No way to disable SmartScreen

[jschroedl]

Description
The agreement shown when downloading and running the Evergreen Standalone Installer includes this statement:

(b) Microsoft Defender SmartScreen. Microsoft Defender SmartScreen (“SmartScreen”) is enabled by default. You can learn more about SmartScreen in the Microsoft Edge Privacy Whitepaper at https://docs.microsoft.com/en-us/microsoft-edge/privacy-whitepaper#smartscreen. If you do not disable SmartScreen, you must provide notice to your end users as required by Section 9 below.

I need to know how to disable SmartScreen within our usage of WebView2. I am using the WPF wrapper.

Reading the referenced page, I see that SmartScreen could be disabled within the Edge Browser by using edge://settings/privacy but that does not apply to the WebView2 control as they are separate.

We need example code illustrating how to disable SmartScreen.

Version
SDK: 1.0.664.37
Framework: All
OS: Win10

Repro Steps
Attempt to disable SmartScreen.

Context
I asked this in question #707 but received no authoritative response so I feel it should be tracked as a bug.

Bug: AB#31694866
Setting: AB#29007172

[liminzhu]

Thanks for opening the issue @jschroedl . We should be doing a better job at documenting this. You can pass in the --disable-features=msSmartScreenProtection flag when creating the WebView environment. In the context of WPF, this means you need to create WV environment through CoreWebView2Environment.CreateAsync and set the AdditionalBrowserArguments property under CoreWebView2EnvironmentOptions.

[jschroedl]

Thanks @liminzhu. Unfortunately this does not have any effect.

Using this test page: https://demo.smartscreen.msft.net/ all actions on the page still trigger SmartScreen. So it is not disabled.

    public partial class MainWindow : Window
    {
        public string BrowserLanguage = "en";
        public CoreWebView2EnvironmentOptions coreViewOptions;

       . . . 

        public MainWindow()
        {
            try
            {
                InitializeComponent();

                Loaded += async (s, e) =>
                {
                    coreViewOptions = new CoreWebView2EnvironmentOptions(
                        additionalBrowserArguments: "--disable-features=msSmartScreenProtection",
                        language: BrowserLanguage);

                    await webView.EnsureCoreWebView2Async(
                        await CoreWebView2Environment.CreateAsync(
                            options: coreViewOptions));
                };
            }
            catch (Exception ex)
            {
                string msg = "Uh-oh, something went wrong while creating the main window. Do you have the WebView2 Runtime installed?\n\n" + ex.Message;
                MessageBox.Show(msg);
            }
        }

I also tried the initialization inline after InitializeComponent instead of in the Loaded call. No difference.

[champnic]

Thanks for the report @jschroedl - I've added a bug on our backlog to look into the failed disablement.

[jamesoli]

@jschroedl I've been able to get the switch to work for WPF. Do you have a wv2:WebView2 xaml element? If you do, can you check to make sure the Source property is not getting set there and make sure you're not setting WebView2.Source before the EnsureCoreWebView2Async call. Setting the source will automatically create an environment with default settings that can't be changed later.

[jschroedl]

Thank you @jamesoli and sorry for the delay in responding. I do have a wv2:WebView2 object in my XAML and, yes, it does set Source. Removing that seems to address the problem! Thank you for your psychic diagnosis!

[hexatomium]

Could anyone confirm if this command-line argument still works? Seems to have no effect here (I'm still seeing SmartScreen requests).
--disable-features=msSmartScreenProtection

[champnic]

Yes this should still be working. I just tried the arg you used and navigated to a test smartscreen site to see the site getting blocked or not:
https://nav.smartscreen.msft.net/other/malware.html

Can you verify that --disable-features=msSmartScreenProtection shows up in the command line of the msedgewebview2.exe process for your app? (I use ProcExp to make this easy, but can also be done in Details tab of Task Manager)

[champnic]

FYI - the proper way to disable SmartScreen now is to set CoreWebView2Settings.IsReputationCheckingRequired to false:
https://learn.microsoft.com/en-us/dotnet/api/microsoft.web.webview2.core.corewebview2settings.isreputationcheckingrequired?view=webview2-dotnet-1.0.2849.39