WebView2
WebView2 embeds Microsoft Edge web content inside a native app. Use it when web content is part of the product, not as a default replacement for native WinUI screens.
SDK Versus Runtime
| Piece | Role |
|---|---|
| WebView2 control/SDK | API used by your WinUI app |
| Evergreen WebView2 Runtime | Browser runtime installed and updated on user machines |
| Fixed Version Runtime | Runtime files shipped with your app for controlled compatibility/offline needs |
Add A Control
<WebView2
x:Name="Browser"
Source="https://example.com" />Initialize when you need direct CoreWebView2 access:
await Browser.EnsureCoreWebView2Async();
Browser.CoreWebView2.NavigationStarting += (_, args) =>
{
if (!Uri.TryCreate(args.Uri, UriKind.Absolute, out var uri) || uri.Scheme != "https")
{
args.Cancel = true;
}
};Runtime Choice
| Choice | Use when | Trade-off |
|---|---|---|
| Evergreen | Most apps | Automatic security and quality updates |
| Fixed Version | Strict compatibility, offline, regulated environment | Larger package and explicit update responsibility |
Security Boundaries
- Prefer HTTPS.
- Restrict navigation to expected origins.
- Treat host object/script injection as a privileged bridge.
- Use a deliberate user data folder strategy for profiles, cache, and privacy.
- Test web content with Playwright when it is complex enough to warrant browser automation.
Gotcha: The WinUI template may include the WebView2 SDK path, but users still need an appropriate WebView2 Runtime strategy.