[Problem/Bug]: WebView2 invoked by SearchHost.exe triggers KnownFolders API access denied errors on multiple system folders

[ephemeral8997]

What happened?

SearchHost.exe launches msedgewebview2.exe to render parts of the Windows Search UI. During initialization, WebView2 attempts to verify known folders using the KnownFolders API. It probes multiple system-level folders including, but not limited to:

• C:\ProgramData
• C:\Users<username>
• C:\Users<username>\AppData\Roaming
• C:\Users<username>\Desktop
• C:\Users<username>\OneDrive
• C:\Users<username>\OneDrive\Desktop
• C:\Windows\system32\config\systemprofile\Desktop
• C:\Windows\system32\config\systemprofile\Favorites

These attempts fail with error 0x80070005 (Access Denied), resulting in repeated Event ID 1002 warnings in the Microsoft-Windows-KnownFolders API Service log. The process runs under a restricted context (likely AppContainer or similar ig) and these folders are protected by default ACLs. The access attempts are unnecessary and noisy and usually happen on boot, especially since the folders are obviously present and not misconfigured.

Importance

Moderate. The system is affected by log spam and unnecessary folder probes, but functionality remains usable.

Runtime Channel

Stable release (WebView2 Runtime)

Runtime Version

140.0.3485.54

SDK Version

N/A (not using SDK directly)

Framework

Native

Operating System

Windows 11

OS Version

26100.5074

Repro steps

1. Open Windows Search (Start menu or taskbar)
2. Observe that SearchHost.exe launches msedgewebview2.exe (in Sysinternals Procmon)
3. Check Event Viewer → Applications and Services Logs → Microsoft → Windows → KnownFolders → Operational
4. Multiple Event ID 1002 entries appear with:
   • hrError: 0x80070005
   • FolderId: varies (e.g., ProgramData, Users, etc)
   • Path: varies across protected system folders

Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

No, this never worked

Last working version (if regression)

N/A

[chetanpandey1266]

I'm able to repro this. Will investigate once and let you know.

[chetanpandey1266]

I investigated the issue and found the following:

1. In the Event Viewer entry, I can't find any detail which links the Known Folder errors to webview2.
2. I cleared Known Folder logs, and then started procmon. Then I killed SearchHost process from task manager and tried launching it from the taskbar. Recorded procmon for the whole process and also waited for 2-3 minutes extra but nothing showed up in Event Viewer.
3. While trying above steps, once Event Viewer did showed an Error but when I tried finding it in the Procmon log I can't find that folder for webview2 process.

Also some questions for you.

1. How were you able to link the Known Folder error with SearchHost's webview2?
2. If you are able to repro can you send me the Procmon Logs. Steps to collect procmon logs can be found here.

[ephemeral8997]

Hey @chetanpandey1266

I originally linked the KnownFolders errors to msedgewebview2.exe using Procmon. I traced SearchHost.exe launching WebView2 and saw folder probes that matched Event ID 1002 entries in Event Viewer. The folders were mostly ACL-protected paths like OneDrive\Desktop, and the errors showed up consistently on boot.

That said, I recently reinstalled Windows without OneDrive integration, and the log spam seems to have stopped. So it might've been tied to OneDrive folder ACLs or how WebView2 handles known folders under restricted contexts.

I'm not actively repro'ing this anymore, so this thread goes quiet for now. If it resurfaces, I'll grab fresh Procmon logs and follow up.

Appreciate you tracking this internally.