Reading the Crashpad Signature and Choosing a Mitigation

Summary

Crashpad dumps from Playwright headless, Playwright headed, and dependency-free raw CDP runs pointed to the same offset in Edge 152’s msedge.dll.
The exception was a read access violation, 0xC0000005, against near-null addresses between 0x18 and 0x21.
The agreement supports a common native failure path. It does not identify the internal source line, regression range, or security impact.
The most reliable observed workaround was to launch Edge with --remote-debugging-port and attach through connect_over_cdp().

Crashpad collection

Edge and Chromium can record abnormal process termination in Crashpad minidumps. These files may contain the exception type, instruction address, loaded modules, and other process state.

Three independently produced dumps were compared:

A: Playwright + Edge / headless
B: Playwright + Edge / headed
C: raw CDP pipe + Edge / no Playwright

All three contained the same relevant signature:

Exception code:    0xC0000005
Access type:       read
Module:            msedge.dll 152.0.4191.53
Module offset:     0x9D5C88B
Invalid addresses: 0x18-0x21

Interpreting `0xC0000005`

Windows uses 0xC0000005 for an access violation: a process attempted to read, write, or execute an invalid memory address.

Access Violation C0000005 — Microsoft Learn

The recorded access type was read. The addresses were very small values in the near-null range. This is consistent with a null-pointer-related access, but the dump information alone is insufficient to identify a specific variable or source expression inside Edge.

That level of attribution would require matching symbols, a complete stack, and source-level analysis by the browser vendor.

Comparing module offsets

Address Space Layout Randomization can place msedge.dll at different absolute memory addresses between processes. The comparable value is therefore the position relative to the module base:

module offset = exception address - module base

Although the absolute addresses differed, the module offset was 0x9D5C88B in all three dumps. This makes a shared native failure path substantially more likely than three unrelated terminations that happen to surface as the same Playwright error.

What the result establishes

Direct observations

Edge exited with 0xC0000005.
The failing access was a read from an invalid address.
The instruction was inside msedge.dll version 152.0.4191.53.
Three execution paths produced the same module offset.
The pipe path reproduced while the port control completed 8 / 8 runs.

Supported interpretation

TargetClosedError followed the Edge process exit and was not the originating failure.
Headed, headless, and raw CDP runs likely reached the same native failure.
The CDP transport path was a material variable in the recorded reproduction.

Still unknown

the responsible Edge source component;
whether Edge 152 introduced the behavior;
how frequently it occurs on other operating system builds or machines;
whether it has any security impact.

The issue is reported as a stability bug. The current data does not justify a vulnerability or CVE claim.

Port-based mitigation

The most reliable observed workaround uses this configuration:

Use a dedicated automation profile.
Launch Edge independently with --remote-debugging-port.
Keep the endpoint bound to localhost.
Attach from Playwright with connect_over_cdp().
Use the existing browser context and page.

The Playwright connection is straightforward:

browser = playwright.chromium.connect_over_cdp("http://127.0.0.1:9222")
context = browser.contexts[0]
page = context.pages[0]

Playwright documents that a CDP connection can provide lower fidelity than its native protocol. Independently launching Edge can also change browser arguments and lifecycle behavior. The port path is therefore an observed mitigation, not a root-cause fix.

Other practical options

Option	Suitable when	Trade-off
Edge + port + `connect_over_cdp()`	Edge-specific behavior and retained profile state are required	Connection fidelity and launch differences need validation
Playwright-bundled Chromium	Edge-specific behavior is not required	Does not test the production Edge browser itself
New profile per process	Authentication state does not need to persist	Authentication and setup repeat every run

Public artifacts

Crash dumps are not published because they can contain process memory and local information.

Conclusion

The investigation progressed from an application-level exception to a dependency-free raw CDP reproduction, a controlled pipe-versus-port comparison, and a repeated native crash signature.

The durable outcome is not a claim about Edge’s internal source code. It is a bounded reproduction, a control matrix, a practical mitigation, and an upstream report that another engineer can inspect and rerun.