From c4ded9a3ab577bfb5bbf854eeb47836336f67397 Mon Sep 17 00:00:00 2001 From: ciregenz Date: Tue, 11 Aug 2026 02:44:22 -0700 Subject: [PATCH] [eric] browser: strip the Electron token from every request UA in the browser partition, so out-of-process sign-in iframes stop reading as an embedded browser (ENG-238) --- electron/main.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/electron/main.js b/electron/main.js index b4c55e53..e13cd9a1 100644 --- a/electron/main.js +++ b/electron/main.js @@ -2242,6 +2242,12 @@ app.whenReady().then(async () => { const lk = k.toLowerCase(); if (lk === 'sec-ch-ua' || lk === 'sec-ch-ua-full-version-list') { headers[k] = addGoogleChromeBrand(headers[k]); + } else if (lk === 'user-agent' && /\bElectron\//i.test(headers[k]) && !borrowed) { + // The webview `useragent` attribute misses out-of-process iframes (Google's GSI sign-in + // button runs in one), which then send the DEFAULT UA carrying the Electron token, and + // Google refuses sign-in from an "embedded browser" (ENG-238, measured on pinterest.com). + // Stripping it at the header covers every frame, worker and process in the partition. + headers[k] = headers[k].replace(/\s*Electron\/\S+/i, ''); } else if (borrowed && lk === 'user-agent') { const swapped = bareChromeUserAgent(headers[k]); // Once per site: proof the swap actually fired, so "borrowed but still signed out" can be