Accessibility (UIA) Troubleshooting

Chromium-based browsers offer a number of accessibility-related features. When you visit about:accessibility, you can see more about the state of these features (similarly, you can find the states in about:histograms/Accessibility.ModeFlag). You can enable features via the Accessibility page, or pass the command line argument --force-renderer-accessibility into the browser.

In some cases, you may be surprised to find some of the accessibility features enabled even when you have not manually enabled them:

This can happen when the browser detects interactions from a UI Automation tool; such API calls are mostly from accessibility tools like screen-readers. However, some features like Windows 10’s Text Cursor Indicator:

…are implemented using UIA, and when this feature is enabled, the browser enables the corresponding accessibility features.

Back in the spring, some improvements to the Accessibility code caused a series of regressions that would result in crashes, hangs, and memory exhaustion when a loading many pages, including YouTube:

These regressions were impactful for many customers who didn’t expect to be running the impacted code. Fortunately, the problems were quickly fixed.

Update: A similar regression shipped in Edge 97.1069 and should be fixed in Edge 97.1073; in the case of the new crash, the entire browser crashes and disappears. :(

Unfortunately for end-users, tracking down how Accessibility features got enabled on their browsers is presently used to be non-trivial. (Update: read on)

For Microsoft Edge users running Windows 10 version 20H1 or later, visiting about:histograms/UIA will show a truncated hash of the process name of the UIA client:

The value shown is the Integer representation of the first four bytes of the SHA-1 Hash of the process name. Some common values include:

Truncated HashProcess Name
612857738EoAExperiences.exe (Win10 Text Cursor Indicator feature)
1759000766TextExpander.exe
319076627Narrator.exe
427450884Snagit32.exe
592588840Magnify.exe
3897604127magnify.exe
494880639nvda.exe

Unfortunately, there’s no easy way to go from a truncated hash back to the original string; hashes are one-way. (The only way to do it is brute force — start with a list of possible strings and hash them all to find a match).

A simple PowerShell script mostly written by Artem Pronichkin allows you to get the hashes of all of your running processes, which you can then compare to the reported value:

In the future, we hope to streamline this experience somewhat, but for now, it’s an annoyingly geeky scavenger hunt.

Update: In Edge 93+, the edge://accessibility page includes a simple “Show Client Info” button. Easy peasy.

In this case, we see the Text Cursor Indicator feature implemented inside EoAExperiences.exe has enabled accessibility for Edge.

Published by ericlaw

Impatient optimist. Dad. Author/speaker. Created Fiddler & SlickRun. PM @ Microsoft 2001-2012, and 2018-2022, working on Office, IE, and Edge. Now a SWE on Microsoft Defender Web Protection. My words are my own, I do not speak for any other entity.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: