Hey folks, I'm *very* excited to see this capability coming to the web!
At the same time, the shape of this proposal is not going to pass muster in current form. First, we can't be embedding the name `chromeos` into APIs that can be used across platforms. We should hope and expect for a day when IWAs are lit up more broadly, so putting this in a CrOS-specific namespace is a bad smell. It also isn't clear that this should be prefixed with an IWA-specific namespace. Second, it isn't clear that this making format is common to other masking formats on the web. I don't see a list of considered design alternatives for these (and other) API shape concerns in the Explainer, which in and of itself is concerning. Can you please reach out to a current or former TAG memeber in your org to get guidance on API shape? Best, Alex On Wednesday, July 8, 2026 at 9:58:26 AM UTC-7 Chromestatus wrote: > *Contact emails* > [email protected], [email protected] > > *Explainer* > > https://github.com/explainers-by-googlers/chromeos-iwa-apis/blob/main/window-shape-explainer.md > > *Specification* > https://explainers-by-googlers.github.io/chromeos-iwa-apis > > *Design docs* > > > https://docs.google.com/document/d/1zPr1QgS-bXsJE7nrO44zx9RBopR4gHuvHxfcqxsX5Ag/edit?tab=t.0#heading=h.pcgro84kqnh3 > > *Summary* > Window Shape API enables allowlisted [Isolated Web Apps]( > https://chromeos.dev/en/web/isolated-web-apps) on ChromeOS to customize > their window shape. By enabling non-rectangular and non-contiguous window > layouts, developers can implement unique user experiences (such as widgets, > floating panels, and overlays) that match the look-and-feel of native > applications. The API `window.chromeos.isolatedWebApp.setShape` requires > the window to be in the unframed display mode and requires the > window-management permission to be granted. Administrators can manage this > feature with existing policies for window management: - > [DefaultWindowManagementSetting]( > https://chromeenterprise.google/policies/#DefaultWindowManagementSetting) > configures the default state for the window management for all apps. The > policies below can override this default. - > [WindowManagementAllowedForUrls]( > https://chromeenterprise.google/policies/#WindowManagementAllowedForUrls) > allows IWAs with specified origins to enter unframed mode and set custom > window shapes without any user interaction. - > [WindowManagementBlockedForUrls]( > https://chromeenterprise.google/policies/#WindowManagementBlockedForUrls) > blocks the permission for specified origins, forcing Chrome to remove any > custom window shapes and fallback to other available display modes. > > *Blink component* > UI>Browser>WebAppInstalls>Isolated > <https://issues.chromium.org/issues?q=customfield1222907:%22UI%3EBrowser%3EWebAppInstalls%3EIsolated%22> > > *Web Feature ID* > Missing feature > > *Motivation* > *No information provided* > > *Initial public proposal* > *No information provided* > > *TAG review* > N/A - TAG review is not needed for IWA APIs > https://crsrc.org/c/docs/website/site/blink/launching-features/isolated-web-apps/index.md;l=73;drc=a5459539e0dfc093d8dc137fb9f8a72ddf5dcbb3 > > > *TAG review status* > Not applicable > > *Goals for experimentation* > None > > *Risks* > > > *Interoperability and Compatibility* > N/A, this feature is not meant to be implemented by other browsers. > > *Gecko*: No signal > > *WebKit*: No signal > > *Web developers*: No signals > > *Other signals*: > > *Ergonomics* > N/A > > *Activation* > N/A, the feature is a single JS API that follows the same behavior as a > pre-existing Chrome App API. Developers already know how to use it. > > *Security* > See > https://github.com/explainers-by-googlers/chromeos-iwa-apis/blob/main/window-shape-explainer.md#security--privacy-considerations > > In summary: The custom shape can be used to create a hidden window, or for > clickjacking. We mitigate this by requiring a minimum shape size of 10x10 > pixels, and by enforcing an allowlist of partners that can use this API. > > *WebView application risks* > > Does this intent deprecate or change behavior of existing APIs, such that > it has potentially high risk for Android WebView-based applications? > N/A > > > *Debuggability* > N/A > > *Will this feature be supported on all six Blink platforms (Windows, Mac, > Linux, ChromeOS, Android, and Android WebView)?* > No > This feature is implemented as a Blink extensions for Chrome on ChromeOS. > It will not be available in any other platform. > > *Is this feature fully tested by web-platform-tests > <https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md>?* > No > > > *Flag name on about://flags* > enable-chromeos-isolated-web-app-set-shape > > *Finch feature name* > *No information provided* > > *Non-finch justification* > *No information provided* > > *Rollout plan* > Will ship enabled for all users > > *Requires code in //chrome?* > False > > *Availability expectation* > Feature is available only in Chrome on ChromeOS, and only for allowlisted > IWAs. > > *Adoption expectation* > Feature is used by allowlisted IWAs within 12 months of launch in Chrome. > > *Adoption plan* > Work with partners: The feature is currently available behind a feature > flag in ChromeOS, and two partners already use it to develop new IWAs. The > target release of their IWAs is 26Q4. > > *Non-OSS dependencies* > > Does the feature depend on any code or APIs outside the Chromium open > source repository and its open-source dependencies to function? > N/A > > *Estimated milestones* > Shipping on desktop 152 > > *Anticipated spec changes* > > Open questions about a feature may be a source of future web compat or > interop issues. Please list open issues (e.g. links to known github issues > in the project for the feature specification) whose resolution may > introduce web compat/interop risk (e.g., changing to naming or structure of > the API in a non-backward-compatible way). > N/A > > *Link to entry on the Chrome Platform Status* > https://chromestatus.com/feature/5075144470036480?gate=6125215051546624 > > This intent message was generated by Chrome Platform Status > <https://chromestatus.com>. > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/f6bf82c3-d0d1-413b-a6bd-02b4f3323cf7n%40chromium.org.
