[Aaronontheweb]

Bumps PlaywrightVersion from 1.52.0 to 1.64.1 (affects both Microsoft.Playwright and Microsoft.Playwright.MSTest).

Why

Playwright 1.52.0 bundles a Chromium build predating the Chrome 156.0.8078.73 security release, which fixes four Critical CVEs:

• CVE-2026-118306 — memory corruption in FileSystem
• CVE-2026-118331 — improper input validation in FileAPI
• CVE-2026-118348 — improper input validation in Skia
• CVE-2026-118344 — use-after-free in Layout

Caveat worth knowing

1.64.1 bundles Chromium 156.0.8078.4, still below the 156.0.8078.73 fix line. This bump moves off an older Chromium but does not fully remediate those CVEs on its own. Full remediation needs Channel = "chrome" (system Chrome) or Playwright 1.65+ (bundles 158.0.8127.2).

I deliberately did not add Channel = "chrome": pr_validation.yaml caches ~/.cache/ms-playwright keyed on PlayWrightVersion, so switching to system Chrome would break the E2E job unless the runners also provision Chrome.

Verification

• dotnet restore succeeds; project.assets.json resolves Microsoft.Playwright/1.64.1 in DrawTogether.End2End.Tests.