreWebView2.GetDevToolsProtocolEventReceiver("Runtime.exceptionThrown");
        _exceptionReceiver.DevToolsProtocolEventReceived += OnWebviewException;