Chrome plugin domSnapshot fails because bundled InjectedScript lacks incrementalAriaSnapshot

Summary

tab.playwright.domSnapshot() consistently fails in the Codex Chrome plugin with:

TypeError: o.incrementalAriaSnapshot is not a function

The released browser-client.mjs appears to contain a mixed Playwright ARIA snapshot implementation: the DOM snapshot caller expects the Playwright 1.57 incrementalAriaSnapshot() API, while the InjectedScript bundled into the same file only implements the older ariaSnapshotWithRefs() API.

Environment

• Codex Desktop for macOS: 26.623.101652
• Bundled Chrome plugin: 26.623.101652
• Codex Chrome extension: 1.1.5
• Bundled playwright / playwright-core: 1.57.0
• Platform: macOS arm64

Minimal reproduction

const tab = await browser.tabs.new();
await tab.goto("https://example.com");
await tab.playwright.domSnapshot();

Observed result:

Browser Use encountered an error interacting with this webpage:
TypeError: o.incrementalAriaSnapshot is not a function

The failure reproduces after fully restarting both Codex and Chrome.

Capability comparison

On the same tab and in the same session:

• tab.goto() works
• tab.title() and tab.url() work
• tab.playwright.evaluate() works
• Playwright locators work
• tab.screenshot() works
• tab.dom_cua.get_visible_dom() works
• only tab.playwright.domSnapshot() fails

Root-cause evidence

In the bundled Chrome plugin's scripts/browser-client.mjs, the playwright_dom_snapshot handler calls:

o.incrementalAriaSnapshot(element, { mode: "ai" })

However, the InjectedScript implementation embedded in that same bundle exposes:

ariaSnapshot(element, options) {
  return this.ariaSnapshotWithRefs(element, options).text;
}

ariaSnapshotWithRefs(element, options) {
  // returns { text, iframeRefs, iframeDepths }
}

It does not define incrementalAriaSnapshot().

For comparison, the Codex app's bundled @oai/cdp-browser-backend browser client contains a consistent newer implementation: both the caller and its embedded InjectedScript use incrementalAriaSnapshot(). The installed playwright-core@1.57.0 also contains the method.

The Chrome and in-app Browser plugin copies of browser-client.mjs are byte-identical and have SHA-256:

60e4902788f207f88fd09344dfeafe07769488bdb2924bbb12b322c3b9d2b999

This suggests a plugin bundle/build composition issue rather than an outdated Web Store extension or stale app-server process.

Additional observation

The recovery predicate near the Playwright injection path recognizes a missing injected constant and errors of the form:

Cannot read properties of undefined/null (reading 'incrementalAriaSnapshot')

but not the actual ... is not a function error. Even if reinjection were triggered, it would currently inject the same older implementation.

Expected behavior

domSnapshot() should return an ARIA snapshot. The plugin bundle should use one internally consistent Playwright injected-script API. A compatibility fallback could map the older result shape:

const result = injected.ariaSnapshotWithRefs(element, { mode: "ai" });
return {
  full: result.text,
  iframeRefs: result.iframeRefs,
  iframeDepths: result.iframeDepths,
};

No installed application or plugin files were modified while diagnosing this issue.