FiveM October 14 — CEF v144 Hits Canary With Breaking NUI Changes, Plus A GTAV Enhanced Hotfix

Two things landed on October 14, 2026, and they're very different in character. First: CFX have begun rolling out a Chromium Embedded Framework upgrade for FiveM Legacy and RedM, moving CEF v103 to v144 — available on the Canary channel now, and re-enabling WebAssembly (WASM) support. Second: the FiveM for GTA V Enhanced Early Access hotfix, whose headline is the return of SetNuiFocusKeepInput.

The CEF upgrade comes with a long list of breaking changes, and CFX expect to push it to all release channels within the next few days once regressions are ironed out. That window is the important part: you can test on Canary now, before it lands on stable.

⚠️ CEF v144: The Breaking Changes

This is the part that matters if you run or write NUI resources, because very little of it is cosmetic:

• alert() and confirm() are no longer available inside NUI resources. If your UI depends on browser dialogs for confirmations or debugging, they will simply stop working.
• Microphone and camera permission requests are limited to the parent resource — iframes inside NUI resources will be blocked from requesting or using them. Anything that embeds voice or camera access in an iframe needs restructuring.
• WebUSB, WebBluetooth, WebHID, SerialAPI and printing pages are now blocked in NUI.
• Copying to the clipboard with document.execCommand('copy') now requires the element to be focused — for example by calling element.focus() first.
• JS mutation events such as DOMNodeInserted and DOMSubtreeModified have been removed. MutationObserver should be used in their place.
• The CSS zoom property has been standardised, and the old behaviour is gone. UI that leaned on zoom for scaling may need re-tuning.
• Chrome APIs that would access elements outside the game — picture-in-picture, for example — are now disabled and will throw an error.
• Cookie expiry is now capped at a maximum of 400 days, and existing cookies that exceeded it have been migrated to the new limit.
• Secure-context checks now apply properly: sites that check for a secure context (https) may block access in non-secure contexts. This affects resources using manifest versions adamant and bodacious, or the legacy _resource.lua manifest. Use the cerulean resource manifest version instead.
• Network requests are now throttled if a large amount of requests is received.
• URL can now throw errors on forbidden characters such as <, > and |.

🧪 The Manifest Item Is The One To Fix First

Most of that list is a resource-by-resource problem you can find by testing. The manifest note is different — it's a changed requirement, not a behaviour change, and it lands on every resource in your server folder that still ships an old manifest.

Resources on adamant, bodacious or the legacy _resource.lua can now be blocked where a page or API checks for a secure context. Moving to the cerulean manifest is the fix, and it's the sort of change worth making deliberately, outside a busy evening, rather than discovering when a phone or an admin menu stops loading.

🖥️ What To Do Before It Reaches Stable

• Test your NUI-heavy resources on Canary now. The upgrade is on Canary first precisely so regressions surface before stable. Your chat, phone, inventory, banking, admin menus and any custom reports UI are the things to put through their paces.
• Hunt for alert() and confirm(). They're the single most common dependency in this list and the easiest to grep for. Anything relying on them needs a real UI element instead.
• Check iframes for mic and camera access. Permissions are now limited to the parent resource, so embedded iframes can't request or use them — that directly affects voice, camera and identity-style resources that sandbox their UI.
• Audit your manifests. Bulk-move to cerulean and you remove the largest single source of post-upgrade breakage in one pass.
• Re-check clipboard code paths. If a resource copies text from an NUI (invite links, share codes, admin actions), it now needs the element focused before execCommand('copy'). The modern Clipboard API is the better long-term move.
• Look for mutation-event listeners. DOMNodeInserted and DOMSubtreeModified are gone; the replacement is MutationObserver. Framework code and older UI libraries are the likely holders.
• Watch polling loops. With network requests throttled under heavy load, a resource that polls aggressively will feel it — generally a good reason to move to events anyway.
• WASM is back, and that's an opportunity. Resources that wanted WebAssembly for heavier client-side work — image processing, parsers, simulation — have a much bigger ceiling on what they can do natively in the UI layer.

🎮 GTA V Enhanced: Early Access Hotfix — October 14

• SetNuiFocusKeepInput is fixed — a long-standing issue (#555) that had broken the ability to use game controls while a NUI interface is in focus. It's restored.
• Various stability and performance improvements round out the patch.

Don't let the single line understate this one. SetNuiFocusKeepInput is what lets players keep moving — and keep driving — while an interface has their cursor. Without it, opening a phone, a chat window or any custom UI means the game goes deaf to movement input, which is why so many servers carefully choreograph which interfaces they allow while a player is in a vehicle. Restoring it removes a constraint a lot of resource logic was written around, and it's exactly the sort of fix players feel instantly and can't articulate.

🖥️ What This Means For Your Server

• The SetNuiFocusKeepInput fix is safe to deploy now. It's a stable-channel behaviour fix that restores expected input handling — patch the server build alongside the client and your players get game controls back while interfaces are focused.
• The CEF upgrade is not a "deploy now" item — it's a "prepare now" item. On Canary today, planned for all release channels within days. Treat the next few days as your test window rather than the morning it reaches stable.
• Your custom UI is your exposure. Framework UIs get patched by their authors; the bespoke phone, banking, job or admin menus your community actually lives in are the ones most likely to lean on alert(), confirm(), clipboard writes or iframe permissions. Inventory those resources first.
• The manifest change is the cheapest insurance available. Moving to cerulean resolves the secure-context problem for every affected resource in a single sweep, and it's a config edit rather than a rewrite.
• Expect a short, noisy transition window. A Chromium jump of 41 major versions changes a lot of underlying behaviour. Bug reports in the days after the stable rollout are more likely to be CEF-related than your scripts — worth telling your dev team so nobody chases a phantom in their own code.
• Keep a rollback plan. CFX are explicitly rolling this out early to catch regressions before broad release. If something critical breaks on your live server after stable, having a known-good resource set to fall back to is worth more than a fast fix.

Running a FiveM community? NolimitHost FiveM server hosting keeps you on current builds with fast high-clock CPUs, NVMe storage, DDoS protection and automated backups. And if a heavy UI change means bigger client downloads, FiveM Resource Caching serves that content from our edge instead of your game server.

Conclusion

October 14 brought two very different updates. The CEF upgrade — v103 to v144 — is live on Canary for FiveM Legacy and RedM and re-enables WASM, at the cost of a substantial breaking-change list: no alert() or confirm() in NUI, mic and camera permissions limited to the parent resource with iframes blocked, WebUSB, WebBluetooth, WebHID, SerialAPI and printing blocked, clipboard copies now needing a focused element, DOM mutation events replaced by MutationObserver, CSS zoom standardised, 400-day cookie expiry cap, request throttling, URL errors on forbidden characters, and a manifest requirement to move to cerulean for resources on adamant, bodacious or _resource.lua. It reaches all release channels in the next few days.

The GTA V Enhanced Early Access hotfix is the one to apply today: it fixes SetNuiFocusKeepInput, restoring the ability to use game controls while a NUI interface is focused, alongside general stability and performance improvements.

Patch the server build now, then set aside time to run your NUI resources on Canary before the CEF upgrade reaches stable.