#53185: fix: don't crash when the Touch ID WebAuthn prompt reason is empty
Merged
Created: Aug 25, 2026, 3:27:57 PM
Merged: Aug 26, 2026, 12:52:37 AM
5 comments
Target: main
-[LAContext evaluateAccessControl:operation:localizedReason:reply:]raisesNSInvalidArgumentException("Non-empty localizedReason must be provided.") when given an empty reason, and AppKit's uncaught-exception handler then kills the browser process (-[NSApplication _crashOnException:]underdevice::fido::mac::TouchIdContext::PromptTouchId).- The reason is
IDS_WEBAUTHN_TOUCH_ID_PROMPT_REASON, whichResourceBundlereturns as an empty string whenever no locale pak is loaded (e.g. the--lang=de-DEcase fixed in #53184), so anynavigator.credentials.create()/get()that needed user verification crashed instead of prompting. - New Chromium patch: when the localized template is empty, fall back to an unlocalized
verify your identity on <rp id>in bothMakeCredentialOperationandGetAssertionOperation. The normal path is unchanged. - Defense in depth alongside #53184, which fixes the locale loading itself. Apps on current releases can also mitigate with
app.configureWebAuthn({ touchID: { promptReason: '…' } }), since string overrides are consulted before the missing-pak check.
Notes: Fixed a crash on macOS when a WebAuthn Touch ID prompt was requested while no locale resources were loaded.
Backports
Semver Impact
Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron