diff --git a/Makefile.am b/Makefile.am
index 183c093085fd..230dfb918505 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -85,15 +85,12 @@ clean-local::
 	find $(builddir) -name '*.gc??' -delete
 	find $(srcdir) -name '*.pyc' -delete
 
-# required for running unit and integration tests; commander and ws are deps of chrome-remote-interface
+# required for running integration tests
 node_modules/%: $(srcdir)/package-lock.json
 	@true
 
 EXTRA_DIST += \
-	node_modules/chrome-remote-interface \
-	node_modules/commander \
 	node_modules/sizzle \
-	node_modules/ws \
 	$(NULL)
 
 check: export VERBOSE=1
diff --git a/pyproject.toml b/pyproject.toml
index 3a75f3c77d94..e9b00ff62166 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -66,6 +66,7 @@ module = [
     # test/common
     'cdp',
     'testlib',
+    'webdriver_bidi',
 ]
 
 [tool.pylint]
diff --git a/test/common/cdp.py b/test/common/cdp.py
index 19a52ef8e4f3..143fcce47534 100644
--- a/test/common/cdp.py
+++ b/test/common/cdp.py
@@ -58,7 +58,7 @@ def path(self, show_browser: bool) -> str:
 
     @abc.abstractmethod
     def cmd(
-        self, cdp_port: int, env: Mapping[str, str], show_browser: bool, browser_home: str, download_dir: str
+        self, cdp_port: int, env: Mapping[str, str], show_browser: bool, download_dir: str
     ) -> Sequence[str]:
         pass
 
@@ -96,7 +96,7 @@ def _path(self, show_browser: bool) -> str | None:
 
     @override
     def cmd(
-        self, cdp_port: int, env: Mapping[str, str], show_browser: bool, browser_home: str, download_dir: str
+        self, cdp_port: int, env: Mapping[str, str], show_browser: bool, download_dir: str
     ) -> Sequence[str]:
         exe = self.path(show_browser)
 
@@ -110,65 +110,6 @@ def cmd(
                 "--v=0", f"--remote-debugging-port={cdp_port}", "about:blank"]
 
 
-class Firefox(Browser):
-    NAME = "firefox"
-    EXECUTABLES = ["firefox-developer-edition", "firefox-nightly", "firefox"]
-    CDP_DRIVER_FILENAME = f"{TEST_DIR}/common/firefox-cdp-driver.js"
-
-    @override
-    def _path(self, show_browser: bool) -> str | None:
-        """Return path to Firefox browser."""
-        return self.find_exe()
-
-    @override
-    def cmd(
-        self, cdp_port: int, env: Mapping[str, str], show_browser: bool, browser_home: str, download_dir: str
-    ) -> Sequence[str]:
-        exe = self.path(show_browser)
-
-        subprocess.check_call([exe, "--headless", "--no-remote", "-CreateProfile", "blank"], env=env)
-        profile = glob.glob(os.path.join(browser_home, ".mozilla/firefox/*.blank"))[0]
-
-        with open(os.path.join(profile, "user.js"), "w") as f:
-            f.write(f"""
-                user_pref("remote.enabled", true);
-                user_pref("remote.frames.enabled", true);
-                user_pref("app.update.auto", false);
-                user_pref("datareporting.policy.dataSubmissionEnabled", false);
-                user_pref("toolkit.telemetry.reportingpolicy.firstRun", false);
-                user_pref("dom.disable_beforeunload", true);
-                user_pref("browser.download.dir", "{download_dir}");
-                user_pref("browser.download.folderList", 2);
-                user_pref("signon.rememberSignons", false);
-                user_pref("dom.navigation.locationChangeRateLimit.count", 9999);
-                // HACK: https://bugzilla.mozilla.org/show_bug.cgi?id=1746154
-                user_pref("fission.webContentIsolationStrategy", 0);
-                user_pref("fission.bfcacheInParent", false);
-                """)
-
-        with open(os.path.join(profile, "handlers.json"), "w") as f:
-            f.write('{'
-                    '"defaultHandlersVersion":{"en-US":4},'
-                    '"mimeTypes":{"application/xz":{"action":0,"extensions":["xz"]}}'
-                    '}')
-
-        cmd = [exe, "-P", "blank", f"--remote-debugging-port={cdp_port}", "--no-remote", "localhost"]
-        if not show_browser:
-            cmd.insert(3, "--headless")
-        return cmd
-
-
-def get_browser(browser: str) -> Browser:
-    browser_classes = [
-        Chromium,
-        Firefox,
-    ]
-    for cls in browser_classes:
-        if browser == cls.NAME:
-            return cls()
-    raise SystemError(f"Unsupported browser: {browser}")
-
-
 def jsquote(obj: object) -> str:
     return json.dumps(obj)
 
@@ -195,7 +136,7 @@ def __init__(
         self.trace = trace
         self.inject_helpers = inject_helpers
         self.start_profile = start_profile
-        self.browser = get_browser(os.environ.get("TEST_BROWSER", "chromium"))
+        self.browser = Chromium()
         self.show_browser = bool(os.environ.get("TEST_SHOW_BROWSER", ""))
         self.download_dir = tempfile.mkdtemp()
         self._driver = None
@@ -322,8 +263,7 @@ def start(self) -> None:
             except KeyError:
                 pass
 
-            cmd = self.browser.cmd(cdp_port, environ, self.show_browser,
-                                   self._browser_home, self.download_dir)
+            cmd = self.browser.cmd(cdp_port, environ, self.show_browser, self.download_dir)
 
             # sandboxing does not work in Docker container
             self._browser = subprocess.Popen(
diff --git a/test/common/firefox-cdp-driver.js b/test/common/firefox-cdp-driver.js
deleted file mode 100755
index 1d7d78291b39..000000000000
--- a/test/common/firefox-cdp-driver.js
+++ /dev/null
@@ -1,397 +0,0 @@
-#!/usr/bin/env node
-
-/*
- * This file is part of Cockpit.
- *
- * Copyright (C) 2019 Red Hat, Inc.
- *
- * Cockpit is free software; you can redistribute it and/or modify it
- * under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation; either version 2.1 of the License, or
- * (at your option) any later version.
- *
- * Cockpit is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with Cockpit; If not, see <http://www.gnu.org/licenses/>.
- */
-
-/* firefox-cdp-driver -- A command-line JSON input/output wrapper around
- * chrome-remote-interface (Chrome Debug Protocol).
- * See https://chromedevtools.github.io/devtools-protocol/
- * This needs support for protocol version 1.3.
- *
- * Set $TEST_CDP_DEBUG environment variable to enable additional
- * frame/execution context debugging.
- */
-
-import * as readline from 'readline';
-import CDP from 'chrome-remote-interface';
-
-let enable_debug = false;
-
-function debug(msg) {
-    if (enable_debug)
-        process.stderr.write("CDP: " + msg + "\n");
-}
-
-/**
- * Format response to the client
- */
-
-function fatal() {
-    console.error.apply(console.error, arguments);
-    process.exit(1);
-}
-
-// We keep sequence numbers so that we never get the protocol out of
-// synch with re-ordered or duplicate replies.  This only matters for
-// duplicate replies due to destroyed contexts, but that is already so
-// hairy that this big hammer seems necessary.
-
-let cur_cmd_seq = 0;
-let next_reply_seq = 1;
-
-function fail(seq, err) {
-    if (seq != next_reply_seq)
-        return;
-    next_reply_seq++;
-
-    if (typeof err === 'undefined')
-        err = null;
-    process.stdout.write(JSON.stringify({ error: err }) + '\n');
-}
-
-function success(seq, result) {
-    if (seq != next_reply_seq)
-        return;
-    next_reply_seq++;
-
-    if (typeof result === 'undefined')
-        result = null;
-    process.stdout.write(JSON.stringify({ result }) + '\n');
-}
-
-/**
- * Record console.*() calls and Log messages so that we can forward them to
- * stderr and dump them on test failure
- */
-const messages = [];
-let logPromiseResolver;
-let nReportedLogMessages = 0;
-const unhandledExceptions = [];
-
-function clearExceptions() {
-    unhandledExceptions.length = 0;
-    return Promise.resolve();
-}
-
-function stringifyConsoleArg(arg) {
-    if (arg.type === 'string')
-        return arg.value;
-    if (arg.type === 'object')
-        return JSON.stringify(arg.value);
-    return JSON.stringify(arg);
-}
-
-function setupLogging(client) {
-    client.Runtime.enable();
-
-    client.Runtime.consoleAPICalled(info => {
-        const msg = info.args.map(stringifyConsoleArg).join(" ");
-        messages.push([info.type, msg]);
-        process.stderr.write("> " + info.type + ": " + msg + "\n");
-
-        resolveLogPromise();
-    });
-
-    function processException(info) {
-        let details = info.exceptionDetails;
-        if (details.exception)
-            details = details.exception;
-
-        // don't log test timeouts, they already get handled
-        if (details.className === "PhWaitCondTimeout")
-            return;
-
-        process.stderr.write(details.description || details.text || JSON.stringify(details) + "\n");
-
-        unhandledExceptions.push(details.message ||
-                                 details.description ||
-                                 details.value ||
-                                 JSON.stringify(details));
-    }
-
-    client.Runtime.exceptionThrown(info => processException(info));
-
-    client.Log.enable();
-    client.Log.entryAdded(entry => {
-        // HACK: Firefox does not implement `Runtime.exceptionThrown` but logs it
-        // Lets parse it to have at least some basic check that code did not throw
-        // exception
-        // https://bugzilla.mozilla.org/show_bug.cgi?id=1549528
-
-        const msg = entry.entry;
-        let text = msg.text;
-        if (typeof text !== "string")
-            if (text[0] && typeof text[0] === "string")
-                text = text[0];
-
-        if (msg.stackTrace !== undefined &&
-            typeof text === "string" &&
-            text.indexOf("Error: ") !== -1) {
-            const trace = text.split(": ", 1);
-            processException({
-                exceptionDetails: {
-                    exception: {
-                        className: trace[0],
-                        message: trace.length > 1 ? trace[1] : "",
-                        stacktrace: msg.stackTrace,
-                        entry: msg,
-                    },
-                }
-            });
-        } else {
-            messages.push(["cdp", msg]);
-            /* Ignore authentication failure log lines that don't denote failures */
-            if (!(msg.url || "").endsWith("/login") || (text || "").indexOf("401") === -1) {
-                process.stderr.write("CDP: " + JSON.stringify(msg) + "\n");
-            }
-            resolveLogPromise();
-        }
-    });
-}
-
-/**
- * Resolve the log promise created with waitLog().
- */
-function resolveLogPromise() {
-    if (logPromiseResolver) {
-        logPromiseResolver(messages.slice(nReportedLogMessages));
-        nReportedLogMessages = messages.length;
-        logPromiseResolver = undefined;
-    }
-}
-
-/**
- * Returns a promise that resolves when log messages are available. If there
- * are already some unreported ones in the global messages variable, resolves
- * immediately.
- *
- * Only one such promise can be active at a given time. Once the promise is
- * resolved, this function can be called again to wait for further messages.
- */
-function waitLog() { // eslint-disable-line no-unused-vars
-    console.assert(logPromiseResolver === undefined);
-
-    return new Promise((resolve, reject) => {
-        logPromiseResolver = resolve;
-
-        if (nReportedLogMessages < messages.length)
-            resolveLogPromise();
-    });
-}
-
-/**
- * Frame tracking
- *
- * For tests to be able to select the current frame (by its name) and make
- * subsequent queries apply to that, we need to track frame name → frameId →
- * executionContextId. Frame and context IDs can even change through page
- * operations (e. g. in systemd/logs.js when reporting a crash is complete),
- * so we also need a helper function to explicitly wait for a particular frame
- * to load. This is very laborious, see this issue for discussing improvements:
- * https://github.com/ChromeDevTools/devtools-protocol/issues/72
- */
-const scriptsOnNewContext = [];
-const frameIdToContextId = {};
-const frameNameToFrameId = {};
-
-let pageLoadHandler = null;
-let currentExecId = null;
-
-function setupFrameTracking(client) {
-    client.Page.enable();
-
-    // map frame names to frame IDs; root frame has no name, no need to track that
-    client.Page.frameNavigated(info => {
-        if (info.frame?.url?.startsWith("about:")) {
-            debug("frameNavigated: ignoring about: frame " + JSON.stringify(info));
-            return;
-        }
-        debug("frameNavigated " + JSON.stringify(info));
-        frameNameToFrameId[info.frame.name || "cockpit1"] = info.frame.id;
-    });
-
-    client.Page.loadEventFired(() => {
-        if (pageLoadHandler) {
-            debug("loadEventFired, calling pageLoadHandler");
-            pageLoadHandler();
-        } else {
-            debug("loadEventFired, but no pageLoadHandler");
-        }
-    });
-
-    // track execution contexts so that we can map between context and frame IDs
-    client.Runtime.executionContextCreated(info => {
-        debug("executionContextCreated " + JSON.stringify(info));
-        frameIdToContextId[info.context.auxData.frameId] = info.context.id;
-        scriptsOnNewContext.forEach(s => {
-            client.Runtime.evaluate({ expression: s, contextId: info.context.id })
-                    .catch(ex => {
-                    // race condition with short-lived frames -- OK if the frame is already gone
-                        if (ex.response && ex.response.message && ex.response.message.indexOf("Cannot find context") >= 0)
-                            debug(`scriptsOnNewContext for context ${info.context.id} failed, ignoring: ${JSON.stringify(ex.response)}`);
-                        else
-                            throw ex;
-                    });
-        });
-    });
-
-    client.Runtime.executionContextDestroyed(info => {
-        debug("executionContextDestroyed " + info.executionContextId);
-        for (const frameId in frameIdToContextId) {
-            if (frameIdToContextId[frameId] == info.executionContextId) {
-                delete frameIdToContextId[frameId];
-                break;
-            }
-        }
-
-        // Firefox does not report an error when the execution context
-        // of a Runtime.evaluate call gets destroyed.  It will never
-        // ever resolve or be rejected.  So let's provide the failure
-        // reply from here.
-        //
-        // However, if the timing is just right, the context gets
-        // destroyed before Runtime.evaluate has started the real
-        // processing, and in that case it will return an error.  Then
-        // we would send the reply here, and would also send the
-        // error. This would drive the protocol out of synch. Also, our driver
-        // might immediately send more commands after seeing the first reply,
-        // and the unwanted second reply might be triggered in the middle of one
-        // of the next commands.  To reliably suppress the second reply we have
-        // the pretty general sequence number checks.
-        //
-        if (info.executionContextId == currentExecId) {
-            currentExecId = null;
-            fail(cur_cmd_seq, { response: { message: "Execution context was destroyed." } });
-        }
-    });
-}
-
-function setupLocalFunctions(client) {
-    client.setupPageLoadHandler = timeout => {
-        if (pageLoadHandler !== null)
-            return Promise.reject("setupPageLoadHandler: already pending"); // eslint-disable-line prefer-promise-reject-errors
-
-        client.pageLoadPromise = new Promise((resolve, reject) => {
-            const timeout_timer = setTimeout(() => {
-                pageLoadHandler = null;
-                reject("Timeout waiting for page load"); // eslint-disable-line prefer-promise-reject-errors
-            }, timeout * 1000);
-
-            pageLoadHandler = () => {
-                clearTimeout(timeout_timer);
-                pageLoadHandler = null;
-                resolve({});
-            };
-        });
-
-        return Promise.resolve({});
-    };
-}
-
-// helper functions for testlib.py which are too unwieldy to be poked in from Python
-function getFrameExecId(frame) { // eslint-disable-line no-unused-vars
-    const frameId = frameNameToFrameId[frame || "cockpit1"];
-    const execId = frameIdToContextId[frameId];
-    if (execId !== undefined)
-        currentExecId = execId;
-    else
-        debug(`WARNING: getFrameExecId: frame ${frame} ID ${frameId} has no known execution context`);
-    return execId;
-}
-
-/**
- * Main input/process loop
- *
- * Read one line with a JS expression, eval() it, and respond with the result:
- *    success <JSON formatted return value>
- *    fail <JSON formatted error>
- * EOF shuts down the client.
- */
-process.stdin.setEncoding('utf8');
-
-if (process.env.TEST_CDP_DEBUG)
-    enable_debug = true;
-
-const options = { };
-if (process.argv.length >= 3) {
-    options.port = parseInt(process.argv[2]);
-    if (!options.port) {
-        process.stderr.write("Usage: firefox-cdp-driver.js [port]\n");
-        process.exit(1);
-    }
-}
-
-// HACK: `addScriptToEvaluateOnNewDocument` is not implemented in Firefox
-// thus save all scripts in array and on each new context just execute these
-// scripts in them
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1549465
-function addScriptToEvaluateOnNewDocument(script) { // eslint-disable-line no-unused-vars
-    return new Promise((resolve, reject) => {
-        scriptsOnNewContext.push(script.source);
-        resolve();
-    });
-}
-
-// This should work on different targets (meaning tabs)
-// CDP takes {target:target} so we can pick target
-// Problem is that CDP.New() which creates new target works only for chrome/ium
-// But we should be able to use CPD.List to list all targets and then pick one
-// Firefox just gives them ascending numbers, so we can pick the one with highest number
-// and if we feel fancy we can check that url is `about:newtab`.
-// That still though does not create new tab - but we can just call `firefox about:blank`
-// from cdline and since firefox would open it in the same browser, it should work.
-// This would work just fine in CI (as there would be only one browser) but on our machines it may
-// pick a wrong window (no idea if they can be somehow distinguish and execute it in a specific
-// one). But I guess we can live with it (and it seems it picks the last opened window anyway,
-// so having your own browser running should not interfere)
-//
-// Just calling executable to open another tab in the same browser works also for chromium, so
-// should be fine
-CDP(options)
-        .then(client => {
-            setupLogging(client);
-            setupFrameTracking(client);
-            setupLocalFunctions(client);
-            // TODO: Security handling not yet supported in Firefox
-
-            readline.createInterface(process.stdin)
-                    .on('line', command => {
-                        // HACKS: See description of related functions
-                        if (command.startsWith("client.Page.addScriptToEvaluateOnNewDocument"))
-                            command = command.substring(12);
-
-                        // run the command
-                        const seq = ++cur_cmd_seq;
-                        eval(command).then(reply => { // eslint-disable-line no-eval
-                            currentExecId = null;
-                            if (unhandledExceptions.length === 0) {
-                                success(seq, reply);
-                            } else {
-                                const message = unhandledExceptions[0];
-                                fail(seq, message.split("\n")[0]);
-                                clearExceptions();
-                            }
-                        }, err => {
-                            currentExecId = null;
-                            fail(seq, err);
-                        });
-                    })
-                    .on('close', () => process.exit(0));
-        })
-        .catch(fatal);
diff --git a/test/common/storagelib.py b/test/common/storagelib.py
index 38877302eae2..357b0651a4c5 100644
--- a/test/common/storagelib.py
+++ b/test/common/storagelib.py
@@ -241,7 +241,7 @@ def dialog_cancel(self):
 
     def dialog_wait_close(self):
         # file system operations often take longer than 10s
-        with self.browser.wait_timeout(max(self.browser.cdp.timeout, 60)):
+        with self.browser.wait_timeout(max(self.browser.timeout, 60)):
             self.browser.wait_not_present('#dialog')
 
     def dialog_check(self, expect):
diff --git a/test/common/testlib.py b/test/common/testlib.py
index 7a87e5d47d7a..0aacc26fac8a 100644
--- a/test/common/testlib.py
+++ b/test/common/testlib.py
@@ -18,6 +18,7 @@
 """Tools for writing Cockpit test cases."""
 
 import argparse
+import asyncio
 import base64
 import contextlib
 import errno
@@ -25,6 +26,7 @@
 import glob
 import io
 import json
+import logging
 import os
 import re
 import shutil
@@ -32,13 +34,15 @@
 import subprocess
 import sys
 import tempfile
+import threading
 import time
 import traceback
 import unittest
-from collections.abc import Collection, Container, Iterator, Mapping, Sequence
-from typing import Any, Callable, ClassVar, Literal, Never, TypedDict, TypeVar
+from collections.abc import Collection, Container, Coroutine, Iterator, Mapping, Sequence
+from pathlib import Path
+from typing import Any, Callable, ClassVar, Literal, TypedDict, TypeVar
 
-import cdp
+import webdriver_bidi
 from lcov import write_lcov
 from lib.constants import OSTREE_IMAGES
 from machine import testvm
@@ -47,6 +51,8 @@
 _T = TypeVar('_T')
 _FT = TypeVar("_FT", bound=Callable[..., Any])
 
+JsonObject = dict[str, Any]
+
 BASE_DIR = os.path.realpath(f'{__file__}/../../..')
 TEST_DIR = f'{BASE_DIR}/test'
 BOTS_DIR = f'{BASE_DIR}/bots'
@@ -92,6 +98,25 @@
 opts.coverage = False
 
 
+# https://w3c.github.io/webdriver/#keyboard-actions for encoding key names
+WEBDRIVER_KEYS = {
+    "Backspace": "\uE003",
+    "Tab": "\uE004",
+    "Return": "\uE006",
+    "Enter": "\uE007",
+    "Shift": "\uE008",
+    "Control": "\uE009",
+    "Alt": "\uE00A",
+    "Escape": "\uE00C",
+    "ArrowLeft": "\uE012",
+    "ArrowUp": "\uE013",
+    "ArrowRight": "\uE014",
+    "ArrowDown": "\uE015",
+    "Insert": "\uE016",
+    "Delete": "\uE017",
+}
+
+
 # Browser layouts
 #
 # A browser can be switched into a number of different layouts, such
@@ -185,6 +210,8 @@ def unique_filename(base: str, ext: str) -> str:
 
 
 class Browser:
+    driver: webdriver_bidi.WebdriverBidi
+    browser: str
     layouts: Sequence[BrowserLayout]
     current_layout: BrowserLayout | None
     port: str | int
@@ -211,39 +238,97 @@ def __init__(
         self.used_pixel_references = set[str]()
         self.coverage_label = coverage_label
         self.machine = machine
-        path = os.path.dirname(__file__)
-        sizzle_js = os.path.join(path, "../../node_modules/sizzle/dist/sizzle.js")
-        helpers = [os.path.join(path, "test-functions.js")]
-        if os.path.exists(sizzle_js):
-            helpers.append(sizzle_js)
-        self.cdp = cdp.CDP("C.utf8", verbose=opts.trace, trace=opts.trace,
-                           inject_helpers=helpers,
-                           start_profile=coverage_label is not None)
+
+        headless = not bool(os.environ.get("TEST_SHOW_BROWSER", ""))
+        self.browser = os.environ.get("TEST_BROWSER", "chromium")
+        if self.browser == "chromium":
+            self.driver = webdriver_bidi.ChromiumBidi(headless=headless)
+        elif self.browser == "firefox":
+            self.driver = webdriver_bidi.FirefoxBidi(headless=headless)
+        else:
+            raise ValueError(f"unknown browser {self.browser}")
+        self.loop = asyncio.new_event_loop()
+        self.bidi_thread = threading.Thread(target=self.asyncio_loop_thread, args=(self.loop,))
+        self.bidi_thread.start()
+
+        self.run_async(self.driver.start_session())
+
+        if opts.trace:
+            logging.basicConfig(level=logging.INFO)
+            webdriver_bidi.log_command.setLevel(logging.INFO if opts.trace else logging.WARNING)
+            # not appropriate for --trace, just enable for debugging low-level protocol with browser
+            # bidiwebdriver_.log_proto.setLevel(logging.DEBUG)
+
+        test_functions = (Path(__file__).parent / "test-functions.js").read_text()
+        # Don't redefine globals, this confuses Firefox
+        test_functions = "if (window.ph_select) return; " + test_functions
+        self.bidi("script.addPreloadScript", quiet=True, functionDeclaration=f"() => {{ {test_functions} }}")
+
+        try:
+            sizzle_js = (Path(__file__).parent.parent.parent / "node_modules/sizzle/dist/sizzle.js").read_text()
+            # HACK: injecting sizzle fails on missing `document` in assert()
+            sizzle_js = sizzle_js.replace('function assert( fn ) {',
+                                          'function assert( fn ) { if (true) return true; else ')
+            # HACK: sizzle tracks document and when we switch frames, it sees the old document
+            # although we execute it in different context.
+            sizzle_js = sizzle_js.replace('context = context || document;', 'context = context || window.document;')
+            self.bidi("script.addPreloadScript", quiet=True, functionDeclaration=f"() => {{ {sizzle_js} }}")
+        except FileNotFoundError:
+            pass
+
+        if coverage_label:
+            self.cdp_command("Profiler.enable")
+            self.cdp_command("Profiler.startPreciseCoverage", callCount=False, detailed=True)
+
         self.password = "foobar"
         self.timeout_factor = int(os.getenv("TEST_TIMEOUT_FACTOR", "1"))
+        self.timeout = 15
         self.failed_pixel_tests = 0
         self.allow_oops = False
-        self.body_clip = None
         try:
             with open(f'{TEST_DIR}/browser-layouts.json') as fp:
                 self.layouts = json.load(fp)
         except FileNotFoundError:
             self.layouts = default_layouts
-        # Firefox CDP does not support setting EmulatedMedia
-        # https://bugzilla.mozilla.org/show_bug.cgi?id=1549434
-        if self.cdp.browser.name != "chromium":
-            self.layouts = [layout for layout in self.layouts if layout["theme"] != "dark"]
         self.current_layout = None
+        self.valid = True
 
-        # we don't have a proper SSL certificate for our tests, ignore it
-        # Firefox does not support this, tests which rely on it need to skip it
-        if self.cdp.browser.name == "chromium":
-            self.cdp.command("setSSLBadCertificateAction('continue')")
+    def run_async(self, coro: Coroutine[Any, Any, Any]) -> JsonObject:
+        """Run coro in main loop in our BiDi thread
 
-    def allow_download(self) -> None:
-        """Allow browser downloads"""
-        if self.cdp.browser.name == "chromium":
-            self.cdp.invoke("Page.setDownloadBehavior", behavior="allow", downloadPath=self.cdp.download_dir)
+        Wait for the result and return it.
+        """
+        return asyncio.run_coroutine_threadsafe(coro, self.loop).result()
+
+    @staticmethod
+    def asyncio_loop_thread(loop: asyncio.AbstractEventLoop) -> None:
+        asyncio.set_event_loop(loop)
+        loop.run_forever()
+
+    def kill(self) -> None:
+        if not self.valid:
+            return
+        self.run_async(self.driver.close())
+        self.loop.call_soon_threadsafe(self.loop.stop)
+        self.bidi_thread.join()
+        self.valid = False
+
+    def bidi(self, method: str, **params: Any) -> webdriver_bidi.JsonObject:
+        """Send a Webdriver BiDi command and return the JSON response"""
+
+        try:
+            return self.run_async(self.driver.bidi(method, **params))
+        except webdriver_bidi.WebdriverError as e:
+            raise Error(str(e)) from None
+
+    def cdp_command(self, method: str, **params: Any) -> webdriver_bidi.JsonObject:
+        """Send a Chrome DevTools Protocol command and return the JSON response"""
+
+        if self.browser == "chromium":
+            assert isinstance(self.driver, webdriver_bidi.ChromiumBidi)
+            return self.run_async(self.driver.cdp(method, **params))
+        else:
+            raise webdriver_bidi.WebdriverError("CDP is only supported in Chromium")
 
     def open(self, href: str, cookie: Mapping[str, str] | None = None, tls: bool = False) -> None:
         """Load a page into the browser.
@@ -264,14 +349,15 @@ def open(self, href: str, cookie: Mapping[str, str] | None = None, tls: bool = F
             size = self.current_layout["shell_size"]
             self._set_window_size(size[0], size[1])
         if cookie:
-            self.cdp.invoke("Network.setCookie", **cookie)
+            c = {**cookie, "value": {"type": "string", "value": cookie["value"]}}
+            self.bidi("storage.setCookie", cookie=c)
 
         self.switch_to_top()
         # Some browsers optimize this away if the current URL is already href
         # (e.g. in TestKeys.testAuthorizedKeys). Load the blank page first to always
         # force a load.
-        self.cdp.invoke("Page.navigate", url="about:blank")
-        self.cdp.invoke("Page.navigate", url=href)
+        self.bidi("browsingContext.navigate", context=self.driver.context, url="about:blank", wait="complete")
+        self.bidi("browsingContext.navigate", context=self.driver.context, url=href, wait="complete")
 
     def set_user_agent(self, ua: str) -> None:
         """Set the user agent of the browser
@@ -279,7 +365,10 @@ def set_user_agent(self, ua: str) -> None:
         :param ua: user agent string
         :type ua: str
         """
-        self.cdp.invoke("Emulation.setUserAgentOverride", userAgent=ua)
+        if self.browser == "chromium":
+            self.cdp_command("Emulation.setUserAgentOverride", userAgent=ua)
+        else:
+            raise NotImplementedError
 
     def reload(self, ignore_cache: bool = False) -> None:
         """Reload the current page
@@ -289,8 +378,15 @@ def reload(self, ignore_cache: bool = False) -> None:
         """
 
         self.switch_to_top()
-        self.wait_js_cond("ph_select('iframe.container-frame').every(function (e) { return e.getAttribute('data-loaded'); })")
-        self.cdp.invoke("Page.reload", ignoreCache=ignore_cache)
+        self.wait_js_cond("ph_select('iframe.container-frame').every(e => e.getAttribute('data-loaded'))")
+        if self.browser == "firefox":
+            if ignore_cache:
+                webdriver_bidi.log_command.warning(
+                    "Browser.reload(): ignore_cache==True not yet supported with Firefox, ignoring")
+            self.bidi("browsingContext.reload", context=self.driver.context, wait="complete")
+        else:
+            self.bidi("browsingContext.reload", context=self.driver.context, ignoreCache=ignore_cache,
+                      wait="complete")
 
         self.machine.allow_restart_journal_messages()
 
@@ -302,14 +398,23 @@ def switch_to_frame(self, name: str | None) -> None:
 
         :param name: frame name
         """
-        self.cdp.set_frame(name)
+        if name is None:
+            self.switch_to_top()
+        else:
+            self.run_async(self.driver.switch_to_frame(name))
 
     def switch_to_top(self) -> None:
         """Switch to the main frame
 
         Switch to the main frame from for example an iframe.
         """
-        self.cdp.set_frame(None)
+        self.driver.switch_to_top()
+
+    def allow_download(self) -> None:
+        """Allow browser downloads"""
+        # this is only necessary for headless chromium
+        if self.browser == "chromium":
+            self.cdp_command("Page.setDownloadBehavior", behavior="allow", downloadPath=str(self.driver.download_dir))
 
     def upload_files(self, selector: str, files: Sequence[str]) -> None:
         """Upload a local file to the browser
@@ -317,32 +422,8 @@ def upload_files(self, selector: str, files: Sequence[str]) -> None:
         The selector should select the <input type="file"/> element.
         Files is a list of absolute paths to files which should be uploaded.
         """
-        r = self.cdp.invoke("Runtime.evaluate", expression='document.querySelector(%s)' % jsquote(selector))
-        objectId = r["result"]["objectId"]
-        self.cdp.invoke("DOM.setFileInputFiles", files=files, objectId=objectId)
-
-    def raise_cdp_exception(
-        self, func: str, arg: str, details: Mapping[str, Any], trailer: str | None = None
-    ) -> Never:
-        # unwrap a typical error string
-        if details.get("exception", {}).get("type") == "string":
-            msg = details["exception"]["value"]
-        elif details.get("text", None):
-            msg = details.get("text", None)
-        else:
-            msg = str(details)
-        if trailer:
-            msg += "\n" + trailer
-        raise Error("%s(%s): %s" % (func, arg, msg))
-
-    def inject_js(self, code: str) -> None:
-        """Execute JS code that does not return anything
-
-        :param code: a string containing JavaScript code
-        :type code: str
-        """
-        self.cdp.invoke("Runtime.evaluate", expression=code, trace=code,
-                        silent=False, awaitPromise=True, returnByValue=False, no_trace=True)
+        element = self.eval_js(f"ph_find({jsquote(selector)})")
+        self.bidi("input.setFiles", context=self.driver.context, element=element, files=files)
 
     def eval_js(self, code: str, no_trace: bool = False) -> Any:
         """Execute JS code that returns something
@@ -350,21 +431,8 @@ def eval_js(self, code: str, no_trace: bool = False) -> Any:
         :param code: a string containing JavaScript code
         :param no_trace: do not print information about unknown return values (default False)
         """
-        result = self.cdp.invoke("Runtime.evaluate", expression=code, trace=code,
-                                 silent=False, awaitPromise=True, returnByValue=True, no_trace=no_trace)
-        if "exceptionDetails" in result:
-            self.raise_cdp_exception("eval_js", code, result["exceptionDetails"])
-        _type = result.get("result", {}).get("type")
-        if _type == 'object' and result["result"].get("subtype", "") == "error":
-            raise Error(result["result"]["description"])
-        if _type == "undefined":
-            return None
-        if _type and "value" in result["result"]:
-            return result["result"]["value"]
-
-        if opts.trace:
-            print("eval_js(%s): cannot interpret return value %s" % (code, result))
-        return None
+        return self.bidi("script.evaluate", expression=code, quiet=no_trace,
+                         awaitPromise=True, target={"context": self.driver.context})["result"]
 
     def call_js_func(self, func: str, *args: object) -> Any:
         """Call a JavaScript function
@@ -396,11 +464,13 @@ def cookie(self, name: str) -> Mapping[str, object] | None:
         :param name: the name of the cookie
         :type name: str
         """
-        cookies = self.cdp.invoke("Network.getCookies")
-        for c in cookies["cookies"]:
-            assert isinstance(c, Mapping)
-            if c["name"] == name:
-                return c
+        cookies = self.bidi("storage.getCookies", filter={"name": name})["cookies"]
+        if len(cookies) > 0:
+            c = cookies[0]
+            # if we ever need to handle "base64", add that
+            assert c["value"]["type"] == "string"
+            c["value"] = c["value"]["value"]
+            return c
         return None
 
     def go(self, url_hash: str) -> None:
@@ -439,7 +509,7 @@ def click(self, selector: str) -> None:
 
         :param selector: the selector to click on
         """
-        self.mouse(selector + ":not([disabled]):not([aria-disabled=true])", "click", 0, 0, 0)
+        self.mouse(selector + ":not([disabled]):not([aria-disabled=true])", "click")
 
     def val(self, selector: str) -> Any:
         """Get the value attribute of a selector.
@@ -502,8 +572,10 @@ def set_checked(self, selector: str, val: bool) -> None:
         :param selector: the selector
         :param val: boolean value to enable or disable checkbox
         """
-        self.wait_visible(selector + ':not([disabled]):not([aria-disabled=true])')
-        self.call_js_func('ph_set_checked', selector, val)
+        # avoid ph_set_checked, that doesn't use proper mouse emulation
+        checked = self.get_checked(selector)
+        if checked != val:
+            self.click(selector)
 
     def focus(self, selector: str) -> None:
         """Set focus on selected element.
@@ -522,43 +594,37 @@ def blur(self, selector: str) -> None:
         self.call_js_func('ph_blur', selector)
 
     def input_text(self, text: str) -> None:
-        for char in text:
-            if char == "\n":
-                self.key("Enter")
-            else:
-                self.cdp.invoke("Input.dispatchKeyEvent", type="keyDown", text=char, key=char)
-                self.cdp.invoke("Input.dispatchKeyEvent", type="keyUp", text=char, key=char)
-
-    def key(self, name: str, repeat: int = 1, modifiers: int = 0) -> None:
+        actions = []
+        for c in text:
+            actions.append({"type": "keyDown", "value": c})
+            actions.append({"type": "keyUp", "value": c})
+        self.bidi("input.performActions", context=self.driver.context, actions=[
+            {"type": "key", "id": "key-0", "actions": actions}])
+
+    def key(self, name: str, repeat: int = 1, modifiers: list[str] | None = None) -> None:
         """Press and release a named keyboard key.
 
         Use this function to input special characters or modifiers.
 
-        :param name: key name like "Enter", "Delete", or "ArrowLeft"
+        :param name: ASCII value or key name like "Enter", "Delete", or "ArrowLeft" (entry in WEBDRIVER_KEYS)
         :param repeat: number of times to repeat this key (default 1)
-        :param modifiers: bit field: Alt=1, Ctrl=2, Meta/Command=4, Shift=8
+        :param modifiers: "Shift", "Control", "Alt"
         """
-        args: dict[str, int | str] = {}
-        if self.cdp.browser.name == "chromium":
-            # HACK: chromium doesn't understand some key codes in some situations
-            win_keys = {
-                "Backspace": 8,
-                "Enter": 13,
-                "Escape": 27,
-                "ArrowDown": 40,
-                "Insert": 45,
-            }
-            if name in win_keys:
-                args["windowsVirtualKeyCode"] = win_keys[name]
-            if name == 'Enter':
-                args["text"] = '\r'
-            # HACK: chromium needs windowsVirtualKeyCode with modifiers
-            elif len(name) == 1 and name.isalnum() and modifiers != 0:
-                args["windowsVirtualKeyCode"] = ord(name.upper())
+        actions = []
+        actions_pre = []
+        actions_post = []
+        keycode = WEBDRIVER_KEYS.get(name, name)
+
+        for m in (modifiers or []):
+            actions_pre.append({"type": "keyDown", "value": WEBDRIVER_KEYS[m]})
+            actions_post.append({"type": "keyUp", "value": WEBDRIVER_KEYS[m]})
 
         for _ in range(repeat):
-            self.cdp.invoke("Input.dispatchKeyEvent", type="keyDown", key=name, modifiers=modifiers, **args)
-            self.cdp.invoke("Input.dispatchKeyEvent", type="keyUp", key=name, modifiers=modifiers, **args)
+            actions.append({"type": "keyDown", "value": keycode})
+            actions.append({"type": "keyUp", "value": keycode})
+
+        self.bidi("input.performActions", context=self.driver.context, actions=[
+            {"type": "key", "id": "key-0", "actions": actions_pre + actions + actions_post}])
 
     def select_from_dropdown(self, selector: str, value: object) -> None:
         """For an actual <select> HTML component"""
@@ -592,7 +658,7 @@ def set_input_text(
     ) -> None:
         self.focus(selector)
         if not append:
-            self.key("a", modifiers=2)  # Ctrl + a
+            self.key("a", modifiers=["Control"])
         if val == "":
             self.key("Backspace")
         else:
@@ -611,13 +677,13 @@ def set_file_autocomplete_val(self, group_identifier: str, location: str) -> Non
 
     @contextlib.contextmanager
     def wait_timeout(self, timeout: int) -> Iterator[None]:
-        old_timeout = self.cdp.timeout
-        self.cdp.timeout = timeout
+        old_timeout = self.timeout
+        self.timeout = timeout
         yield
-        self.cdp.timeout = old_timeout
+        self.timeout = old_timeout
 
     def wait(self, predicate: Callable[[], _T | None]) -> _T:
-        for _ in range(self.cdp.timeout * self.timeout_factor * 5):
+        for _ in range(self.timeout * self.timeout_factor * 5):
             val = predicate()
             if val:
                 return val
@@ -625,33 +691,45 @@ def wait(self, predicate: Callable[[], _T | None]) -> _T:
         raise Error('timed out waiting for predicate to become true')
 
     def wait_js_cond(self, cond: str, error_description: str = "null") -> None:
-        count = 0
-        timeout = self.cdp.timeout * self.timeout_factor
+        timeout = self.timeout * self.timeout_factor
         start = time.time()
-        while True:
-            count += 1
+        last_error = None
+        for _retry in range(5):
             try:
-                result = self.cdp.invoke("Runtime.evaluate",
-                                         expression="ph_wait_cond(() => %s, %i, %s)" % (cond, timeout * 1000, error_description),
-                                         silent=False, awaitPromise=True, trace="wait: " + cond)
-                if "exceptionDetails" in result:
-                    if self.cdp.browser.name == "firefox" and count < 20 and "ph_wait_cond is not defined" in result["exceptionDetails"].get("text", ""):
-                        time.sleep(0.1)
-                        continue
-                    trailer = "\n".join(self.cdp.get_js_log())
-                    self.raise_cdp_exception("timeout\nwait_js_cond", cond, result["exceptionDetails"], trailer)
-                if timeout > 0:
-                    duration = time.time() - start
-                    percent = int(duration / timeout * 100)
-                    if percent >= 50:
-                        print(f"WARNING: Waiting for {cond} took {duration:.1f} seconds, which is {percent}% of the timeout.")
+                self.bidi("script.evaluate",
+                          expression=f"ph_wait_cond(() => {cond}, {timeout * 1000}, {error_description})",
+                          awaitPromise=True, timeout=timeout + 5, target={"context": self.driver.context})
+
+                duration = time.time() - start
+                percent = int(duration / timeout * 100)
+                if percent >= 50:
+                    print(f"WARNING: Waiting for {cond} took {duration:.1f} seconds, which is {percent}% of the timeout.")
                 return
-            except RuntimeError as e:
-                data = e.args[0]
-                if count < 20 and isinstance(data, dict) and "response" in data and data["response"].get("message") in ["Execution context was destroyed.", "Cannot find context with specified id"]:
-                    time.sleep(1)
-                else:
-                    raise e
+            except Error as e:
+                last_error = e
+                # rewrite exception to have more context, also for compatibility with existing naughties
+                if "condition did not become true" in e.msg:
+                    raise Error(f"timeout\nwait_js_cond({cond}): {e.msg}") from None
+
+                # can happen when waiting across page reloads
+                if any(pattern in str(e) for pattern in [
+                    # during page loading
+                    "is not a function",
+                    # chromium
+                    "Execution context was destroyed",
+                    "Cannot find context",
+                    # firefox
+                    "MessageHandlerFrame' destroyed",
+                   ]):
+                    if time.time() - start < timeout:
+                        webdriver_bidi.log_command.info("wait_js_cond: Ignoring/retrying %r", e)
+                        time.sleep(1)
+                        continue
+
+                break
+
+        assert last_error
+        raise last_error
 
     def wait_js_func(self, func: str, *args: object) -> None:
         self.wait_js_cond("%s(%s)" % (func, ','.join(map(jsquote, args))))
@@ -684,7 +762,7 @@ def wait_attr(self, selector: str, attr: str, val: object) -> None:
         self._wait_present(selector)
         self.wait_js_func('ph_has_attr', selector, attr, val)
 
-    def wait_attr_contains(self, selector: str, attr: str, val: object) -> None:
+    def wait_attr_contains(self, selector: str, attr: str, val: str) -> None:
         self._wait_present(selector)
         self.wait_js_func('ph_attr_contains', selector, attr, val)
 
@@ -932,42 +1010,35 @@ def become_superuser(
         password: str | None = None,
         passwordless: bool | None = False
     ) -> None:
-        cur_frame = self.cdp.cur_frame
-        self.switch_to_top()
-
-        self.open_superuser_dialog()
-
-        # In (open)SUSE images, superuser access always requires the root password
-        if user is None:
-            user = "root" if "suse" in self.machine.image else "admin"
-
-        if passwordless:
-            self.wait_in_text("div[role=dialog]", "Administrative access")
-            self.wait_in_text("div[role=dialog] .pf-v5-c-modal-box__body", "You now have administrative access.")
-            # there should be only one ("Close") button
-            self.click("div[role=dialog] .pf-v5-c-modal-box__footer button")
-        else:
-            self.wait_in_text("div[role=dialog]", "Switch to administrative access")
-            self.wait_in_text("div[role=dialog]", f"Password for {user}:")
-            self.set_input_text("div[role=dialog] input", password or "foobar")
-            self.click("div[role=dialog] button.pf-m-primary")
+        with self.driver.restore_context():
+            self.open_superuser_dialog()
+
+            # In (open)SUSE images, superuser access always requires the root password
+            if user is None:
+                user = "root" if "suse" in self.machine.image else "admin"
+
+            if passwordless:
+                self.wait_in_text("div[role=dialog]", "Administrative access")
+                self.wait_in_text("div[role=dialog] .pf-v5-c-modal-box__body", "You now have administrative access.")
+                # there should be only one ("Close") button
+                self.click("div[role=dialog] .pf-v5-c-modal-box__footer button")
+            else:
+                self.wait_in_text("div[role=dialog]", "Switch to administrative access")
+                self.wait_in_text("div[role=dialog]", f"Password for {user}:")
+                self.set_input_text("div[role=dialog] input", password or "foobar")
+                self.click("div[role=dialog] button.pf-m-primary")
 
-        self.wait_not_present("div[role=dialog]")
+            self.wait_not_present("div[role=dialog]")
 
-        self.check_superuser_indicator("Administrative access")
-        self.switch_to_frame(cur_frame)
+            self.check_superuser_indicator("Administrative access")
 
     def drop_superuser(self) -> None:
-        cur_frame = self.cdp.cur_frame
-        self.switch_to_top()
-
-        self.open_superuser_dialog()
-        self.wait_in_text("div[role=dialog]", "Switch to limited access")
-        self.click("div[role=dialog] button.pf-m-primary")
-        self.wait_not_present("div[role=dialog]")
-        self.check_superuser_indicator("Limited access")
-
-        self.switch_to_frame(cur_frame)
+        with self.driver.restore_context():
+            self.open_superuser_dialog()
+            self.wait_in_text("div[role=dialog]", "Switch to limited access")
+            self.click("div[role=dialog] button.pf-m-primary")
+            self.wait_not_present("div[role=dialog]")
+            self.check_superuser_indicator("Limited access")
 
     def click_system_menu(self, path: str, enter: bool = True) -> None:
         """Click on a "System" menu entry with given URL path
@@ -1025,10 +1096,12 @@ def add_machine(self, address: str, known_host: bool = False, password: str = "f
 
     def grant_permissions(self, *args: str) -> None:
         """Grant permissions to the browser"""
-        # https://chromedevtools.github.io/devtools-protocol/tot/Browser/#method-grantPermissions
-        self.cdp.invoke("Browser.grantPermissions",
-                        origin="http://%s:%s" % (self.address, self.port),
-                        permissions=args)
+
+        # BiDi permission extension:
+        # https://www.w3.org/TR/permissions/#automation-webdriver-bidi
+        for perm in args:
+            self.bidi("permissions.setPermission", descriptor={"name": perm}, state="granted",
+                      origin=f"http://{self.address}:{self.port}")
 
     def snapshot(self, title: str, label: str | None = None) -> None:
         """Take a snapshot of the current screen and save it as a PNG and HTML.
@@ -1036,46 +1109,42 @@ def snapshot(self, title: str, label: str | None = None) -> None:
         Arguments:
             title: Used for the filename.
         """
-        if self.cdp and self.cdp.valid:
-            self.cdp.command("clearExceptions()")
-
+        if self.valid:
             filename = unique_filename(f"{label or self.label}-{title}", "png")
-            if self.body_clip:
-                ret = self.cdp.invoke("Page.captureScreenshot", clip=self.body_clip, no_trace=True)
-            else:
-                ret = self.cdp.invoke("Page.captureScreenshot", no_trace=True)
-            if "data" in ret:
+            try:
+                ret = self.bidi("browsingContext.captureScreenshot", quiet=True,
+                                context=self.driver.top_context, origin="document")
                 with open(filename, 'wb') as f:
                     f.write(base64.standard_b64decode(ret["data"]))
                 attach(filename, move=True)
                 print("Wrote screenshot to " + filename)
-            else:
-                print("Screenshot not available")
+            except Error as e:
+                print("Screenshot not available:", e)
 
             filename = unique_filename(f"{label or self.label}-{title}", "html")
-            html = self.cdp.invoke("Runtime.evaluate", expression="document.documentElement.outerHTML",
-                                   no_trace=True)["result"]["value"]
-            with open(filename, 'wb') as f:
-                f.write(html.encode())
-            attach(filename, move=True)
-            print("Wrote HTML dump to " + filename)
+            try:
+                html = self.eval_js("document.documentElement.outerHTML", no_trace=True)
+                with open(filename, 'wb') as f:
+                    f.write(html.encode())
+                attach(filename, move=True)
+                print("Wrote HTML dump to " + filename)
+            except Error as e:
+                print("HTML dump not available:", e)
 
     def _set_window_size(self, width: int, height: int) -> None:
-        self.cdp.invoke("Emulation.setDeviceMetricsOverride",
-                        width=width, height=height,
-                        deviceScaleFactor=0, mobile=False)
+        self.bidi("browsingContext.setViewport", context=self.driver.top_context,
+                  viewport={"width": width, "height": height})
 
     def _set_emulated_media_theme(self, name: str) -> None:
         # https://bugzilla.mozilla.org/show_bug.cgi?id=1549434
-        if self.cdp.browser.name == "chromium":
-            self.cdp.invoke("Emulation.setEmulatedMedia", features=[{'name': 'prefers-color-scheme', 'value': name}])
+        if self.browser == "chromium":
+            self.cdp_command("Emulation.setEmulatedMedia", features=[{'name': 'prefers-color-scheme', 'value': name}])
 
     def _set_direction(self, direction: str) -> None:
-        cur_frame = self.cdp.cur_frame
-        if self.is_present("#shell-page"):
-            self.switch_to_top()
-            self.set_attr("#shell-page", "dir", direction)
-        self.switch_to_frame(cur_frame)
+        with self.driver.restore_context(switch_to_top=False):
+            if self.is_present("#shell-page"):
+                self.switch_to_top()
+                self.set_attr("#shell-page", "dir", direction)
         self.set_attr("html", "dir", direction)
 
     def set_layout(self, name: str) -> None:
@@ -1182,7 +1251,10 @@ def relative_clips(sels: Collection[str]) -> Collection[tuple[int, int, int, int
         filename = base + "-pixels.png"
         ref_filename = os.path.join(reference_dir, filename)
         self.used_pixel_references.add(ref_filename)
-        ret = self.cdp.invoke("Page.captureScreenshot", clip=rect, no_trace=True)
+        rect["type"] = "box"
+        ret = self.bidi("browsingContext.captureScreenshot", quiet=True,
+                        context=self.driver.top_context,
+                        clip=rect)
         png_now = base64.standard_b64decode(ret["data"])
         png_ref = os.path.exists(ref_filename) and open(ref_filename, "rb").read()
         if not png_ref:
@@ -1298,7 +1370,6 @@ def assert_pixels(
         # If the page overflows make sure to not show a scrollbar
         # Don't apply this hack for login and terminal and shell as they don't use PF Page
         if not self.is_present("#shell-page") and not self.is_present("#login-details") and not self.is_present("#system-terminal-page"):
-            self.switch_to_frame(self.cdp.cur_frame)
             classes = self.attr("main", "class")
             if "pf-v5-c-page__main" in classes:
                 self.set_attr("main.pf-v5-c-page__main", "class", f"{classes} pixel-test")
@@ -1333,14 +1404,14 @@ def assert_no_unused_pixel_test_references(self) -> None:
     def get_js_log(self) -> Sequence[str]:
         """Return the current javascript log"""
 
-        if self.cdp:
-            return self.cdp.get_js_log()
+        if self.valid:
+            return [str(log) for log in self.driver.logs]
         return []
 
     def copy_js_log(self, title: str, label: str | None = None) -> None:
         """Copy the current javascript log"""
 
-        logs = list(self.get_js_log())
+        logs = self.get_js_log()
         if logs:
             filename = unique_filename(f"{label or self.label}-{title}", "js.log")
             with open(filename, 'wb') as f:
@@ -1348,19 +1419,16 @@ def copy_js_log(self, title: str, label: str | None = None) -> None:
             attach(filename, move=True)
             print("Wrote JS log to " + filename)
 
-    def kill(self) -> None:
-        self.cdp.kill()
-
     def write_coverage_data(self) -> None:
-        if self.coverage_label and self.cdp and self.cdp.valid:
-            coverage = self.cdp.invoke("Profiler.takePreciseCoverage")
+        if self.coverage_label and self.valid:
+            coverage = self.cdp_command("Profiler.takePreciseCoverage")["result"]
             write_lcov(coverage['result'], self.coverage_label)
 
     def assert_no_oops(self) -> None:
         if self.allow_oops:
             return
 
-        if self.cdp and self.cdp.valid:
+        if self.valid:
             self.switch_to_top()
             if self.eval_js("!!document.getElementById('navbar-oops')"):
                 assert not self.is_visible("#navbar-oops"), "Cockpit shows an Oops"
@@ -2059,7 +2127,7 @@ def snapshot(self, title: str, label: str | None = None) -> None:
         if self.browser is not None:
             try:
                 self.browser.snapshot(title, label)
-            except RuntimeError:
+            except Error:
                 # this usually runs in exception handlers; raising an exception here skips cleanup handlers, so don't
                 sys.stderr.write("Unexpected exception in snapshot():\n")
                 sys.stderr.write(traceback.format_exc())
diff --git a/test/common/webdriver_bidi.py b/test/common/webdriver_bidi.py
new file mode 100644
index 000000000000..1af1aef88b1c
--- /dev/null
+++ b/test/common/webdriver_bidi.py
@@ -0,0 +1,472 @@
+# This file is part of Cockpit.
+#
+# Copyright (C) 2024 Red Hat, Inc.
+#
+# Cockpit is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+#
+# Cockpit is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with Cockpit; If not, see <http://www.gnu.org/licenses/>.
+
+"""BiDi session/API driver
+
+This directly talks the https://w3c.github.io/webdriver-bidi/ protocol from async Python,
+without any node/JS in between. The only dependencies are aiohttp, firefox, and/or
+chromedriver+chromium (or headless_shell).
+"""
+
+import asyncio
+import contextlib
+import json
+import logging
+import os
+import socket
+import sys
+import tempfile
+from collections.abc import Iterator
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import aiohttp
+
+log_proto = logging.getLogger("bidi.proto")
+log_command = logging.getLogger("bidi.command")
+
+
+JsonObject = dict[str, Any]
+
+
+class WebdriverError(RuntimeError):
+    pass
+
+
+@dataclass
+class LogMessage:
+    level: str  # like "info"
+    type: str  # usually "console"
+    timestamp: int
+    args: list[object]
+    text: str
+
+    def __init__(self, message_params: JsonObject) -> None:
+        self.level = message_params["level"]
+        self.type = message_params["type"]
+        self.timestamp = message_params["timestamp"]
+        self.args = message_params.get("args", [])
+        self.text = message_params["text"]
+
+    def __str__(self) -> str:
+        return f"> {self.level}: {self.text}"
+
+
+@dataclass
+class BidiSession:
+    ws_url: str
+    session_url: str
+    process: asyncio.subprocess.Process
+
+
+# Return port numbers that were free at the time of checking
+# They might be in use again by the time the function returns...
+def pick_ports(count: int) -> list[int]:
+    sockets: list[socket.socket] = []
+    ports: list[int] = []
+
+    try:
+        for _ in range(count):
+            sock = socket.socket()
+            sock.bind(('127.0.0.1', 0))
+            sockets.append(sock)
+            ports.append(sock.getsockname()[1])
+    finally:
+        for s in sockets:
+            s.close()
+
+    return ports
+
+
+def jsquote(js: object) -> str:
+    return json.dumps(js)
+
+
+def unpack_value(raw: Any) -> Any:
+    """Convert a WebDriver type/value object into a plain Python object"""
+
+    if not isinstance(raw, dict):
+        return raw
+    try:
+        type_ = raw["type"]
+    except KeyError as e:
+        raise ValueError(f"No type in {raw!r}") from e
+    if type_ in ["undefined", "null"]:
+        return None
+    if type_ in ["string", "boolean", "number"]:
+        return raw["value"]
+    # serialized BiDi objects, don't touch
+    if type_ in ["function", "node", "window"]:
+        return raw
+    if type_ == "array":
+        return [unpack_value(v) for v in raw["value"]]
+    if type_ == "object":
+        obj = {}
+        for k, v in raw["value"]:
+            obj[k] = unpack_value(v["value"])
+        return obj
+    raise ValueError(f"Unknown type in {raw!r}")
+
+
+# FIXME: No current way to say `[Self]`
+class WebdriverBidi(contextlib.AbstractAsyncContextManager):  # type: ignore[type-arg]
+    http_session: aiohttp.ClientSession
+
+    def __init__(self, *, headless: bool = False) -> None:
+        self.headless = headless
+        self.last_id = 0
+        self.pending_commands: dict[int, asyncio.Future[JsonObject]] = {}
+        self.logs: list[LogMessage] = []
+        self.bidi_session: BidiSession | None = None
+        self.future_wait_page_load = None
+        self.top_context: str | None = None  # top-level browsingContext
+        self.context: str | None  # currently selected context (top or iframe)
+
+        self.homedir_temp = tempfile.TemporaryDirectory(prefix="cockpit-test-browser-home-")
+        self.homedir = Path(self.homedir_temp.name)
+        self.download_dir = self.homedir / 'Downloads'
+        self.download_dir.mkdir()
+
+    async def start_bidi_session(self) -> None:
+        raise NotImplementedError
+
+    async def close_bidi_session(self) -> None:
+        raise NotImplementedError
+
+    async def close(self) -> None:
+        assert self.bidi_session is not None
+        log_proto.debug("cleaning up webdriver")
+
+        self.task_reader.cancel()
+        del self.task_reader
+        await self.ws.close()
+        await self.close_bidi_session()
+        self.bidi_session.process.terminate()
+        await self.bidi_session.process.wait()
+        self.bidi_session = None
+        await self.http_session.close()
+
+    def ws_done_callback(self, future: asyncio.Future[None]) -> None:
+        for fut in self.pending_commands.values():
+            if not fut.done():
+                fut.set_exception(WebdriverError("websocket closed"))
+        if not future.cancelled():
+            log_proto.error("ws_reader crashed: %r", future.result())
+
+    async def start_session(self) -> None:
+        self.http_session = aiohttp.ClientSession(raise_for_status=True)
+        await self.start_bidi_session()
+        assert self.bidi_session
+        self.ws = await self.http_session.ws_connect(self.bidi_session.ws_url)
+        self.task_reader = asyncio.create_task(self.ws_reader(self.ws), name="bidi_reader")
+        self.task_reader.add_done_callback(self.ws_done_callback)
+
+        await self.bidi("session.subscribe", events=[
+            "log.entryAdded", "browsingContext.domContentLoaded",
+        ])
+
+        # wait for browser to initialize default context
+        for _ in range(10):
+            realms = (await self.bidi("script.getRealms"))["realms"]
+            if len(realms) > 0:
+                self.top_context = realms[0]["context"]
+                self.context = self.top_context
+                break
+            await asyncio.sleep(0.5)
+        else:
+            raise WebdriverError("timed out waiting for default realm")
+
+    async def __aenter__(self) -> "WebdriverBidi":
+        await self.start_session()
+        return self
+
+    async def __aexit__(self, *_excinfo: Any) -> None:
+        if self.bidi_session is not None:
+            await self.close()
+
+    async def ws_reader(self, ws: aiohttp.client.ClientWebSocketResponse) -> None:
+        async for msg in ws:
+            if msg.type == aiohttp.WSMsgType.TEXT:
+                data = json.loads(msg.data)
+                log_proto.debug("ws TEXT → %r", data)
+                id_ = data.get("id")
+                if id_ in self.pending_commands:
+                    log_proto.debug("ws_reader: resolving pending command %i", id_)
+                    pending_command = self.pending_commands[id_]
+                    if data["type"] == "success":
+                        if data["result"].get("type") == "exception":
+                            pending_command.set_exception(
+                                WebdriverError(data["result"]["exceptionDetails"]["text"]))
+                        else:
+                            pending_command.set_result(data["result"])
+                    elif data["type"] == "exception":
+                        pending_command.set_exception(
+                            WebdriverError(data["exceptionDetails"]["text"]))
+                    elif data["type"] == "error":
+                        pending_command.set_exception(
+                            WebdriverError(f"{data['error']}: {data.get('message', '')}"))
+                    else:
+                        pending_command.set_exception(
+                            WebdriverError(f"unknown response type: {data!r}"))
+                    del self.pending_commands[id_]
+                    continue
+
+                if data["type"] == "event":
+                    if data["method"] == "log.entryAdded":
+                        log = LogMessage(data["params"])
+                        self.logs.append(log)
+                        print(str(log), file=sys.stderr)
+                        continue
+                    if data["method"] == "browsingContext.domContentLoaded":
+                        if self.future_wait_page_load:
+                            log_command.debug("page loaded: %r, resolving wait page load future", data["params"])
+                            self.future_wait_page_load.set_result(data["params"]["url"])
+                        else:
+                            log_command.debug("page loaded: %r (not awaited)", data["params"])
+                        continue
+
+                log_proto.warning("ws_reader: unhandled message %r", data)
+            elif msg.type == aiohttp.WSMsgType.ERROR:
+                log_proto.error("BiDi failure: %s", msg)
+                break
+
+    async def bidi(self, method: str, *, quiet: bool = False, timeout: int = 10, **params: Any) -> JsonObject:
+        """Send a Webdriver BiDi command and return the JSON response
+
+        Most commands ought to be quick, so the default timeout is 10 seconds.
+        Set a custom one if you call a function which waits/polls for something
+        for a non-trivial duration.
+        """
+        payload = json.dumps({"id": self.last_id, "method": method, "params": params})
+        log_command.info("← %s(%r) [id %i]", method, 'quiet' if quiet else params, self.last_id)
+        await self.ws.send_str(payload)
+        future = asyncio.get_event_loop().create_future()
+        self.pending_commands[self.last_id] = future
+        res = await asyncio.wait_for(future, timeout=timeout)
+        if "result" in res:
+            value = unpack_value(res["result"])
+            log_proto.debug("[id %i] unpacking raw result %r", self.last_id, res["result"])
+            res["result"] = value
+        self.last_id += 1
+        if not quiet:
+            log_command.info("→ %r", res)
+        return res
+
+    # this is mostly unused; testlib uses ph_find() due to sizzle
+    async def locate(self, selector: str) -> str:
+        r = await self.bidi("browsingContext.locateNodes", context=self.context,
+                            locator={"type": "css", "value": selector})
+        nodes = r["nodes"]
+        if len(nodes) == 0:
+            raise WebdriverError(f"no element found for {selector}")
+        if len(nodes) > 1:
+            raise WebdriverError(f"selector {selector} is ambiguous: {nodes}")
+        log_command.info("locate(%s) = %r", selector, nodes[0])
+        return nodes[0]
+
+    async def switch_to_frame(self, name: str) -> None:
+        frame = await self.locate(f"iframe[name='{name}']")
+        cw = await self.bidi("script.callFunction",
+                             functionDeclaration="f => f.contentWindow",
+                             arguments=[frame],
+                             awaitPromise=False,
+                             target={"context": self.top_context})
+        self.context = cw["result"]["value"]["context"]
+        log_command.info("← switch_to_frame(%s)", name)
+
+    def switch_to_top(self) -> None:
+        self.context = self.top_context
+        log_command.info("← switch_to_top")
+
+    @contextlib.contextmanager
+    def restore_context(self, *, switch_to_top: bool = True) -> Iterator[None]:
+        saved = self.context
+        if switch_to_top:
+            self.switch_to_top()
+        try:
+            yield
+        finally:
+            self.context = saved
+
+
+class ChromiumBidi(WebdriverBidi):
+    def __init__(self, *, headless: bool = False) -> None:
+        super().__init__(headless=headless)
+        self.cdp_ws: aiohttp.client.ClientWebSocketResponse | None = None
+
+    async def start_bidi_session(self) -> None:
+        assert self.bidi_session is None
+
+        candidate_binaries = ["/usr/bin/chromium-browser"]
+        if self.headless:
+            candidate_binaries.insert(0, "/usr/lib64/chromium-browser/headless_shell")
+        binaries = [path for path in candidate_binaries if os.path.exists(path)]
+        if not binaries:
+            raise WebdriverError(f"no Chromium binary found: tried {' '.join(candidate_binaries)}")
+        chrome_binary = binaries[0]
+        log_proto.debug("webdriver chromium binary: %s", chrome_binary)
+
+        session_args = {"capabilities": {
+            "alwaysMatch": {
+                "webSocketUrl": True,
+                "acceptInsecureCerts": True,
+                "goog:chromeOptions": {
+                    "binary": chrome_binary,
+                    "args": [
+                        "--font-render-hinting=none",
+                        "--disable-pushstate-throttle",
+                        # HACK: For Cockpit-Files downloading uses `window.open` which is sometimes allowed depending
+                        # on unpredictable and unknown heuristics
+                        "--disable-popup-blocking",
+                    ] + (["--headless"] if self.headless else []),
+                },
+            }
+        }}
+
+        [webdriver_port] = pick_ports(1)
+        driver = await asyncio.create_subprocess_exec(
+                "chromedriver", "--port=" + str(webdriver_port),
+                env=dict(os.environ, HOME=str(self.homedir)))
+
+        wd_url = f"http://localhost:{webdriver_port}"
+
+        # webdriver needs some time to launch
+        for retry in range(1, 10):
+            try:
+                async with self.http_session.post(f"{wd_url}/session",
+                                                  data=json.dumps(session_args).encode()) as resp:
+                    session_info = json.loads(await resp.text())["value"]
+                    log_proto.debug("webdriver session request: %r %r", resp, session_info)
+                    break
+            except (IOError, aiohttp.client.ClientResponseError) as e:
+                log_proto.debug("waiting for webdriver: %s", e)
+                await asyncio.sleep(0.1 * retry)
+        else:
+            raise WebdriverError("could not connect to chromedriver")
+
+        self.cdp_address = session_info["capabilities"]["goog:chromeOptions"]["debuggerAddress"]
+        self.last_cdp_id = 0
+
+        self.bidi_session = BidiSession(
+            session_url=f"{wd_url}/session/{session_info['sessionId']}",
+            ws_url=session_info["capabilities"]["webSocketUrl"],
+            process=driver)
+        log_proto.debug("Established chromium session %r, CDP address %s", self.bidi_session, self.cdp_address)
+
+    async def close_cdp_session(self) -> None:
+        if self.cdp_ws is not None:
+            await self.cdp_ws.close()
+            self.cdp_ws = None
+
+    async def close_bidi_session(self) -> None:
+        assert self.bidi_session is not None
+        await self.close_cdp_session()
+        await self.http_session.delete(self.bidi_session.session_url)
+
+    async def cdp(self, method: str, **params: Any) -> dict[str, Any]:
+        """Send a Chrome DevTools command and return the JSON response
+
+        This is currently *not* safe for enabling events! These should be handled via BiDi,
+        this is only an escape hatch for CDP specific functionality such as Profiler.
+        """
+        if self.cdp_ws is None:
+            # unfortunately we have to hold on to the open ws after sending .enable() commands,
+            # otherwise they'll reset when closing and re-opening
+            self.cdp_ws = await self.http_session.ws_connect(
+                    f"ws://{self.cdp_address}/devtools/page/{self.top_context}",
+                    # coverage data can be big
+                    max_msg_size=16000000)
+
+        reply = None
+        payload = json.dumps({"id": self.last_cdp_id, "method": method, "params": params})
+        log_proto.debug("CDP ← %r", payload)
+        await self.cdp_ws.send_str(payload)
+        async for msg in self.cdp_ws:
+            if msg.type == aiohttp.WSMsgType.TEXT:
+                reply = json.loads(msg.data)
+                if reply.get("id") == self.last_cdp_id:
+                    break
+                else:
+                    log_proto.warning("CDP message: %r", reply)
+            else:
+                log_proto.debug("CDP non-text message: %r", msg)
+        log_proto.debug("CDP → %r", reply)
+        assert reply
+        self.last_cdp_id += 1
+        return reply
+
+
+# We could do this with https://github.com/mozilla/geckodriver/releases with a similar protocol as ChromeBidi
+# But let's use https://firefox-source-docs.mozilla.org/testing/marionette/Protocol.html directly, fewer moving parts
+class FirefoxBidi(WebdriverBidi):
+    async def start_bidi_session(self) -> None:
+        [marionette_port, bidi_port] = pick_ports(2)
+
+        self.profiledir = self.homedir / "profile"
+        self.profiledir.mkdir()
+        (self.profiledir / "user.js").write_text(f"""
+            user_pref("remote.enabled", true);
+            user_pref("remote.frames.enabled", true);
+            user_pref("app.update.auto", false);
+            user_pref("datareporting.policy.dataSubmissionEnabled", false);
+            user_pref("toolkit.telemetry.reportingpolicy.firstRun", false);
+            user_pref("dom.disable_beforeunload", true);
+            user_pref("browser.download.dir", "{self.download_dir}");
+            user_pref("browser.download.folderList", 2);
+            user_pref("signon.rememberSignons", false);
+            user_pref("dom.navigation.locationChangeRateLimit.count", 9999);
+            user_pref('marionette.port', {marionette_port});
+            """)
+
+        driver = await asyncio.create_subprocess_exec(
+            "firefox", "-profile", str(self.profiledir), "--marionette", "--no-remote",
+            f"--remote-debugging-port={bidi_port}",
+            *(["-headless"] if self.headless else []), "about:blank")
+
+        # needs some time to launch
+        for _ in range(1, 30):
+            try:
+                # we must keep this socket open throughout the lifetime of that session
+                reader, self.writer_marionette = await asyncio.open_connection("127.0.0.1", marionette_port)
+                break
+            except ConnectionRefusedError as e:
+                log_proto.debug("waiting for firefox marionette: %s", e)
+                await asyncio.sleep(1)
+        else:
+            raise WebdriverError("could not connect to firefox marionette")
+
+        reply = await reader.read(1024)
+        if b'"marionetteProtocol":3' not in reply:
+            raise WebdriverError(f"unexpected marionette reply: {reply.decode()}")
+        cmd = '[0,1,"WebDriver:NewSession",{"webSocketUrl":true,"acceptInsecureCerts":true}]'
+        self.writer_marionette.write(f"{len(cmd)}:{cmd}".encode())
+        await self.writer_marionette.drain()
+        reply = await reader.read(1024)
+        # cut off length prefix
+        reply = json.loads(reply[reply.index(b":") + 1:].decode())
+        if not isinstance(reply, list) or len(reply) != 4 or not isinstance(reply[3], dict):
+            raise WebdriverError(f"unexpected marionette session request reply: {reply!r}")
+        log_proto.debug("marionette session request reply: %s", reply)
+
+        url = reply[3]["capabilities"]["webSocketUrl"]
+        self.bidi_session = BidiSession(session_url=url, ws_url=url, process=driver)
+        log_proto.debug("Established firefox session %r", self.bidi_session)
+
+    async def close_bidi_session(self) -> None:
+        self.writer_marionette.close()
+        await self.writer_marionette.wait_closed()
diff --git a/test/reference b/test/reference
index 49ef2e9d7c49..c27bf1b16f6d 160000
--- a/test/reference
+++ b/test/reference
@@ -1 +1 @@
-Subproject commit 49ef2e9d7c491157f66abe28c32907a96c6844b9
+Subproject commit c27bf1b16f6d8ed4847c817bbcefd12ebafb4440
diff --git a/test/verify/check-connection b/test/verify/check-connection
index 60df4445ce96..a8eaf2afc565 100755
--- a/test/verify/check-connection
+++ b/test/verify/check-connection
@@ -107,7 +107,7 @@ class TestConnection(testlib.MachineCase):
         # cookie should not be marked as secure, it's not https
         cookie = b.cookie("cockpit")
         self.assertTrue(cookie["httpOnly"])
-        self.assertEqual(cookie["sameSite"].lower(), "strict")
+        self.assertEqual(cookie["sameSite"], "strict")
         self.assertFalse(cookie["secure"])
 
         # take cockpit-ws down on the server page
@@ -502,14 +502,14 @@ class TestConnection(testlib.MachineCase):
         # cookie should be marked as secure
         self.assertTrue(cookie["httpOnly"])
         self.assertTrue(cookie["secure"])
-        self.assertEqual(cookie["sameSite"].lower(), "strict")
+        self.assertEqual(cookie["sameSite"], "strict")
         # same after logout
         b.logout()
         cookie = b.cookie("cockpit")
         self.assertEqual(cookie["value"], "deleted")
         self.assertTrue(cookie["httpOnly"])
         self.assertTrue(cookie["secure"])
-        self.assertEqual(cookie["sameSite"].lower(), "strict")
+        self.assertEqual(cookie["sameSite"], "strict")
 
         # http on localhost should not redirect to https
         self.assertIn("HTTP/1.1 200 OK", m.execute("curl --head http://127.0.0.1:9090"))
@@ -978,7 +978,6 @@ until pgrep -f '^(/usr/[^ ]+/[^ /]*python[^ /]* )?/usr/bin/cockpit-bridge'; do s
         self.allow_journal_messages(r".*cannot reauthorize identity\(s\): unix-user:.*")
         self.allow_journal_messages("admin: Executing command .*COMMAND=.*cockpit-bridge --privileged.*")
 
-    @testlib.skipBrowser("Firefox needs proper cert and CA", "firefox")
     def testReverseProxy(self):
         m = self.machine
         b = self.browser
@@ -1005,12 +1004,8 @@ until pgrep -f '^(/usr/[^ ]+/[^ /]*python[^ /]* )?/usr/bin/cockpit-bridge'; do s
         b.set_val("#login-password-input", "foobar")
         b.click('#login-button')
 
-        def check_wss_log():
-            for log in self.browser.get_js_log():
-                if 'Error during WebSocket handshake: Unexpected response code: 403' in log:
-                    return True
-            return False
-        testlib.wait(check_wss_log)
+        b.wait_text(".early-failure .pf-v5-c-empty-state__title", "Connection failed")
+        b.wait_in_text(".early-failure ", "unexpected error while connecting to the machine")
 
         testlib.wait(lambda: m.execute("grep 'received request from bad Origin' /var/log/ws-notls.log"))
 
diff --git a/test/verify/check-embed b/test/verify/check-embed
index f09acb57f7e6..dacc12311807 100755
--- a/test/verify/check-embed
+++ b/test/verify/check-embed
@@ -96,7 +96,7 @@ Shell=/shell/index.html
         b.switch_to_frame("embed-full")
 
         # X-Frame-Options sameorigin blocks frame
-        if b.cdp.browser.name == "firefox":
+        if b.browser == "firefox":
             b.wait_visible("body.neterror")
         self.assertFalse(b.is_present("#login"))
 
diff --git a/test/verify/check-kdump b/test/verify/check-kdump
index c6b48506454e..403cd16d74ae 100755
--- a/test/verify/check-kdump
+++ b/test/verify/check-kdump
@@ -360,8 +360,10 @@ class TestKdump(KdumpHelpers):
 
         # Check malformed lines
         b.wait_text("#kdump-target-info", "No configuration found")
-        b.wait(lambda: "warning: Malformed kdump config line: skip this line in /etc/sysconfig/kdump" in list(self.browser.get_js_log()))
-        b.wait(lambda: "warning: Malformed KDUMP_SAVEDIR entry: ssh//missing/colon in /etc/sysconfig/kdump" in list(self.browser.get_js_log()))
+        b.wait(lambda: "Malformed kdump config line: skip this line in /etc/sysconfig/kdump" in
+               '/'.join(self.browser.get_js_log()))
+        b.wait(lambda: "Malformed KDUMP_SAVEDIR entry: ssh//missing/colon in /etc/sysconfig/kdump" in
+               '/'.join(self.browser.get_js_log()))
 
         # Remove malformed KDUMP_SAVEDIR to check default if nothing specified
         m.execute("sed -i '/KDUMP_SAVEDIR=.*/d' /etc/sysconfig/kdump")
diff --git a/test/verify/check-metrics b/test/verify/check-metrics
index 271bac3fb9c5..e81d14d13bd7 100755
--- a/test/verify/check-metrics
+++ b/test/verify/check-metrics
@@ -1419,6 +1419,8 @@ class TestMultiCPU(testlib.MachineCase):
 
 @testlib.skipOstree("no PCP support")
 @testlib.skipImage("pcp not currently in testing", "debian-testing")
+# FIXME: Works with TEST_SHOW_BROWSER; not obvious what happens
+@testlib.skipBrowser("Headless chromium spontaneously logs out Grafana", "chromium")
 class TestGrafanaClient(testlib.MachineCase):
 
     provision = {
diff --git a/test/verify/check-pages b/test/verify/check-pages
index 96ab6727b2f6..564caf6a694a 100755
--- a/test/verify/check-pages
+++ b/test/verify/check-pages
@@ -254,7 +254,8 @@ OnCalendar=daily
         b.wait_visible('#password-group')
         b.wait_text("#password-group > label", "Passwort")
 
-    @testlib.onlyImage("Enough to test on one OS, not OS specific", "rhel-9*")
+    # FIXME: Works with TEST_SHOW_BROWSER; not obvious what happens
+    @testlib.skipBrowser("Headless chromium spontaneously logs out", "chromium")
     def testAllLanguages(self):
         # Test that pages do not oops
         m = self.machine
@@ -686,7 +687,7 @@ OnCalendar=daily
         # range, otherwise we would find any arbitrary average in a
         # graph with a slope.
 
-        b.inject_js("""
+        b.eval_js("""
           ph_plateau = function (data, min, max, duration, label) {
               var i, j;
               var sum;  // sum of data[i..j]
@@ -711,7 +712,7 @@ OnCalendar=daily
           }
         """)
 
-        b.inject_js("""
+        b.eval_js("""
           ph_plot_data_plateau = function (sel, min, max, duration, label) {
             return ph_plateau(window.plot_state.data(sel)[0].data, min, max, duration, label);
           }
@@ -869,7 +870,6 @@ OnCalendar=daily
         # logging out too fast, some D-Bus services get disconnected
         self.allow_restart_journal_messages()
 
-    @testlib.skipBrowser(".upload_files() doesn't work on Firefox", "firefox")
     def testUpload(self) -> None:
         b = self.browser
         m = self.machine
@@ -938,7 +938,6 @@ OnCalendar=daily
         b.upload_files("#demo-upload input[type='file']", [test_upload_file])
         b.wait_in_text(".pf-v5-c-alert", "Not permitted to perform this action")
 
-    @testlib.skipBrowser(".upload_files() doesn't work on Firefox", "firefox")
     def testUploadMultiple(self) -> None:
         b = self.browser
         m = self.machine
diff --git a/test/verify/check-selinux b/test/verify/check-selinux
index 95005594ae90..7fdc3bac6f42 100755
--- a/test/verify/check-selinux
+++ b/test/verify/check-selinux
@@ -207,11 +207,7 @@ class TestSelinux(testlib.MachineCase):
         b.click(dismiss_sel)
         b.wait_not_present(row_selector)
 
-        try:
-            b.grant_permissions("clipboardReadWrite", "clipboardSanitizedWrite")
-        except RuntimeError:
-            # fallback for older Chrome releases
-            b.grant_permissions("clipboardRead", "clipboardWrite")
+        b.grant_permissions("clipboard-read", "clipboard-write")
 
         b.wait_visible(".pf-v5-c-data-list__cell:contains(Allow zebra)")
         b.wait_visible(".pf-v5-c-data-list__cell:contains(fcontext -a -f a -t samba_share_t -r 's0' '/var/tmp/')")
diff --git a/test/verify/check-shell-host-switching b/test/verify/check-shell-host-switching
index 5c99ad4d79e5..8fe490bee984 100755
--- a/test/verify/check-shell-host-switching
+++ b/test/verify/check-shell-host-switching
@@ -468,7 +468,7 @@ class TestHostSwitching(testlib.MachineCase, HostSwitcherHelpers):
         # On Firefox the popup window cannot be targeted nor with mouse nor keayboard
         # On Chomium it is possible to tab-navigate through the color selector
         # So tab to RGB inputs and type in zeros
-        if b.cdp.browser.name == "chromium":
+        if b.browser == "chromium":
             b.focus("input[type=color]")
             b.click("input[type=color]")
             time.sleep(1)  # We cannot wait until the popup opens up, so just little of waiting
@@ -497,12 +497,12 @@ class TestHostSwitching(testlib.MachineCase, HostSwitcherHelpers):
         b.click("#nav-hosts .nav-item a[href='/@10.111.113.3'] + span button.nav-action.pf-m-secondary")
 
         b.wait_val('#add-machine-address', "10.111.113.3")
-        if b.cdp.browser.name == "chromium":
+        if b.browser == "chromium":
             self.assertEqual(b.attr("input[type=color]", "value"), "#000000")
         b.wait_val('#add-machine-user', 'franz')
         b.set_input_text('#add-machine-address', "10.111.113.2")
         b.set_input_text('#add-machine-user', 'admin')
-        if b.cdp.browser.name == "chromium":
+        if b.browser == "chromium":
             self.assertNotEqual(b.attr("input[type=color]", "value"), "#000000")
         b.click('#hosts_setup_server_dialog .pf-m-primary')
         b.wait_in_text('#hosts_setup_server_dialog', "You are connecting to 10.111.113.2 for the first time.")
diff --git a/test/verify/check-shell-menu b/test/verify/check-shell-menu
index 1cf22e2ea43a..1c6b5ae23f3c 100755
--- a/test/verify/check-shell-menu
+++ b/test/verify/check-shell-menu
@@ -45,7 +45,7 @@ class TestMenu(testlib.MachineCase):
         b.wait_not_present("html.pf-v5-theme-dark")
 
         # Test overriding, switching only works on Chromium
-        if b.cdp.browser.name == "chromium":
+        if b.browser == "chromium":
             # Light theme overrides browser defaults
             b._set_emulated_media_theme("dark")
             b.wait_not_present("html.pf-v5-theme-dark")
@@ -101,15 +101,9 @@ class TestMenu(testlib.MachineCase):
         b.wait_in_text("#host-apps .pf-m-current", "Development")
 
         b.enter_page("/playground/exception")
-        b.wait_visible("button")
-        with self.assertRaisesRegex(RuntimeError, "TypeError:.*undefined"):
-            b.click("button")
-            # Some round trips, one of which should update the deferred exception
-            for _ in range(5):
-                b.wait_visible("button")
-                time.sleep(2)
-
-        # UI should also show the crash
+        b.click("button")
+
+        # UI should show the crash
         b.switch_to_top()
         b.wait_visible("#navbar-oops")
 
diff --git a/test/verify/check-sosreport b/test/verify/check-sosreport
index 95ae2a6c9a37..5e6d268364e5 100755
--- a/test/verify/check-sosreport
+++ b/test/verify/check-sosreport
@@ -17,7 +17,6 @@
 # You should have received a copy of the GNU Lesser General Public License
 # along with Cockpit; If not, see <http://www.gnu.org/licenses/>.
 
-import glob
 import os.path
 import subprocess
 import tarfile
@@ -80,7 +79,7 @@ class TestSOS(testlib.MachineCase):
         b.allow_download()
 
         def downloaded_sosreports():
-            return glob.glob(os.path.join(b.cdp.download_dir, "*sosreport-*.xz.gpg"))
+            return [str(p) for p in b.driver.download_dir.glob("*sosreport-*.xz.gpg")]
 
         b.click("tr:contains(mylabel) button:contains(Download)")
         # while the download is ongoing, it will have an *.xz.tmpsuffix name, gets renamed to *.xz when done
diff --git a/test/verify/check-static-login b/test/verify/check-static-login
index a3fdb2520925..72603b92122a 100755
--- a/test/verify/check-static-login
+++ b/test/verify/check-static-login
@@ -540,7 +540,8 @@ account    required     pam_succeed_if.so user ingroup %s""" % m.get_admin_group
 
         m.start_cockpit()
         # pretend browser doesn't support a required capability
-        b.cdp.invoke("Page.addScriptToEvaluateOnNewDocument", source="window.WebSocket = undefined;")
+        b.bidi("script.addPreloadScript", functionDeclaration="""() => {
+               window.WebSocket = undefined; }""")
         b.open("/system")
         b.wait_visible("#unsupported-browser")
         b.wait_not_visible("#login-fatal")
@@ -552,9 +553,8 @@ account    required     pam_succeed_if.so user ingroup %s""" % m.get_admin_group
         b = self.browser
 
         m.start_cockpit()
-        b.cdp.invoke("Page.addScriptToEvaluateOnNewDocument", source="""
-          window.CSS.supports = function() { return false; };
-        """)
+        b.bidi("script.addPreloadScript", functionDeclaration="""() => {
+               window.CSS.supports = () => false; }""")
         b.open("/system")
         b.wait_visible("#unsupported-browser")
         b.wait_in_text("#bypass-browser-check", "Bypass browser check")
diff --git a/test/verify/check-storage-multipath b/test/verify/check-storage-multipath
index afd00e539e13..ff7430b6cc0f 100755
--- a/test/verify/check-storage-multipath
+++ b/test/verify/check-storage-multipath
@@ -53,7 +53,7 @@ class TestStorageMultipath(storagelib.StorageCase):
 
         self.login_and_go("/storage")
 
-        b.inject_js("""
+        b.eval_js("""
           ph_texts = function (sel) {
             return ph_select(sel).map(function (e) { return e.textContent });
           }""")
diff --git a/test/verify/check-storage-unused b/test/verify/check-storage-unused
index 0e370a148fdf..e5f9e2b8848d 100755
--- a/test/verify/check-storage-unused
+++ b/test/verify/check-storage-unused
@@ -52,7 +52,7 @@ mkpart logical ext2 24 48"""
         m.execute("udevadm settle")
         m.execute(f"mke2fs -q -L TEST {disk1}5")
 
-        b.inject_js("""
+        b.eval_js("""
           ph_texts = function (sel) {
             return ph_select(sel).map(function(e) { return e.textContent });
           }""")
diff --git a/test/verify/check-system-journal b/test/verify/check-system-journal
index 686b63aa1c15..97938e6dd7f3 100755
--- a/test/verify/check-system-journal
+++ b/test/verify/check-system-journal
@@ -32,7 +32,7 @@ class TestJournal(testlib.MachineCase):
         self.test_start_time = self.machine.execute("date +%s").strip()
 
     def injectExtras(self):
-        self.browser.inject_js("""
+        self.browser.eval_js("""
         ph_get_log_lines = function () {
             var lines = [ ];
             var panels = ph_find('.cockpit-log-panel').childNodes;
@@ -406,7 +406,7 @@ ExecStart=/bin/sh -c 'sleep 5; for s in $(seq 10); do echo SLOW; sleep 0.1; done
         self.login_and_go("/system/logs")
 
         self.injectExtras()
-        b.inject_js("""
+        b.eval_js("""
             localTime = function(time) {
                 var month_names = [
                     'January',
diff --git a/test/verify/check-system-services b/test/verify/check-system-services
index b2de8f593295..e0666b4ce26d 100755
--- a/test/verify/check-system-services
+++ b/test/verify/check-system-services
@@ -342,7 +342,7 @@ WantedBy=default.target
         b.go(f'/system/services#/{suffix}')
 
         # returns index of first unit that isn't failed
-        b.inject_js("""
+        b.eval_js("""
                     function firstWorkingUnitPos() {
                         const services = document.getElementById('services-list');
                         for (let i = 0; i < services.childElementCount; i++) {
diff --git a/test/verify/check-system-terminal b/test/verify/check-system-terminal
index e0d780e60b24..fc20775e0aa3 100755
--- a/test/verify/check-system-terminal
+++ b/test/verify/check-system-terminal
@@ -133,12 +133,8 @@ PROMPT_COMMAND='printf "\033]0;%s@%s:%s\007" "${USER}" "${HOSTNAME%%.*}" "${PWD/
 
         # Firefox does not support setting of permissions
         # and therefore we cannot test copy/paste with context menu
-        if b.cdp.browser.name != "firefox":
-            try:
-                b.grant_permissions("clipboardReadWrite", "clipboardSanitizedWrite")
-            except RuntimeError:
-                # fallback for older Chrome releases
-                b.grant_permissions("clipboardRead", "clipboardWrite")
+        if b.browser != "firefox":
+            b.grant_permissions("clipboard-read", "clipboard-write")
 
             # Execute command
             wait_line(n, prompt)
@@ -185,8 +181,8 @@ PROMPT_COMMAND='printf "\033]0;%s@%s:%s\007" "${USER}" "${HOSTNAME%%.*}" "${PWD/
         select_line(sel, 40)
 
         # Use keyboard shortcuts to copy text
-        b.key("Insert", modifiers=2)  # Ctrl
-        b.key("Insert", modifiers=8)  # Shift
+        b.key("Insert", modifiers=["Control"])
+        b.key("Insert", modifiers=["Shift"])
 
         # Wait for text to show up
         wait_line(echo_result_line + 1, prompt + "foo")
diff --git a/test/verify/check-users b/test/verify/check-users
index 21b72576df2f..0a848167a7ef 100755
--- a/test/verify/check-users
+++ b/test/verify/check-users
@@ -355,7 +355,7 @@ class TestAccounts(testlib.MachineCase):
         b.click("div.pf-v5-c-empty-state button.pf-m-link")
         b.wait_not_present("#accounts div.pf-v5-c-empty-state")
 
-        b.inject_js("""
+        b.eval_js("""
                     function getTextColumn(query_selector) {
                         const values = [];
                         document.querySelectorAll(query_selector).forEach(node => values.push(node.innerText));
diff --git a/tools/debian/copyright.template b/tools/debian/copyright.template
index f53327f77b0b..376e35babd3a 100644
--- a/tools/debian/copyright.template
+++ b/tools/debian/copyright.template
@@ -55,22 +55,10 @@ License: CC0-1.0
 #NPM# semi-autogenerated records for node_modules/ go here
 
 
-Files: node_modules/chrome-remote-interface/*
-Copyright: (c) 2020 Andrea Cardaci <cyrus.and@gmail.com>
-License: MIT
-
-Files: node_modules/commander/*
-Copyright: (c) 2011 TJ Holowaychuk <tj@vision-media.ca>
-License: MIT
-
 Files: node_modules/sizzle/*
 Copyright:  JS Foundation and other contributors, https://js.foundation/
 License: MIT
 
-Files: node_modules/ws/*
-Copyright: (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
-License: MIT
-
 License: LGPL-2.1-or-later
  This package is free software; you can redistribute it and/or
  modify it under the terms of the GNU Lesser General Public
diff --git a/tools/debian/source/lintian-overrides b/tools/debian/source/lintian-overrides
index 70145d0457ef..602ee2ce72b2 100644
--- a/tools/debian/source/lintian-overrides
+++ b/tools/debian/source/lintian-overrides
@@ -2,7 +2,5 @@
 cockpit source: source-is-missing *pkg/static/login.html*
 cockpit source: source-is-missing *src/cockpit/data/fail.html*
 cockpit source: source-is-missing *src/common/fail.html*
-# source contains NPM modules required for running browser integration tests
-cockpit source: source-is-missing *node_modules/*
 # dist/ is (pre-)built from pkg/ and node_modules, see ./build.js
 cockpit source: source-is-missing *dist/*
diff --git a/tools/vulture_suppressions/cdp.py b/tools/vulture_suppressions/cdp.py
new file mode 100644
index 000000000000..b8ebfb4fe320
--- /dev/null
+++ b/tools/vulture_suppressions/cdp.py
@@ -0,0 +1,4 @@
+from cdp import CDP
+
+# not really used any more, but unit tests still use CDP
+CDP.set_frame