FreeRDP 3.33.0 Adds WebAssembly Support to Run in a Browser; Its Build Script Says the Page Needs Two Cross-Origin Headers and a WebSocket Bridge

Overview

FreeRDP, an open-source implementation of Microsoft’s Remote Desktop Protocol, released version 3.33.0 on November 2, 2026 (10:57 UTC on GitHub), and its release notes list “webassembly support, now can run from within your browser” first among the changes. heise online calls it the biggest new feature, and Linuxiac calls it the biggest addition. The project’s own build script adds conditions: the hosting page needs two cross-origin headers, and a WebSocket-to-TCP bridge has to sit in front of the RDP server.

What the release notes say

The 3.33.0 notes put the WebAssembly line ahead of “improved SDL client RAILS”, “experimental UDP support for direct (without gateway) RDP connections”, an experimental Windows shadow server and macOS file clipboard support without FUSE, among other items. In those notes the word “experimental” is attached to the UDP and shadow-server lines but not to the WebAssembly line.

The prose of the notes does not describe how the browser build works. The details appear as titles in the “What’s Changed” list, among them “decode with WebCodecs in Emscripten builds” for both AV1 (#13731) and H.264 (#13812), “a Web Audio backend for Emscripten builds” (#13732), a Web Audio microphone backend (#13811), “browser clipboard for Emscripten builds” (#13733), “a page may split the canvas into monitors” (#13865) and “use the SSE primitives with WebAssembly SIMD” (#13893). heise online summarises these as the web port using “modern browser APIs” and attributes the description to the release announcement; Linuxiac likewise reports WebCodecs for H.264 and AV1 decoding, Web Audio backends and browser clipboard integration. MDN describes WebCodecs as enabling developers to “encode and decode video and audio in the browser efficiently (using hardware acceleration)”.

What the build script requires

The script at the 3.33.0 tag builds “the SDL3 client for the browser” and says the client “needs a page that serves sdl-freerdp.js” with two response headers, Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp (the comment gives the reason as “SharedArrayBuffer for pthreads”), plus “a WebSocket to TCP bridge such as websockify in front of the RDP server”. heise online also describes the bridge requirement: connecting to an RDP server “requires a proxy service, such as a WebSocket-to-TCP bridge like websockify”. On the general requirement for shared memory, MDN’s SharedArrayBuffer page says that to use it “your document must be in a secure context and cross-origin isolated”.

Other points in the script, as the Herald reads it:

• SIMD is opt-in for the browser client. The script’s SIMD variable starts as OFF, becomes ON only with the --with-simd flag, and is what the client build passes as WITH_SIMD (the unit-test build always sets it on). Its comment says a SIMD build “no longer loads in browsers without SIMD support (e.g. Safari before 16.4)”. heise says the Emscripten build “also supports WebAssembly SIMD instructions”, without mentioning the flag.
• Parts of the client are switched off. A comment reading “Features without a backend in the browser” precedes a list of CMake options set to OFF, among them WITH_SERVER, WITH_SHADOW, WITH_PROXY, WITH_KRB5, WITH_PCSC, WITH_CUPS and CHANNEL_URBDRC.
• Toolchain. The script says it needs “emsdk 6 (CI uses 6.0.12)”, and a workflow file runs the Emscripten build and unit tests on pull requests to the master and stable branches and on a weekly schedule.

The 3.33.1 patch release

The 3.33.0 notes said a patch release for the backlog of “papercuts and bug” would come “soon”. Version 3.33.1 was published on November 10, 2026 (08:35 UTC on GitHub) as a “Bugfix and papercut release”. Its four headline bullets cover the shadow server, hashless certificate support, Apple VideoToolbox H.264 support and “various RAILS fixes”, and none names the browser build. Its changelog list includes, among other entries, “detect the browser time zone on Emscripten” (#13980), “publish the wire audio format for the web page” (#14044) and “don’t re-offer the browser clipboard the server replaced” (#14113).

For scale, GitHub’s compare pages show 748 commits between 3.32.2 and 3.33.0 and 380 between 3.33.0 and 3.33.1; these counts are the Herald’s reading of those pages on November 13, 2026.

One framing differs between sources

The release notes say “The influx of pull requests and feedback for bugs/regressions/… was huge”. Phoronix quotes that sentence under a headline that adds “Due To AI” and writes that the release “was also impacted by the onslaught of AI/LLM activity”. The release text Phoronix quotes does not mention AI or LLMs, and the notes themselves give no cause. heise online mentions the volume of pull requests and bug reports without a cause, and Linuxiac does not mention it, so among the cited sources the AI link is Phoronix’s characterisation.

Security fixes

The 3.33.0 notes link 13 GitHub security advisories under a “CVE” heading; Phoronix says the release ships “13 known security fixes” and Linuxiac says it addresses “13 GitHub security advisories”. The 3.33.1 notes link 11, and by the Herald’s comparison one identifier, GHSA-76c4-7552-ffhv, appears in both lists. This article does not examine the advisories or whether they touch the browser build.

What we don’t know

None of the cited sources says which browsers the WebAssembly client has been tested in, reports performance figures for it, points to a hosted demonstration, or says whether the project regards it as ready for production use. None says whether the 3.33.0 or 3.33.1 advisories affect the browser build.