Widevine

Widevine is Google’s DRM module. Video sites use it through Encrypted Media Extensions, and real Chrome resolves navigator.requestMediaKeySystemAccess("com.widevine.alpha", ...). Google’s licence does not allow shipping the module with the browser, so the release archive has none, and a browser without it rejects that call with NotSupportedError.

How the packages add it

Every launch through either package checks the browser for the module and adds it when it is missing. apostate install and apostate run in both CLIs do the same. To add it:

The package looks for a copy on the host, in Google Chrome’s install and in the user data directories of Chromium-based browsers, and takes the newest version it finds.
With none found, it downloads the module from Google’s component update service, as Chrome’s own component updater does, and checks it against the SHA-256 the service returns.
It keeps the module in the cache directory, in widevinecdm/, so the download happens once per host. Both packages share the cache.
It copies the module into the browser’s install, where it loads for every profile, the temporary one launch() uses included. On Linux, a persistent profile also gets a file that points at the module.

When the package finds no copy and cannot download one, the launch continues without DRM and prints one warning. The packages add the module only to a browser inside an Apostate install, the directory a release archive unpacks to, with build/MANIFEST.lock or resources/profiles/ beside the executable.

The packages have no option to skip Widevine. A module you delete comes back on the next package launch.

Install a copy you choose

To install a particular copy, point the package at a WidevineCdm directory. It replaces the module the browser has.

apostate provision-drm --list
apostate provision-drm --source "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries/WidevineCdm"

import { provisionWidevine } from "@heretic-tech/apostate";

console.log(await provisionWidevine({
  source: "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries/WidevineCdm",
}));

provision-drm --list prints the copies on the host, with version and size. On a Mac with Google Chrome installed, the first line is:

4.10.3112.0      20416896  /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries/WidevineCdm

Without --source or source, the command installs a copy it finds or downloads, as a launch does. Unlike a launch, it fails when it can neither find nor download a copy. Both print or return the platform, whether Widevine is verified there, where the copy came from, its version, and the cache and install paths. The Node CLI has no provision-drm command. Use provisionWidevine().

Keep component updates on

--disable-component-update stops Chrome’s preinstalled components from registering. On a macOS host Widevine is one of them, and a Playwright launch, which passes the switch by default, rejected the Widevine key system on a macOS arm64 host with the module installed. On Linux the browser loads the module from WidevineCdm beside the executable, so the switch does not keep it out there. Patchright and Puppeteer do not pass the switch. The packages remove it from the driver’s default switches and keep it only when you put it in args yourself. If you drive the browser with Playwright yourself, remove it too:

from playwright.sync_api import sync_playwright

from apostate import ensure_binary

with sync_playwright() as p:
    browser = p.chromium.launch(
        executable_path=str(ensure_binary()),
        args=["--fingerprint=42", "--fingerprint-platform=windows"],
        ignore_default_args=["--disable-component-update"],
    )
    print(browser.version)
    browser.close()

import { chromium } from "playwright-core";
import { ensureBinary } from "@heretic-tech/apostate";

const browser = await chromium.launch({
  executablePath: await ensureBinary(),
  args: ["--fingerprint=42", "--fingerprint-platform=windows"],
  ignoreDefaultArgs: ["--disable-component-update"],
});
console.log(browser.version());
await browser.close();

ensure_binary() and ensureBinary() return the browser’s path and add nothing else. A browser started this way gets no Widevine from the packages until a package launch or apostate install has added it to the install. Raw binary covers driving the browser yourself.

Hosts

Host	Widevine
macOS arm64	Works
Linux x64	Works
Linux arm64	Works
Windows x64	Not verified. `provision-drm` warns that it is not verified there. If it fails, the browser starts without DRM.

Check it from a page

from apostate import launch

CHECK_WIDEVINE = """async () => {
    try {
        const access = await navigator.requestMediaKeySystemAccess("com.widevine.alpha", [{
            initDataTypes: ["cenc"],
            videoCapabilities: [{ contentType: 'video/mp4; codecs="avc1.42E01E"' }],
        }]);
        return `supported: ${access.keySystem}`;
    } catch (error) {
        return `${error.name}: ${error.message}`;
    }
}"""

with launch(fingerprint=42, fingerprint_platform="windows") as browser:
    page = browser.new_page()
    page.goto("https://example.com")
    print(page.evaluate(CHECK_WIDEVINE))

With the module, this prints supported: com.widevine.alpha. Without it, it prints NotSupportedError: Unsupported keySystem or supportedConfigurations.

Known issue with Windows personas on Linux

The module is the host’s build. On a Linux host, a Windows persona carries the Linux module, and a page can tell:

On 2026-09-26, with the v0.4.3 release binary on a bare-metal x86 Linux server under Xvfb, FingerprintJS Pro flagged Windows personas as anti_detect_browser in 6 of 6 runs with the Linux module present, and in 0 of 6 runs without it. The seeds and the exit were the same in both sets.
The module’s first license message names its platform, Linux and x86-64, in the clear, where real Windows Chrome sends a 2-byte certificate request.

DRM playback works with the module present. The packages and apostate run put the module back on every launch, and --disable-component-update does not keep it out on Linux. To run a Windows persona on Linux without it, delete the WidevineCdm directory beside the executable and start the binary directly, not through the packages or apostate run. Known gaps tracks the issue.

Get started

Concepts

Configure

Run in production

Help

How the packages add it

Install a copy you choose

Keep component updates on

Hosts

Check it from a page

Known issue with Windows personas on Linux

​How the packages add it

​Install a copy you choose

​Keep component updates on

​Hosts

​Check it from a page

​Known issue with Windows personas on Linux

How the packages add it

Install a copy you choose

Keep component updates on

Hosts

Check it from a page

Known issue with Windows personas on Linux