›_ Codex Issues
Codex Issues / #30968

Chrome plugin domSnapshot fails because bundled InjectedScript lacks incrementalAriaSnapshot

Open 💬 4 comments Opened Jul 3, 2026 by Nekokir

Summary

tab.playwright.domSnapshot() consistently fails in the Codex Chrome plugin with:

TypeError: o.incrementalAriaSnapshot is not a function

The released browser-client.mjs appears to contain a mixed Playwright ARIA snapshot implementation: the DOM snapshot caller expects the Playwright 1.57 incrementalAriaSnapshot() API, while the InjectedScript bundled into the same file only implements the older ariaSnapshotWithRefs() API.

Environment

  • Codex Desktop for macOS: 26.623.101652
  • Bundled Chrome plugin: 26.623.101652
  • Codex Chrome extension: 1.1.5
  • Bundled playwright / playwright-core: 1.57.0
  • Platform: macOS arm64

Minimal reproduction

const tab = await browser.tabs.new();
await tab.goto("https://example.com");
await tab.playwright.domSnapshot();

Observed result:

Browser Use encountered an error interacting with this webpage:
TypeError: o.incrementalAriaSnapshot is not a function

The failure reproduces after fully restarting both Codex and Chrome.

Capability comparison

On the same tab and in the same session:

  • tab.goto() works
  • tab.title() and tab.url() work
  • tab.playwright.evaluate() works
  • Playwright locators work
  • tab.screenshot() works
  • tab.dom_cua.get_visible_dom() works
  • only tab.playwright.domSnapshot() fails

Root-cause evidence

In the bundled Chrome plugin's scripts/browser-client.mjs, the playwright_dom_snapshot handler calls:

o.incrementalAriaSnapshot(element, { mode: "ai" })

However, the InjectedScript implementation embedded in that same bundle exposes:

ariaSnapshot(element, options) {
  return this.ariaSnapshotWithRefs(element, options).text;
}

ariaSnapshotWithRefs(element, options) {
  // returns { text, iframeRefs, iframeDepths }
}

It does not define incrementalAriaSnapshot().

For comparison, the Codex app's bundled @oai/cdp-browser-backend browser client contains a consistent newer implementation: both the caller and its embedded InjectedScript use incrementalAriaSnapshot(). The installed playwright-core@1.57.0 also contains the method.

The Chrome and in-app Browser plugin copies of browser-client.mjs are byte-identical and have SHA-256:

60e4902788f207f88fd09344dfeafe07769488bdb2924bbb12b322c3b9d2b999

This suggests a plugin bundle/build composition issue rather than an outdated Web Store extension or stale app-server process.

Additional observation

The recovery predicate near the Playwright injection path recognizes a missing injected constant and errors of the form:

Cannot read properties of undefined/null (reading 'incrementalAriaSnapshot')

but not the actual ... is not a function error. Even if reinjection were triggered, it would currently inject the same older implementation.

Expected behavior

domSnapshot() should return an ARIA snapshot. The plugin bundle should use one internally consistent Playwright injected-script API. A compatibility fallback could map the older result shape:

const result = injected.ariaSnapshotWithRefs(element, { mode: "ai" });
return {
  full: result.text,
  iframeRefs: result.iframeRefs,
  iframeDepths: result.iframeDepths,
};

No installed application or plugin files were modified while diagnosing this issue.

View original on GitHub ↗

4 Comments

Nekokir · 1 month ago

Related issues:

https://github.com/openai/codex/issues/21807 exercises the same Chrome-extension tab.playwright.domSnapshot() path. On an older app/plugin build and extension 1.1.4, it caused the user's Chrome profile to exit while snapshotting a complex authenticated page. It does not report the same exception, so it may be a separate failure mode, but it is the closest prior report for this code path.
https://github.com/openai/codex/issues/22797 reports the same broad partial-functionality pattern on macOS: URL/title work while real-page DOM inspection, including domSnapshot(), fails. That report concerns the in-app browser and timeouts rather than the deterministic incrementalAriaSnapshot exception here.
https://github.com/openai/codex/issues/20661 also reports URL/title succeeding while DOM inspection fails, but its Windows failure is traced to the app-server process not starting. That is a different layer/root cause and is included only as a diagnostic contrast.

I found no existing issue containing either incrementalAriaSnapshot or ariaSnapshotWithRefs. This issue appears to isolate a new bundle-composition mismatch in 26.623.101652, rather than duplicate the environment/startup failures above.

mySebbe · 1 month ago

I can confirm this also reproduces on Windows with the current bundled Chrome plugin.

Environment verified locally:

  • Windows / Codex Desktop session
  • Bundled Chrome plugin: 26.623.101652
  • Codex Chrome extension: 1.1.5
  • Chrome profile: Default
  • Chrome native host manifest: valid
  • Chrome executable: C:\Program Files\Google\Chrome\Application\chrome.exe

Minimal repro:

const tab = await browser.tabs.new();
await tab.goto("https://example.com/");
await tab.playwright.waitForLoadState({ state: "domcontentloaded", timeoutMs: 15000 });
await tab.playwright.domSnapshot();

Observed:

Browser Use encountered an error interacting with this webpage:
TypeError: o.incrementalAriaSnapshot is not a function

Other Chrome plugin APIs work in the same session:

  • browser.tabs.new()
  • tab.goto()
  • tab.title() / tab.url()
  • tab.playwright.evaluate()
  • tab.screenshot()
  • browser.tabs.finalize()

I also verified computer-use is unrelated/healthy in the same Codex session by launching Windows Calculator, sending 1 + 2 =, and reading the accessibility result Die Anzeige lautet 3.

Local workaround only:
I patched the installed cache file:

%USERPROFILE%\.codex\plugins\cache\openai-bundled\chrome\26.623.101652\scripts\browser-client.mjs

Adding a fallback in the playwright_dom_snapshot handler for the missing incrementalAriaSnapshot path made domSnapshot() pass on https://example.com/ and return a snapshot containing Example Domain. This confirms the failure is localized to the snapshot implementation, not Chrome startup, the extension, native host setup, or tab control.

I agree with the proposed upstream direction in this issue: the clean fix should make the bundled implementation internally consistent, likely by using the older ariaSnapshotWithRefs() result shape when incrementalAriaSnapshot() is not present, rather than relying on my local CDP text fallback.

schickling-assistant · 1 month ago

I can confirm the same domSnapshot() failure on the in-app Browser backend in Codex Desktop for macOS.

Environment:

  • Codex Desktop: 26.623.141536
  • Platform: macOS arm64
  • Browser plugin: browser@openai-bundled
  • Current backend: Codex in-app Browser (iab)

Repro shape:

if (globalThis.agent?.browsers == null) {
  const { setupBrowserRuntime } = await import("<browser-plugin-root>/scripts/browser-client.mjs");
  await setupBrowserRuntime({ globals: globalThis });
}

const iab = await agent.browsers.get("iab");
const tab = await iab.tabs.selected();
await tab.playwright.domSnapshot();

Observed:

Browser Use encountered an error interacting with this webpage: TypeError: o.incrementalAriaSnapshot is not a function

Other in-app Browser APIs work in the same session:

  • tab.url()
  • tab.title()
  • tab.playwright.evaluate(...)
  • tab.dom_cua.get_visible_dom()
  • tab.screenshot(...)

So this is not limited to the Chrome extension backend; the same bundled Browser client/runtime mismatch also affects the iab backend.

Xiloan · 1 month ago

I’m seeing the same issue.

Additional local evidence:

  • Feedback ID: 019f41e8-0af1-7730-943b-20885cf74e9e
  • Browser plugin version: 26.623.141536
  • Plugin directory timestamp: 2026-07-07 05:37
  • browser-client.mjs timestamp: 2026-07-07 05:35
  • Failure observed: 2026-07-08
  • tab.playwright.domSnapshot() fails even on about:blank with:
  • incrementalAriaSnapshot is not a function
  • tab.playwright.evaluate(...) still works.
  • tab.dom_cua.get_visible_dom() still works.
  • Outside-sandbox Playwright bundled Chromium works locally, so this appears specific to the Browser Use / injected snapshot path rather than the local web app or browser binary availability.

This looks consistent with the bundled client / injected helper mismatch described in this issue.