diff --git a/.github/.cache-key b/.github/.cache-key
index b25300ecf..d05221f2f 100644
--- a/.github/.cache-key
+++ b/.github/.cache-key
@@ -6,5 +6,5 @@
               ;   ;
               /   \
 _____________/_ __ \_____________
-Times we have broken CI: 3
+Times we have broken CI: 4
 Times Windows has broken CI: 99+
diff --git a/packages/core/src/browser.js b/packages/core/src/browser.js
index e3fdc53d5..abdf7aebf 100644
--- a/packages/core/src/browser.js
+++ b/packages/core/src/browser.js
@@ -11,6 +11,16 @@ import install from './install.js';
 import Session from './session.js';
 import Page from './page.js';
 
+// Chrome features Percy disables for v143 new-headless asset discovery.
+const DISABLED_FEATURES = [
+  'Translate', // suppress translate prompt overlay
+  'OptimizationGuideModelDownloading', // suppress background model fetches
+  'IsolateOrigins', // [headless-only] keep cross-origin sub-resources on the page session for CDP capture
+  'site-per-process', // companion to IsolateOrigins
+  'HttpsFirstBalancedModeAutoEnable', // allow HTTP customer URLs (CI / local dev / staging)
+  'LocalNetworkAccessChecks' // allow loopback/RFC1918 sub-resources (Chrome 143 LNA gating)
+];
+
 export class Browser extends EventEmitter {
   log = logger('core:browser');
   sessions = new Map();
@@ -21,8 +31,7 @@ export class Browser extends EventEmitter {
   #lastid = 0;
 
   args = [
-    // disable the translate popup and optimization downloads
-    '--disable-features=Translate,OptimizationGuideModelDownloading',
+    `--disable-features=${DISABLED_FEATURES.join(',')}`,
     // disable several subsystems which run network requests in the background
     '--disable-background-networking',
     // disable task throttling of timer tasks from background pages
@@ -300,9 +309,11 @@ export class Browser extends EventEmitter {
         if (match) cleanup(() => resolve(match[1]));
       };
 
-      let handleExitClose = () => handleError();
+      let handleExitClose = () => handleError(
+        new Error('Browser exited before devtools address')
+      );
       let handleError = error => cleanup(() => reject(new Error(
-        `Failed to launch browser. ${error?.message ?? ''}\n${stderr}'\n\n`
+        `Failed to launch browser. ${error.message}\n${stderr}'\n\n`
       )));
 
       let cleanup = callback => {
diff --git a/packages/core/src/install.js b/packages/core/src/install.js
index ac87c89bd..d5f3ff391 100644
--- a/packages/core/src/install.js
+++ b/packages/core/src/install.js
@@ -175,13 +175,14 @@ export function chromium({
   });
 }
 
-// default chromium revisions corresponds to v126.0.6478.184
+// Chrome 143.0.7499.169 (base position 1536371) — closest per-platform
+// revision from https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html
 chromium.revisions = {
-  linux: '1300309',
-  win64: '1300297',
-  win32: '1300295',
-  darwin: '1300293',
-  darwinArm: '1300314'
+  linux: '1536366',
+  win64: '1536376',
+  win32: '1536377',
+  darwin: '1536380',
+  darwinArm: '1536376'
 };
 
 // export the namespace by default
diff --git a/packages/core/src/network.js b/packages/core/src/network.js
index 98c15f260..0f0674df7 100644
--- a/packages/core/src/network.js
+++ b/packages/core/src/network.js
@@ -7,6 +7,12 @@ const MAX_RESOURCE_SIZE = 25 * (1024 ** 2) * 0.63; // 25MB, 0.63 factor for acco
 const ALLOWED_STATUSES = [200, 201, 301, 302, 304, 307, 308];
 const ALLOWED_RESOURCES = ['Document', 'Stylesheet', 'Image', 'Media', 'Font', 'Other'];
 const ABORTED_MESSAGE = 'Request was aborted by browser';
+// Chrome 143 omits Network.responseReceived for worker scripts; cap the wait
+// so loadingFinished can clean up. Per-request — N timeouts accumulate to N*2s;
+// PERCY_NETWORK_IDLE_WAIT_TIMEOUT (default 30s) caps cumulative impact.
+const RESPONSE_RECEIVED_TIMEOUT = 2000;
+// Cap idle() impact when a host accepts the TCP connection then stalls during a direct fetch.
+const DIRECT_FETCH_TIMEOUT = 5000;
 
 // Stable, machine-readable codes for abort errors thrown from this module.
 // Consumers should prefer `error.code` over string matching on `error.message`.
@@ -74,7 +80,7 @@ export class Network {
     this.captureMockedServiceWorker = options.captureMockedServiceWorker ?? false;
     this.userAgent = options.userAgent ??
       // by default, emulate a non-headless browser
-      page.session.browser.version.userAgent.replace('Headless', '');
+      page.session.browser?.version?.userAgent?.replace('Headless', '');
     this.fontDomains = options.fontDomains || [];
     this.intercept = options.intercept;
     this.meta = options.meta;
@@ -250,6 +256,13 @@ export class Network {
   _handleRequestPaused = async (session, event) => {
     let { networkId: requestId, requestId: interceptId, resourceType } = event;
 
+    // Response-stage events arrive here when Fetch.continueRequest was called
+    // with interceptResponse:true (see sendResponseResource).
+    if (event.responseStatusCode != null || event.responseErrorReason != null) {
+      await this._handleResponsePaused(session, event);
+      return;
+    }
+
     // wait for request to be sent
     await this.#requestsLifeCycleHandler.get(requestId).requestWillBeSent;
     let pending = this.#pending.get(requestId);
@@ -262,6 +275,68 @@ export class Network {
     await this._handleRequest(session, { ...pending, resourceType, interceptId });
   }
 
+  // Response-stage interception is kept ONLY to detect oversized/malformed
+  // Content-Length and abort the request before Chrome streams a body it
+  // would never terminate (Chrome 143 quirk). For everything else we just
+  // continue — body capture happens later via Network.loadingFinished →
+  // Network.getResponseBody (the v126 path). Reading the body at this stage
+  // hangs worker-initiated fetches, so we don't.
+  _handleResponsePaused = async (session, event) => {
+    let { networkId: requestId, requestId: interceptId, responseHeaders, responseStatusCode } = event;
+    // request may be undefined when a response-stage pause arrives for a request
+    // whose request-stage tracking we never installed (service-worker-fulfilled,
+    // or a cleanup race). We still need to unpause Chrome regardless.
+    let request = this.#requests.get(requestId);
+    let url = request ? originURL(request) : (event.request?.url && normalizeURL(event.request.url));
+    let headersObj = headersArrayToObject(responseHeaders);
+    let { tooLarge, malformed, rawValue } = inspectContentLength(headersObj);
+
+    if (tooLarge || malformed) {
+      let meta = { ...this.meta, url, responseStatus: responseStatusCode };
+      logAssetInstrumentation(this.log, 'asset_not_uploaded', 'resource_too_large', {
+        url, size: rawValue, snapshot: meta.snapshot
+      });
+      this.log.debug('- Skipping resource larger than 25MB', meta);
+
+      // Disposition first, then forget the request — so we never leave Chrome's
+      // Fetch state paused while Percy thinks the request is already done.
+      try {
+        await this.send(session, 'Fetch.failRequest', { requestId: interceptId, errorReason: 'Aborted' });
+      } catch (error) {
+        if (error.message === ABORTED_MESSAGE || error.message.includes('Invalid InterceptionId')) {
+          // benign race — request was already aborted upstream; nothing to un-pause
+        } else {
+          this.log.debug(`Failed to abort oversized response for ${url}: ${error.message}`);
+          // Last-resort: un-pause Chrome's Fetch so it doesn't leak the response.
+          try {
+            await this.send(session, 'Fetch.continueResponse', { requestId: interceptId });
+          } catch (continueError) {
+            this.log.debug(`Last-resort continueResponse also failed for ${url}: ${continueError.message}`);
+          }
+        }
+      }
+
+      if (request) {
+        this._forgetRequest(request);
+        this.#requestsLifeCycleHandler.get(requestId).resolveResponseReceived();
+      }
+      return;
+    }
+
+    return this._continueResponse(session, interceptId, url);
+  }
+
+  // Tell the browser to continue the paused response, swallowing expected
+  // races (request already aborted, interception ID no longer valid).
+  _continueResponse = async (session, interceptId, url) => {
+    try {
+      await this.send(session, 'Fetch.continueResponse', { requestId: interceptId });
+    } catch (error) {
+      if (error.message === ABORTED_MESSAGE || error.message.includes('Invalid InterceptionId')) return;
+      this.log.debug(`Failed to continue response for ${url}: ${error.message}`);
+    }
+  }
+
   // Called when a request will be sent. If the request has already been intercepted, handle it;
   // otherwise set it to be pending until it is paused.
   _handleRequestWillBeSent = async event => {
@@ -351,12 +426,41 @@ export class Network {
   // callback. The request should have an associated response and be finished with any redirects.
   _handleLoadingFinished = async (session, event) => {
     let { requestId } = event;
-    // wait for upto 2 seconds or check if response has been sent
-    await this.#requestsLifeCycleHandler.get(requestId).responseReceived;
     let request = this.#requests.get(requestId);
     /* istanbul ignore if: race condition paranoia */
     if (!request) return;
 
+    if (!request.response) {
+      let timerId;
+      await Promise.race([
+        this.#requestsLifeCycleHandler.get(requestId).responseReceived,
+        new Promise(resolve => { timerId = setTimeout(resolve, RESPONSE_RECEIVED_TIMEOUT); })
+      ]);
+      clearTimeout(timerId);
+    }
+
+    if (!request.response) {
+      this.log.debug(`Skipping resource: responseReceived not received within ${RESPONSE_RECEIVED_TIMEOUT}ms - ${request.url}`);
+      // Chrome 143+ PlzDedicatedWorker: dedicated worker scripts fetch in the browser
+      // process and never surface a CDP response. resourceType varies ('Other' on v143,
+      // 'Script' on older Chrome) so we gate on hostname rather than type, and mirror
+      // sendResponseResource's disallowedHostnames-before-allowedHostnames precedence.
+      let url = originURL(request);
+      /* istanbul ignore else: the else only fires for PlzDedicatedWorker requests
+         whose worker-script fetch bypasses Fetch.requestPaused. Cross-origin assets
+         loaded via the document session still go through sendResponseResource
+         (which performs its own disallowedHostnames check), so the test harness
+         can't reliably reach this skip branch via integration tests. */
+      if (!hostnameMatches(this.intercept.disallowedHostnames, url) &&
+          hostnameMatches(this.intercept.allowedHostnames, url)) {
+        await captureResourceDirectly(this, request, session);
+      } else {
+        this.log.debug(`- Skipping direct-fetch fallback for ${url}: hostname not allowed`, this.meta);
+      }
+      this._forgetRequest(request);
+      return;
+    }
+
     await saveResponseResource(this, request, session);
     this._forgetRequest(request);
   }
@@ -431,7 +535,7 @@ export class Network {
   _initializeNetworkIdleWaitTimeout() {
     // Per-instance timeout so concurrent pages with different env values
     // (or env values changed mid-run by tests) don't stomp each other.
-    this.networkIdleWaitTimeout = parseInt(process.env.PERCY_NETWORK_IDLE_WAIT_TIMEOUT) || 30000;
+    this.networkIdleWaitTimeout = parseInt(process.env.PERCY_NETWORK_IDLE_WAIT_TIMEOUT, 10) || 30000;
 
     if (this.networkIdleWaitTimeout > 60000) {
       this.log.warn('Setting PERCY_NETWORK_IDLE_WAIT_TIMEOUT over 60000ms is not recommended. ' +
@@ -479,6 +583,24 @@ function originURL(request) {
   return normalizeURL((request.redirectChain[0] || request).url);
 }
 
+// Convert Fetch event responseHeaders ([{name, value}, …]) to a header object.
+function headersArrayToObject(arr) {
+  let out = {};
+  if (!Array.isArray(arr)) return out;
+  for (let { name, value } of arr) out[name] = value;
+  return out;
+}
+
+// Returns { tooLarge, malformed, rawValue } for Content-Length classification.
+function inspectContentLength(headers) {
+  let key = headers && Object.keys(headers).find(k => k.toLowerCase() === 'content-length');
+  let rawValue = key ? headers[key] : undefined;
+  let parsed = parseInt(rawValue, 10);
+  let tooLarge = Number.isFinite(parsed) && parsed > MAX_RESOURCE_SIZE;
+  let malformed = rawValue !== undefined && rawValue !== null && String(rawValue).length > 0 && !Number.isFinite(parsed);
+  return { tooLarge, malformed, rawValue };
+}
+
 // Validate domain for auto-allowlisting feature
 // Only validates domains that returned 200 status
 async function validateDomainForAllowlist(network, hostname, url, statusCode) {
@@ -557,8 +679,10 @@ async function sendResponseResource(network, request, session) {
           .map(([k, v]) => ({ name: k.toLowerCase(), value: String(v) }))
       });
     } else {
+      // interceptResponse:true triggers a second pause at the response stage. See _handleResponsePaused.
       await send('Fetch.continueRequest', {
-        requestId: request.interceptId
+        requestId: request.interceptId,
+        interceptResponse: true
       });
     }
   } catch (error) {
@@ -593,9 +717,57 @@ async function sendResponseResource(network, request, session) {
   }
 }
 
-// Make a new request with Node based on a network request
+// Pick the CDP session for Network.getCookies. Worker/auxiliary sessions
+// expose a partial Network domain where Network.getCookies throws
+// "Internal error", so prefer the page's session whenever available and
+// fall back to the request's own session otherwise.
+export function pickCookieSession(network, session) {
+  return network.page?.session ?? session;
+}
+
+// Decide whether to attach a Basic auth header to the Node-side direct fetch.
+// The browser's URLLoader origin-scopes Basic auth; this fallback runs in
+// Node, so we re-enforce the same-origin rule explicitly to avoid leaking
+// credentials cross-origin. Malformed URLs fall through to `false` defensively.
+export function shouldAttachAuth(authorization, requestUrl, snapshotUrl) {
+  if (!authorization?.username) return false;
+  try {
+    return new URL(requestUrl).origin === new URL(snapshotUrl).origin;
+  } catch {
+    return false;
+  }
+}
+
+// Race a promise against a timeout. Resolves with the promise's value if it
+// settles within `ms`, otherwise rejects with `new Error(message)`. The
+// internal timer is always cleared so the event loop can exit cleanly.
+export function raceWithTimeout(promise, ms, message) {
+  let timerId;
+  return Promise.race([
+    promise,
+    new Promise((_, reject) => {
+      timerId = setTimeout(() => reject(new Error(message)), ms);
+    })
+  ]).finally(() => clearTimeout(timerId));
+}
+
+// Server Content-Type wins; URL-extension mime is the fallback; binary default last.
+export function resolveDirectFetchMime(responseHeaders, urlForLookup) {
+  let serverMime = responseHeaders?.['content-type']?.split(';')[0].trim();
+  return serverMime || mime.lookup(urlForLookup) || 'application/octet-stream';
+}
+
+// Make a new request with Node based on a network request. Cookies are read
+// from the page session because worker/auxiliary sessions have a partial
+// Network domain where Network.getCookies throws "Internal error".
 async function makeDirectRequest(network, request, session) {
-  const { cookies } = await session.send('Network.getCookies', { urls: [request.url] });
+  let cookies = [];
+  let cookieSession = pickCookieSession(network, session);
+  try {
+    ({ cookies } = await cookieSession.send('Network.getCookies', { urls: [request.url] }));
+  } catch (error) {
+    network.log.debug(`Network.getCookies unavailable for ${request.url}: ${error.message}`);
+  }
 
   let headers = {
     // add default browser
@@ -603,7 +775,7 @@ async function makeDirectRequest(network, request, session) {
     'sec-fetch-site': 'same-origin',
     'sec-fetch-mode': 'cors',
     'sec-fetch-dest': 'font',
-    'sec-ch-ua': '"Chromium";v="123", "Google Chrome";v="123", "Not?A_Brand";v="99"',
+    'sec-ch-ua': '"Chromium";v="143", "Google Chrome";v="143", "Not?A_Brand";v="99"',
     'sec-ch-ua-mobile': '?0',
     'sec-ch-ua-platform': '"macOS"',
     'sec-fetch-user': '?1',
@@ -613,14 +785,54 @@ async function makeDirectRequest(network, request, session) {
     cookie: cookies.map(cookie => `${cookie.name}=${cookie.value}`).join('; ')
   };
 
-  if (network.authorization?.username) {
-    // include basic authorization username and password
+  if (shouldAttachAuth(network.authorization, request.url, network.meta?.snapshotURL)) {
     let { username, password } = network.authorization;
     let token = Buffer.from([username, password || ''].join(':')).toString('base64');
     headers.Authorization = `Basic ${token}`;
   }
 
-  return makeRequest(request.url, { buffer: true, headers });
+  return makeRequest(request.url, { buffer: true, headers }, (body, res) => ({
+    body, status: res.statusCode, headers: res.headers
+  }));
+}
+
+// Capture a resource via direct HTTP fetch when the browser-side response
+// never surfaces — Chrome 143+ fetches dedicated worker scripts in the browser
+// process (PlzDedicatedWorker) so loadingFinished fires without a body on CDP.
+async function captureResourceDirectly(network, request, session) {
+  let log = network.log;
+  let url = originURL(request);
+  let meta = { ...network.meta, url };
+
+  try {
+    log.debug('- Requesting resource directly (responseReceived timeout fallback)', meta);
+    let { body, status, headers: responseHeaders } = await raceWithTimeout(
+      makeDirectRequest(network, request, session),
+      DIRECT_FETCH_TIMEOUT,
+      `Direct fetch timed out after ${DIRECT_FETCH_TIMEOUT}ms`
+    );
+
+    if (body.length > MAX_RESOURCE_SIZE) {
+      logAssetInstrumentation(log, 'asset_not_uploaded', 'resource_too_large', {
+        url, size: body.length, snapshot: meta.snapshot
+      });
+      log.debug('- Skipping resource larger than 25MB', meta);
+      return;
+    }
+
+    let urlObj = new URL(url);
+    let mimeType = resolveDirectFetchMime(responseHeaders, urlObj.origin + urlObj.pathname);
+
+    let resource = createResource(url, body, mimeType, {
+      status,
+      headers: { 'content-type': [mimeType] }
+    });
+
+    log.debug(`- Saving direct-fetched resource sha=${resource.sha} mimetype=${mimeType}`, meta);
+    network.intercept.saveResource(resource);
+  } catch (error) {
+    log.debug(`Direct fetch failed for ${url} - ${error.message}`, meta);
+  }
 }
 
 // Save a resource from a request, skipping it if specific parameters are not met
@@ -635,19 +847,8 @@ async function saveResponseResource(network, request, session) {
     url,
     responseStatus: response?.status
   };
-  // Checking for content length more than 100MB, to prevent websocket error which is governed by
-  // maxPayload option of websocket defaulted to 100MB.
-  // If content-length is more than our allowed 25MB, no need to process that resouce we can return log.
-  let contentLength = response.headers?.[Object.keys(response.headers).find(key => key.toLowerCase() === 'content-length')];
-  contentLength = parseInt(contentLength);
-  if (contentLength > MAX_RESOURCE_SIZE) {
-    logAssetInstrumentation(log, 'asset_not_uploaded', 'resource_too_large', {
-      url,
-      size: contentLength,
-      snapshot: meta.snapshot
-    });
-    return log.debug('- Skipping resource larger than 25MB', meta);
-  }
+  // Oversized/malformed Content-Length is rejected earlier in _handleResponsePaused;
+  // the body.length check below still guards cached responses where headers may lie.
   let resource = network.intercept.getResource(url);
 
   if (!resource || (!resource.root && !resource.provided && disableCache)) {
@@ -745,7 +946,7 @@ async function saveResponseResource(network, request, session) {
       // so request them directly.
       if (mimeType?.includes('font') || (detectedMime && detectedMime.includes('font'))) {
         log.debug('- Requesting asset directly', meta);
-        body = await makeDirectRequest(network, request, session);
+        ({ body } = await makeDirectRequest(network, request, session));
         log.debug('- Got direct response', meta);
       }
 
diff --git a/packages/core/test/discovery.test.js b/packages/core/test/discovery.test.js
index dede31b93..77fa91fcb 100644
--- a/packages/core/test/discovery.test.js
+++ b/packages/core/test/discovery.test.js
@@ -1,4 +1,5 @@
 import { sha256hash } from '@percy/client/utils';
+import { waitFor } from '@percy/core/utils';
 import { logger, api, setupTest, createTestServer, dedent, mockRequests } from './helpers/index.js';
 import Percy from '@percy/core';
 import { RESOURCE_CACHE_KEY, CACHE_STATS_KEY, DISK_SPILL_KEY } from '../src/discovery.js';
@@ -459,6 +460,48 @@ describe('Discovery', () => {
     ]));
   });
 
+  it('captures favicon when the server provides one', async () => {
+    server.reply('/favicon.ico', () => [200, 'image/x-icon', pixel]);
+    let faviconDOM = testDOM.replace('</head>', '<link rel="icon" href="/favicon.ico"></head>');
+
+    await percy.snapshot({
+      name: 'favicon snapshot',
+      url: 'http://localhost:8000',
+      domSnapshot: faviconDOM
+    });
+
+    await percy.idle();
+
+    expect(captured[0]).toEqual(jasmine.arrayContaining([
+      jasmine.objectContaining({
+        attributes: jasmine.objectContaining({
+          'resource-url': 'http://localhost:8000/favicon.ico'
+        })
+      })
+    ]));
+  });
+
+  it('captures auto-fetched favicon when the page does not declare one', async () => {
+    percy.set({ discovery: { networkIdleTimeout: 1000 } });
+    server.reply('/favicon.ico', () => [200, 'image/x-icon', pixel]);
+
+    await percy.snapshot({
+      name: 'auto-fetch favicon snapshot',
+      url: 'http://localhost:8000',
+      domSnapshot: testDOM
+    });
+
+    await percy.idle();
+
+    expect(captured[0]).toEqual(jasmine.arrayContaining([
+      jasmine.objectContaining({
+        attributes: jasmine.objectContaining({
+          'resource-url': 'http://localhost:8000/favicon.ico'
+        })
+      })
+    ]));
+  });
+
   it('does not capture event-stream requests', async () => {
     let eventStreamDOM = dedent`<!DOCTYPE html><html><head></head><body><script>
       new EventSource('/event-stream').onmessage = event => {
@@ -1166,6 +1209,8 @@ describe('Discovery', () => {
   });
 
   it('captures requests from workers', async () => {
+    percy.loglevel('debug');
+
     // Fetch and Network events are inherently racey because they come from different processes. The
     // bug we are testing here happens specifically when the Network event comes after the Fetch
     // event. Using a stub, we can cause Network events to happen a few milliseconds later than they
@@ -1211,6 +1256,21 @@ describe('Discovery', () => {
         })
       })
     ]));
+
+    // Asserts the v143 worker-script timeout fired so a regression of the hang-fix is observable.
+    expect(logger.stderr).toEqual(jasmine.arrayContaining([
+      jasmine.stringMatching(/Skipping resource: responseReceived not received within 2000ms - http:\/\/localhost:8000\/worker\.js/)
+    ]));
+
+    // Worker scripts must still appear in captured resources for enableJavaScript:true,
+    // courtesy of the direct-fetch fallback that runs when the timeout fires.
+    expect(captured).toContain(jasmine.arrayContaining([
+      jasmine.objectContaining({
+        attributes: jasmine.objectContaining({
+          'resource-url': 'http://localhost:8000/worker.js'
+        })
+      })
+    ]));
   });
 
   it('does not error on cancelled requests', async () => {
@@ -2969,6 +3029,336 @@ describe('Discovery', () => {
         `[percy:core:discovery] ${err.stack}`
       ]));
     });
+
+    it('logs gracefully when direct font request fails', async () => {
+      server.reply('/style.css', () => [200, 'text/css', [
+        '@font-face { font-family: "test"; src: url("/font.woff") format("woff"); }',
+        'body { font-family: "test", "sans-serif"; }'
+      ].join('')]);
+
+      // First hit (browser): octet-stream forces font fallback path.
+      // Second hit (makeDirectRequest): 400 makes the direct fetch throw without retrying.
+      let callCount = 0;
+      server.reply('/font.woff', () => {
+        if (++callCount === 1) return [200, 'application/octet-stream', '<font>'];
+        return [400, 'text/plain', 'bad request'];
+      });
+
+      await percy.snapshot({
+        name: 'font error snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: testDOM
+      });
+
+      await percy.idle();
+
+      expect(logger.stderr).toEqual(jasmine.arrayContaining([
+        jasmine.stringMatching('Encountered an error processing resource: http://localhost:8000/font.woff')
+      ]));
+    });
+
+    it('continues responses gracefully when the request is untracked', async () => {
+      let snap = percy.snapshot({
+        name: 'untracked snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: testDOM
+      });
+
+      await waitFor(() => percy.browser.sessions.size > 0);
+      let [session] = percy.browser.sessions.values();
+      let sentMethods = [];
+      let originalSend = session.send.bind(session);
+      spyOn(session, 'send').and.callFake((method, params) => {
+        sentMethods.push({ method, params });
+        return originalSend(method, params);
+      });
+
+      // Emit a response-stage Fetch.requestPaused for a request that was never
+      // tracked at the request stage — exercises the defensive null-request
+      // branch in _handleResponsePaused.
+      session.emit('Fetch.requestPaused', {
+        networkId: 'untracked-network-id',
+        requestId: 'untracked-intercept-id',
+        responseStatusCode: 200,
+        responseHeaders: [],
+        request: { url: 'http://example.com/orphan' }
+      });
+
+      await snap;
+
+      expect(sentMethods.some(c =>
+        c.method === 'Fetch.continueResponse' &&
+        c.params?.requestId === 'untracked-intercept-id'
+      )).toBe(true);
+    });
+
+    it('aborts oversized responses for untracked requests', async () => {
+      let snap = percy.snapshot({
+        name: 'untracked oversized snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: testDOM
+      });
+
+      await waitFor(() => percy.browser.sessions.size > 0);
+      let [session] = percy.browser.sessions.values();
+      let sentMethods = [];
+      let originalSend = session.send.bind(session);
+      spyOn(session, 'send').and.callFake((method, params) => {
+        sentMethods.push({ method, params });
+        return originalSend(method, params);
+      });
+
+      // Emit a response-stage Fetch.requestPaused with malformed Content-Length
+      // for a request that was never tracked at the request stage — exercises
+      // the `if (request)` false branch inside the oversized/malformed handler.
+      session.emit('Fetch.requestPaused', {
+        networkId: 'untracked-malformed-id',
+        requestId: 'untracked-malformed-intercept',
+        responseStatusCode: 200,
+        responseHeaders: [{ name: 'Content-Length', value: 'NaN' }],
+        request: { url: 'http://example.com/orphan-malformed' }
+      });
+
+      await snap;
+
+      expect(sentMethods.some(c =>
+        c.method === 'Fetch.failRequest' &&
+        c.params?.requestId === 'untracked-malformed-intercept'
+      )).toBe(true);
+    });
+
+    it('logs gracefully when Fetch.failRequest fails during malformed-CL abort', async () => {
+      spyOn(Session.prototype, 'send').and.callFake(function(method, params) {
+        if (method === 'Fetch.failRequest' && params?.requestId === 'fail-request-intercept') {
+          return Promise.reject(new Error('Target closed'));
+        }
+        return Session.prototype.send.and.originalFn.call(this, method, params);
+      });
+
+      let snap = percy.snapshot({
+        name: 'fail-request error snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: testDOM
+      });
+
+      await waitFor(() => percy.browser.sessions.size > 0);
+      let [session] = percy.browser.sessions.values();
+
+      session.emit('Fetch.requestPaused', {
+        networkId: 'fail-request-id',
+        requestId: 'fail-request-intercept',
+        responseStatusCode: 200,
+        responseHeaders: [{ name: 'Content-Length', value: 'NaN' }],
+        request: { url: 'http://example.com/orphan-fail-request' }
+      });
+
+      await snap;
+
+      expect(logger.stderr).toEqual(jasmine.arrayContaining([
+        jasmine.stringMatching(/Failed to abort oversized response for http:\/\/example\.com\/orphan-fail-request: Target closed/)
+      ]));
+    });
+
+    it('silently swallows Fetch.continueResponse benign races (ABORTED_MESSAGE)', async () => {
+      spyOn(Session.prototype, 'send').and.callFake(function(method, params) {
+        if (method === 'Fetch.continueResponse' && params?.requestId === 'continue-aborted-intercept') {
+          return Promise.reject(new Error('Request was aborted by browser'));
+        }
+        return Session.prototype.send.and.originalFn.call(this, method, params);
+      });
+
+      let snap = percy.snapshot({
+        name: 'continue-response aborted snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: testDOM
+      });
+
+      await waitFor(() => percy.browser.sessions.size > 0);
+      let [session] = percy.browser.sessions.values();
+
+      session.emit('Fetch.requestPaused', {
+        networkId: 'continue-aborted-id',
+        requestId: 'continue-aborted-intercept',
+        responseStatusCode: 200,
+        responseHeaders: [],
+        request: { url: 'http://example.com/orphan-continue-aborted' }
+      });
+
+      await snap;
+
+      expect(logger.stderr).not.toEqual(jasmine.arrayContaining([
+        jasmine.stringMatching(/Failed to continue response for http:\/\/example\.com\/orphan-continue-aborted/)
+      ]));
+    });
+
+    it('logs gracefully when Fetch.continueResponse fails with unexpected error', async () => {
+      spyOn(Session.prototype, 'send').and.callFake(function(method, params) {
+        if (method === 'Fetch.continueResponse' && params?.requestId === 'continue-error-intercept') {
+          return Promise.reject(new Error('Target closed'));
+        }
+        return Session.prototype.send.and.originalFn.call(this, method, params);
+      });
+
+      let snap = percy.snapshot({
+        name: 'continue-response error snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: testDOM
+      });
+
+      await waitFor(() => percy.browser.sessions.size > 0);
+      let [session] = percy.browser.sessions.values();
+
+      session.emit('Fetch.requestPaused', {
+        networkId: 'continue-error-id',
+        requestId: 'continue-error-intercept',
+        responseStatusCode: 200,
+        responseHeaders: [],
+        request: { url: 'http://example.com/orphan-continue-error' }
+      });
+
+      await snap;
+
+      expect(logger.stderr).toEqual(jasmine.arrayContaining([
+        jasmine.stringMatching(/Failed to continue response for http:\/\/example\.com\/orphan-continue-error: Target closed/)
+      ]));
+    });
+
+    it('logs gracefully when the direct-fetch fallback fails', async () => {
+      // Drop Network.responseReceived for one asset so it enters the
+      // RESPONSE_RECEIVED_TIMEOUT path that calls captureResourceDirectly,
+      // then make the direct fetch return 400 so the catch logs.
+      spyOn(percy.browser, '_handleMessage').and.callFake(function(data) {
+        let parsed; try { parsed = JSON.parse(data); } catch { /* binary */ }
+        if (parsed?.method === 'Network.responseReceived' &&
+            parsed?.params?.response?.url?.endsWith('/direct-fetch-target.css')) {
+          return;
+        }
+        this._handleMessage.and.originalFn.call(this, data);
+      });
+
+      let assetHits = 0;
+      server.reply('/direct-fetch-target.css', () => {
+        assetHits += 1;
+        if (assetHits === 1) return [200, 'text/css', 'p { color: blue; }'];
+        return [400, 'text/plain', 'bad request'];
+      });
+
+      let targetDOM = '<html><head><link href="direct-fetch-target.css" rel="stylesheet"/></head><body><p>x</p></body></html>';
+
+      await percy.snapshot({
+        name: 'direct-fetch failure snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: targetDOM
+      });
+
+      await percy.idle();
+
+      expect(logger.stderr).toEqual(jasmine.arrayContaining([
+        jasmine.stringMatching(/Direct fetch failed for http:\/\/localhost:8000\/direct-fetch-target\.css -/)
+      ]));
+    });
+
+    it('logs when Network.getCookies fails during direct-fetch fallback', async () => {
+      spyOn(percy.browser, '_handleMessage').and.callFake(function(data) {
+        let parsed; try { parsed = JSON.parse(data); } catch { /* binary */ }
+        if (parsed?.method === 'Network.responseReceived' &&
+            parsed?.params?.response?.url?.endsWith('/cookies-fail.css')) {
+          return;
+        }
+        this._handleMessage.and.originalFn.call(this, data);
+      });
+
+      spyOn(Session.prototype, 'send').and.callFake(function(method, params) {
+        if (method === 'Network.getCookies' && params?.urls?.[0]?.includes('cookies-fail.css')) {
+          return Promise.reject(new Error('Internal error'));
+        }
+        return Session.prototype.send.and.originalFn.call(this, method, params);
+      });
+
+      server.reply('/cookies-fail.css', () => [200, 'text/css', 'p { color: blue; }']);
+      let targetDOM = '<html><head><link href="cookies-fail.css" rel="stylesheet"/></head><body><p>x</p></body></html>';
+
+      await percy.snapshot({
+        name: 'cookies fail snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: targetDOM
+      });
+
+      await percy.idle();
+
+      expect(logger.stderr).toEqual(jasmine.arrayContaining([
+        jasmine.stringMatching(/Network\.getCookies unavailable for http:\/\/localhost:8000\/cookies-fail\.css: Internal error/)
+      ]));
+    });
+
+    it('skips direct-fetched resource when body exceeds 25MB', async () => {
+      spyOn(percy.browser, '_handleMessage').and.callFake(function(data) {
+        let parsed; try { parsed = JSON.parse(data); } catch { /* binary */ }
+        if (parsed?.method === 'Network.responseReceived' &&
+            parsed?.params?.response?.url?.endsWith('/oversized.css')) {
+          return;
+        }
+        this._handleMessage.and.originalFn.call(this, data);
+      });
+
+      let assetHits = 0;
+      // 17MB exceeds MAX_RESOURCE_SIZE (≈15.75 MB after base64 factor)
+      let oversizedBody = Buffer.alloc(17 * 1024 * 1024, 'x');
+      server.reply('/oversized.css', () => {
+        assetHits += 1;
+        if (assetHits === 1) return [200, 'text/css', 'p { color: blue; }'];
+        return [200, 'text/css', oversizedBody];
+      });
+
+      let targetDOM = '<html><head><link href="oversized.css" rel="stylesheet"/></head><body><p>x</p></body></html>';
+
+      await percy.snapshot({
+        name: 'oversized direct-fetch snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: targetDOM
+      });
+
+      await percy.idle();
+
+      expect(logger.stderr).toEqual(jasmine.arrayContaining([
+        jasmine.stringMatching(/Skipping resource larger than 25MB/)
+      ]));
+    });
+
+    it('uses server Content-Type for direct-fetch mimetype when URL has no extension', async () => {
+      // For URLs with no recognizable extension, the direct-fetch path must
+      // honor the server's Content-Type response header rather than guessing
+      // a default. Server returns 'application/octet-stream' → that wins.
+      spyOn(percy.browser, '_handleMessage').and.callFake(function(data) {
+        let parsed; try { parsed = JSON.parse(data); } catch { /* binary */ }
+        if (parsed?.method === 'Network.responseReceived' &&
+            parsed?.params?.response?.url?.endsWith('/asset-no-ext')) {
+          return;
+        }
+        this._handleMessage.and.originalFn.call(this, data);
+      });
+
+      let assetHits = 0;
+      server.reply('/asset-no-ext', () => {
+        assetHits += 1;
+        if (assetHits === 1) return [200, 'text/css', 'p { color: blue; }'];
+        return [200, 'application/octet-stream', 'p { color: red; }'];
+      });
+
+      let targetDOM = '<html><head><link href="asset-no-ext" rel="stylesheet"/></head><body><p>x</p></body></html>';
+
+      await percy.snapshot({
+        name: 'unknown extension direct-fetch snapshot',
+        url: 'http://localhost:8000',
+        domSnapshot: targetDOM
+      });
+
+      await percy.idle();
+
+      expect(logger.stderr).toEqual(jasmine.arrayContaining([
+        jasmine.stringMatching(/Saving direct-fetched resource sha=[a-f0-9]+ mimetype=application\/octet-stream/)
+      ]));
+    });
   });
 
   describe('with remote resources', () => {
@@ -3791,10 +4181,16 @@ describe('Discovery', () => {
 
       let validationCallCount = 0;
       let validationResolver;
+      let firstCallResolver;
+      let firstCallPromise = new Promise(resolve => { firstCallResolver = resolve; });
 
       // Mock validation to hang so we can test concurrent requests
       validationMock.and.callFake(() => {
         validationCallCount++;
+        if (firstCallResolver) {
+          firstCallResolver();
+          firstCallResolver = null;
+        }
         return new Promise(resolve => {
           validationResolver = resolve;
         });
@@ -3824,13 +4220,8 @@ describe('Discovery', () => {
         widths: [1000]
       });
 
-      // Wait for validation to be called at least once
-      let attempts = 0;
-      // eslint-disable-next-line no-unmodified-loop-condition
-      while (validationCallCount === 0 && attempts < 50) {
-        await new Promise(resolve => setTimeout(resolve, 10));
-        attempts++;
-      }
+      // Wait deterministically for the first validation call instead of polling
+      await firstCallPromise;
 
       // Validation should only be called once
       expect(validationCallCount).toBe(1);
@@ -4228,12 +4619,14 @@ describe('Discovery', () => {
     });
 
     it('should fail to launch if the devtools address is not logged', async () => {
+      // --version exits cleanly on Linux Chrome 143; --remote-debugging-port=null still exits on Windows.
+      let earlyExitArg = process.platform === 'win32' ? '--remote-debugging-port=null' : '--version';
       await expectAsync(Percy.start({
         token: 'PERCY_TOKEN',
         snapshot: { widths: [1000] },
         discovery: {
           launchOptions: {
-            args: ['--remote-debugging-port=null']
+            args: [earlyExitArg]
           }
         }
       })).toBeRejectedWithError(
diff --git a/packages/core/test/helpers/server.js b/packages/core/test/helpers/server.js
index ad8d0bdf0..7dc1aac5a 100644
--- a/packages/core/test/helpers/server.js
+++ b/packages/core/test/helpers/server.js
@@ -28,8 +28,14 @@ export function createTestServer({ default: defaultReply, ...replies }, port = 8
   server.route(async (req, res, next) => {
     let pathname = req.url.pathname;
     if (req.url.search) pathname += req.url.search;
-    server.requests.push(req.body ? [pathname, req.body, req.headers] : [pathname, req.headers]);
     let reply = replies[pathname] || defaultReply;
+    // Chrome >=128 auto-fetches /favicon.ico on every navigation; reply 204
+    // by default so it doesn't pollute snapshot resources. Tests can still
+    // override via `server.reply('/favicon.ico', ...)`.
+    if (req.url.pathname === '/favicon.ico' && !replies['/favicon.ico']) {
+      return res.writeHead(204).end();
+    }
+    server.requests.push(req.body ? [pathname, req.body, req.headers] : [pathname, req.headers]);
     return reply ? await reply(req, res) : next();
   });
 
diff --git a/packages/core/test/percy.test.js b/packages/core/test/percy.test.js
index e40509bb8..59cf16565 100644
--- a/packages/core/test/percy.test.js
+++ b/packages/core/test/percy.test.js
@@ -542,11 +542,11 @@ describe('Percy', () => {
         percy.snapshot({
           url: 'http://localhost:8000/snapshot-1'
         }),
-        // should not upload
+        // should not upload — bumped from 100ms to 1000ms so snapshot-1's
+        // upload reliably fails first even when CI runs the suite slowly
         percy.snapshot({
           url: 'http://localhost:8000/snapshot-2',
-          // delay this snapshot so the first upload can fail
-          waitForTimeout: 100
+          waitForTimeout: 1000
         })
       ]);
 
diff --git a/packages/core/test/snapshot.test.js b/packages/core/test/snapshot.test.js
index b8dbebad2..45274ef6e 100644
--- a/packages/core/test/snapshot.test.js
+++ b/packages/core/test/snapshot.test.js
@@ -879,7 +879,20 @@ describe('Snapshot', () => {
       errors: [{ detail: 'unexpected upload error' }]
     }]);
 
+    // Use a setter so a no-op catch is attached the moment percy.snapshot assigns
+    // the promise (percy.js:495). Without this, the upload can reject before the
+    // next line runs and Node reports an unhandled rejection.
     const promise = {};
+    let testSnapshotPromise;
+    Object.defineProperty(promise, 'test snapshot', {
+      configurable: true,
+      enumerable: true,
+      get() { return testSnapshotPromise; },
+      set(p) {
+        testSnapshotPromise = p;
+        p.catch(() => {});
+      }
+    });
     await percy.snapshot({
       name: 'test snapshot',
       url: 'http://localhost:8000',
@@ -1535,10 +1548,13 @@ describe('Snapshot', () => {
 
       await percy.idle();
 
+      // Chrome >=128 entity-escapes `<`/`>` inside attribute values per HTML5
+      // spec; pre-128 left them literal. Accept either form (e.g.
+      // `srcdoc="<p>Foo</p>"` or `srcdoc="&lt;p&gt;Foo&lt;/p&gt;"`).
       expect(Buffer.from((
         api.requests['/builds/123/resources'][0]
           .body.data.attributes['base64-content']
-      ), 'base64').toString()).toMatch(/<iframe.*srcdoc=".*<p>Foo<\/p>/);
+      ), 'base64').toString()).toMatch(/<iframe.*srcdoc=".*(?:<p>Foo<\/p>|&lt;p&gt;Foo&lt;\/p&gt;)/);
     });
 
     it('errors if execute cannot be serialized', async () => {
diff --git a/packages/core/test/unit/network.test.js b/packages/core/test/unit/network.test.js
index ac5e678a3..f45e8e969 100644
--- a/packages/core/test/unit/network.test.js
+++ b/packages/core/test/unit/network.test.js
@@ -1,5 +1,5 @@
 import { setupTest } from '../helpers/index.js';
-import { Network, AbortCodes } from '../../src/network.js';
+import { Network, AbortCodes, pickCookieSession, shouldAttachAuth, raceWithTimeout, resolveDirectFetchMime } from '../../src/network.js';
 import { AbortError } from '../../src/utils.js';
 
 describe('Unit / Network', () => {
@@ -53,4 +53,85 @@ describe('Unit / Network', () => {
       expect(err.message).toBe('msg');
     });
   });
+
+  // pickCookieSession — prefer the page's full Network domain, fall back to
+  // the request's own session for worker/auxiliary paths.
+  describe('pickCookieSession', () => {
+    it('returns the page session when network.page.session is set', () => {
+      let pageSession = { id: 'page' };
+      let fallback = { id: 'fallback' };
+      expect(pickCookieSession({ page: { session: pageSession } }, fallback)).toBe(pageSession);
+    });
+
+    it('falls back to the passed session when network.page is undefined', () => {
+      let fallback = { id: 'fallback' };
+      expect(pickCookieSession({ page: undefined }, fallback)).toBe(fallback);
+    });
+
+    it('falls back to the passed session when network.page lacks a session', () => {
+      let fallback = { id: 'fallback' };
+      expect(pickCookieSession({ page: {} }, fallback)).toBe(fallback);
+    });
+  });
+
+  // shouldAttachAuth — re-enforces the same-origin rule for the Node-side
+  // direct fetch to avoid leaking Basic auth credentials cross-origin.
+  describe('shouldAttachAuth', () => {
+    it('returns false when authorization is missing or has no username', () => {
+      expect(shouldAttachAuth(undefined, 'http://a.com/x', 'http://a.com')).toBe(false);
+      expect(shouldAttachAuth({}, 'http://a.com/x', 'http://a.com')).toBe(false);
+      expect(shouldAttachAuth({ username: '' }, 'http://a.com/x', 'http://a.com')).toBe(false);
+    });
+
+    it('returns true when authorization is set and origins match', () => {
+      expect(shouldAttachAuth({ username: 'u' }, 'http://a.com/x.css', 'http://a.com/page')).toBe(true);
+    });
+
+    it('returns false when origins differ (cross-origin auth must not leak)', () => {
+      expect(shouldAttachAuth({ username: 'u' }, 'http://a.com/x.css', 'http://b.com/page')).toBe(false);
+    });
+
+    it('returns false when either URL is malformed (defensive)', () => {
+      expect(shouldAttachAuth({ username: 'u' }, 'not a url', 'http://a.com')).toBe(false);
+      expect(shouldAttachAuth({ username: 'u' }, 'http://a.com', undefined)).toBe(false);
+    });
+  });
+
+  // raceWithTimeout — caps any async work at a wall-clock budget. The
+  // direct-fetch fallback uses this to keep a hanging worker host from
+  // blocking the snapshot pipeline.
+  describe('raceWithTimeout', () => {
+    it('resolves with the promise value when it settles before the timeout', async () => {
+      let value = await raceWithTimeout(Promise.resolve('ok'), 50, 'timeout');
+      expect(value).toBe('ok');
+    });
+
+    it('rejects with the timeout message when the promise hangs past the budget', async () => {
+      let neverSettles = new Promise(() => {});
+      await expectAsync(raceWithTimeout(neverSettles, 10, 'too slow')).toBeRejectedWithError('too slow');
+    });
+
+    it('propagates the original rejection when the promise rejects before the timeout', async () => {
+      let failing = Promise.reject(new Error('boom'));
+      await expectAsync(raceWithTimeout(failing, 50, 'timeout')).toBeRejectedWithError('boom');
+    });
+  });
+
+  // resolveDirectFetchMime — server header > URL ext > binary default.
+  describe('resolveDirectFetchMime', () => {
+    it('returns the bare server MIME, stripping parameters', () => {
+      expect(resolveDirectFetchMime({ 'content-type': 'text/css' }, '/x')).toBe('text/css');
+      expect(resolveDirectFetchMime({ 'content-type': 'text/css; charset=utf-8' }, '/x')).toBe('text/css');
+    });
+
+    it('falls back to URL-extension mime when no server header', () => {
+      expect(resolveDirectFetchMime({}, '/file.css')).toBe('text/css');
+      expect(resolveDirectFetchMime(undefined, '/file.png')).toBe('image/png');
+    });
+
+    it('falls back to application/octet-stream when neither header nor URL extension is recognized', () => {
+      expect(resolveDirectFetchMime({}, '/no-ext')).toBe('application/octet-stream');
+      expect(resolveDirectFetchMime({ 'content-type': '' }, '/no-ext')).toBe('application/octet-stream');
+    });
+  });
 });