Secure Endpoint breaking Chrome after June Windows cumulative updates?

[ac513]

We deploy Secure Endpoint 8.1.7 to our few thousand devices, and we started getting a mountain of reports this morning that Google Chrome would not appear on the screen after attempting to open it. It's not 100% across the board, but it is a significant uptick in complaints that is getting attention from our unit.

With a little trial & error, I found that killing the Secure Endpoint service or uninstalling Secure Endpoint will allow Chrome to open again. However, nothing shows up as being blocked in the device trajectory in the Secure Endpoint console. Also, if we reinstall an older version 7 Secure Endpoint client, the issue not reproducible. Once we install 8.1.7 again, the issue returns and Chrome does not open.

Behind the scenes the Chrome executable is actually opening & gets listed in Task manager.. But the app window itself never appears.

I did see at least one other thread on this in Malwarebytes' forum -- https://forums.malwarebytes.com/topic/299100-june-2023-update-kb5027231-prevents-google-chrome-from-displaying

Anyone else seeing similar behavior today with Chrome not opening?

[Roman Valenta]

Good question, but from what we know this issue is affecting primarily Windows11. Windows11 is 64bit architecture so is 8.1.x connector release which is recommended to run on Windows11 anyway.

Although the legacy 7.5.x release is also supported  based on the matrix on Wndows11, we don't know yet if the fix will be deployed  due to different 7.5.x architecture. However we are currently working with Microsoft to determine if they can come up with fix on their end that can be implemented as well.

[marinogr]

We have some custom app that are running very slowly on 8.1.x (unusable) compared to 7.5.x. It would be very appreciated or almost necessary to have a fix for 7.5.x.

[Roman Valenta]

When you said slow and unusable, what version of 8.1.x did you run at that time. Only asking as we did have some performance issue in 8.1.x causing for some customers significant slow down due to Secure Endpoint UI "csc_ui.exe" . This issue was mitigated in the latest 8.1.7 release so If you didn't have chance to test this release I would highly suggest that.

On the other note we are currently in testing stage of new connector that have fix for this issue with the latest Windows 11 update and so far it seems that the issue was resolved and the fix will be shipped with the new connector release. For those that do have open TAC case please contact your TCE for further details.

[marinogr]

The last one on 6.April.2023. I think that was 8.1.5.

I have to test it on 8.1.7 or better when new release for fix for CSCwf66658 come out. I have to involve other customer technical stuff and is not easy to test custom app.

[Ken Stieers]

In case you didn't see it yet, they released 8.1.7.21512  to fix this. 

https://docs.amp.cisco.com/Release%20Notes.pdf

[EdieDudley14020]

I did. Testing it today!

[EdieDudley14020]

Looking good.  Chrome opens even if it it's not the default.  No new issues so far!

[emmonsk]

This update does appear to resolve the issue with chrome.

[iboje]

This doesn't seem to resolve it for me either, but my configuration is different (win10 instead of 11).  I'm wondering if I have something else going on.

[Roman Valenta]

Thanks for confirmations we did eventually released this "side" 8.1.7 version to address this quickly glad this fixed the issue. We have more reports through open TAC cases as well that the issue is now resolved with this new version.

[marinogr]

Tested 8.1.7.21512 and confirm fixed chrome and also custom app works well.

[IWard]

After the update Chrome will open now, but it will periodically stop loading new pages/page requests. The browser has to be force closed and re-opened to continue working. Disabling the exploit prevention engine resolves the problem. This is now affecting Windows 10 computers as well as Windows 11.

[mski7861]

@IWard did you deploy the latest connector version 8.1.7.21512?

[IWard]

Yes. I'm on the latest.

[pmedinac]

Hey @IWard , thank you for sharing the insights, based on the information you have shared I would recommend you open a TAC Case so we can investigate further. It´s strange since some organizations have shared that the issue has been fixed after the v8.1.7.21512 version was installed on their environments.