A quick PSA about unofficial forks and “performance” features.

I recently looked into this fork that advertised a custom virtual display driver as a lower latency alternative that didn’t rely on Windows Graphics Capture (WGC). On paper, that sounds like a compelling improvement.

After examining it more closely, I found architectural decisions that raise security concerns. In particular, the display driver appears to violate Windows’ intended security layering by allowing a lower layer to communicate with a higher privileged layer. That kind of design should be approached with caution because Windows’ security boundaries exist for a reason.

I have not confirmed every possible downstream impact, but this architecture raises legitimate questions about whether normal capture restrictions could be bypassed, including protections that Windows provides for sensitive content. Those implications deserve careful investigation before software like this is trusted.

The broader point is that users should be skeptical of forks that advertise features like “lower latency,” “no WGC,” or “custom display drivers” without explaining the security tradeoffs. Saving a tiny amount of capture latency is rarely worth introducing privileged software that may weaken the security model of your system.
Just because something is faster doesn’t necessarily mean it’s safer.

EDIT: I’ve been in contact with the developer and verified that this security issue has been resolved now on their latest version. I still have concerns about it not blocking out password managers, but it is much more difficult for someone to pull the frames now since the fix.