Win+S results pane blank on Windows 11 26H2: inbox msedgewebview2.exe crashes 0x80000003 (msedge.dll 152.0.4191.53, offset 0x3798704) only under SearchHost

Environment

• Windows 11 Home China (CoreCountrySpecific) 26H2, Build 26300.9711, zh-CN
• Lenovo 82YA, i7-13700H, 16 GB, RTX 4060 Laptop
• SearchHost.exe 2608.25008.200.0; MicrosoftWindows.Client.CBS 1000.26100.372.0 (Status Ok, System signature)
• Inbox WebView2: C:\Windows\System32\Microsoft-Edge-WebView\msedge.dll 152.0.4191.53 (343,667,016 bytes), msedgewebview2.exe 152.0.4191.53
• WinSxS: amd64_microsoft-edge-webview_..._10.0.26100.9711 (plus older 10.0.26100.9444 and 10.0.26100.1)
• Evergreen WebView2 runtime: 122.0.2365.92 (used by every other host on this machine and works fine)

Symptom

Pressing Win+S opens the flyout; the search box works (text + IME candidates fine) but the entire results pane is blank — no highlights, no recent/top apps, no local results, no "no results" message. The pane is the HostedWebView2Control inside SearchHost.

Crash

Application Error 1000, every time the flyout opens (roughly every 6-8 s while open):

Faulting application: msedgewebview2.exe, version 152.0.4191.53

Faulting module: msedge.dll, version 152.0.4191.53

Exception code: 0x80000003 (STATUS_BREAKPOINT)

Fault offset: 0x0000000003798704

156 occurrences since 2026-11-06: offset 0x371e26d (125x, with inbox WebView 151.0.4129.59) and offset 0x3798704 (31x, with 152.0.4191.53).

The crash is very early: no crashpad-handler / gpu-process / renderer child processes are spawned, and the user-data-dir (%LOCALAPPDATA%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\EBWebView) is never created.

Only crashes when hosted by SearchHost

Captured command line of the (only) child process:

"C:\WINDOWS\system32\Microsoft-Edge-WebView\msedgewebview2.exe" --embedded-browser-webview=1

--webview-exe-name=SearchHost.exe --webview-exe-version=2608.25008.200.0

--user-data-dir="...\LocalState\EBWebView" --noerrdialogs

--disable-features=msSmartScreenProtection --edge-webview-enable-mojo-ipcz

--enable-features=msEdgeFluentOverlayScrollbar

--user-agent="... IsWebView2/True (WebView2Version 152.0.4191.53)" --lang=zh-Hans-CN

--mojo-named-platform-channel-pipe=26704.27040.1756256256371307267

/pfhostedapp:1b65864cb327989a080d7351dedf8661a019a237

Running the very same binary standalone (headless, --disable-gpu, --use-angle=swiftshader, and with the exact same argument set) always exits 0 — no crash. So the failure needs the real host connection / hosted-app package identity.

Dump analysis (3 dumps attached)

• Exception 0x80000003 at msedge.dll base 0x7FFE9D560000 + 0x371E26D (151 build), RIP equal.
• Only 27 modules loaded, all Microsoft: msedge_elf.dll, windows.staterepositoryclient.dll, windows.staterepositorycore.dll, capauthz.dll, apphelp.dll, winmm.dll, imm32.dll, user32.dll, gdi32.dll — no third-party/injected DLLs.
• CodeView: RSDS, GUID B7 19 F6 75 DD 04 8C 7A 4C 4C 44 20 50 44 42 2E, age 1, msedge.dll.pdb. msdl.microsoft.com returns 404 for the candidate symbol keys, so we cannot resolve the offset.

Already excluded

• WebView version: both 151 and 152 crash; both 25H2 and 26H2 (in-place upgrade done 2026-11-07).
• Files intact: msedge.dll SHA256 matches the WinSxS component; Authenticode valid.
• ANGLE: 152 links ANGLE statically (no libEGL.dll/libGLESv2.dll strings); only the old 10.0.26100.1 component shipped those DLLs.
• Profile: deleting the whole EBWebView tree does not help; it is never recreated.
• Registry: IsWebView2=0/1 and WebView2RuntimeVersionType=0/1 both tried, no change; resetting the WebView restart-recovery values does nothing.
• Capability: Edge.Webview2.Platform state = Installed.
• Package registration: Add-AppxPackage -Register succeeded (elevated), no change.
• Antivirus/injection: clean (see module list); no IFEO, no AppInit_DLLs, no AppCertDlls.
• SFC/DISM run; in-place upgrade to 26H2 replaced all system components — issue persists.
• Other WebView2 hosts (Widgets, ~20 processes) run on Evergreen 122 and are fine; only SearchHost uses the inbox runtime on this machine.

Ask

1. Please provide symbols for msedge.dll 152.0.4191.53 (PDB GUID B719F675DD048C7A4C4C44205044422E) and 151.0.4129.59 so offset 0x3798704 / 0x371e26d can be resolved to the failing CHECK.
2. Is there any client-side state (package identity / StateRepository cache / WebView host registration) that can be reset to work around this?
3. Is this a known issue with a fix/KB?

Evidence available on request (this form does not accept binary attachments): 3 minidumps (5.5 MB each), 156 Application Error events, system/package version info, HKCU Search key export, screenshots. The same issue is also filed in Feedback Hub with the same title.