[Problem/Bug]: visibleSecurityStateChanged only triggered once in new window

[Bjoern76]

What happened?

I register a DevToolsProtocolEventReceiver for Security.visibleSecurityStateChanged which works fine in those WebViews I navigate myself first. But if the created WebView is passed as NewWindow in the NewWindowRequested event, visibleSecurityStateChanged is only triggered once for the new WebView. Even if I manually navigate to a different website afterwards the event isn't triggered. I also tried re-registering the event receiver at a later point but that doesn't change anything.

Importance

Important. My app's user experience is significantly compromised.

Runtime Channel

Stable release (WebView2 Runtime)

Runtime Version

145.0.3800.82

SDK Version

1.0.3848.0

Framework

Win32

Operating System

Windows 11

OS Version

10.0.26200

Repro steps

I reproduced this in the WebView2APISample app by adding the following code to OnCreateCoreWebView2ControllerCompleted:

[...]
        // Set the initial size of the WebView
        ResizeEverything();

        CHECK_FAILURE( m_webView->GetDevToolsProtocolEventReceiver( L"Security.visibleSecurityStateChanged", &m_securityStateEventReceiver ) );
        CHECK_FAILURE( m_securityStateEventReceiver->add_DevToolsProtocolEventReceived(
            Callback<ICoreWebView2DevToolsProtocolEventReceivedEventHandler>(
                [this](ICoreWebView2* sender, ICoreWebView2DevToolsProtocolEventReceivedEventArgs* args) -> HRESULT
                {
                    wil::unique_cotaskmem_string jsonParams;
                    CHECK_FAILURE(args->get_ParameterObjectAsJson(&jsonParams));
                    m_securityState = jsonParams.get();
                    UpdateAppTitle();
                    return S_OK;
                })
            .Get(),
            nullptr));
        CHECK_FAILURE(m_webView->CallDevToolsProtocolMethod(L"Security.enable", L"{}", NULL));
[...]

with m_securityState and m_securityStateEventReceiver declared as

    std::wstring m_securityState;
    wil::com_ptr<ICoreWebView2DevToolsProtocolEventReceiver> m_securityStateEventReceiver;

and changing UpdateAppTitle as follows for an easy way to display the last visibleSecurityStateChanged event params:

void AppWindow::UpdateAppTitle()
{
    std::wstring str(m_appTitle);
    if (!m_profileName.empty())
    {
        str += L" - " + m_profileName;
    }
    if (!m_documentTitle.empty())
    {
        str += L" - " + m_documentTitle;
    }
    if (!m_securityState.empty())
    {
        str += L" - " + m_securityState;
    }
    SetWindowText(m_mainWindow, str.c_str());
}

With those changes made just navigate to any website that contains a link that opens a new window. A simple target="\_blank" is enough. e.g. . Click that link an the newly opened window will show an initial {"visibleSecurityState":_{"securityState":"neutral","securityStateIssueIds":["scheme-is-not-cryptographic"]}}, which is the state reported by the initial about:blank navigation, and then nothing more.

Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

Don't know

Last working version (if regression)

No response