Minimal reproduction for crbug.com/534655509, served from an origin enrolled in the WebMCP origin trial. Reproduced on Chrome 150.0.7871.187 (2026-07-28), 151.0.7922.138 (2026-08-19) and 151.0.7922.170 (2026-08-24), macOS.
Open a variant below, then click the link on the page to go to its second page. Loading either page directly by URL never crashes. The navigation has to come from a click, which is what makes the router take over instead of the browser.
On macOS, count new minidumps to be sure of what you saw:
ls -lt ~/Library/Application\ Support/Google/Chrome/Crashpad/completed/*.dmp | head strings <dump>.dmp | grep -Eo "killed_process_origin_lock.*|bad_message_reason"
| Configuration | Router | Imperative | Declarative | Expected |
|---|---|---|---|---|
| router + imperative + declarative | on | on | on | CRASH |
| router + imperative only | on | on | off | ok |
| router + declarative only | on | off | on | ok |
| router + token, zero tools | on | off | off | ok |
| no router, imperative + declarative | off | on | on | ok |
| no router, token, zero tools | off | off | off | ok |
<ClientRouter>, which navigates same-document by fetching the next page and swapping the DOM through the View Transitions API. Site-wide prefetch on hover is on, as on the real site.document.modelContext.registerTool(), released through the AbortSignal passed at registration.<form> carrying toolname and tooldescription, with toolparamdescription on its input.
The trigger needs all three at once. Removing any one of them stops the crash, and so does
removing the token. Releasing the tools on astro:before-swap and re-registering
them on astro:after-swap does not help either, which is why these pages keep
their tools registered across the swap.
An earlier set of repro pages (/webmcp-repro/a.html, a2.html,
/webmcp-repro-nooac/a2.html) was linked from the bug report in July. Those were
plain multi-page HTML with no router, which is why they never reproduced anything: at the
time we had wrongly described this site as a classic MPA. Those URLs now redirect here, and the
mpa-both and mpa-none variants above cover what they tested.