Problem:
In an empty window, Activity Bar extension icons render normally.
After opening an SSH/WSL workspace, icons are normal at first, but during the second extension-host/workbench refresh they turn into square/missing-glyph boxes. The clickable areas still work and the extension views can still open.
Steps to Reproduce
Tried:
Default product/icon theme
Vertical Activity Bar
Reload Window
Disable GPU
Disable UI-related extensions, including background/theme extensions
Reinstall/reload extensions
Expected Behavior
Expected:
Activity Bar extension icons should remain visible after workspace/remote extension host refresh.
Screenshots / Screen Recordings
Operating System
Windows 10/11
Version Information
Version: Cursor 3.8.11
OS: Windows
Remote: SSH/WSL workspace
Additional Information
Relevant logs:
remote-containers activates on workspaceContains
onStartupFinished extensions activate again
repeated: “No bundle location found for extension anysphere…”
Hey there! Thanks for the detailed report and screenshot.
This is a known bug with Remote-SSH and WSL sessions: the scheme used to load extension resources isn’t marked as CORS-enabled, so Chromium blocks the icon SVGs and fonts and you get empty squares. The buttons still work because only the glyph fails to load. We can reproduce it, and a fix is already prepared and in the pipeline. I can’t share an exact ETA yet.
A temporary workaround is Developer: Reload Window (Ctrl+Shift+P then Developer: Reload Window). It usually brings the icons back, though on 3.8.11 it doesn’t always hold and reconnecting to the remote session can bring the boxes back.
To be clear: this regression started after Cursor 3.8.11. Previous versions did not have this issue on the same Windows machine, with the same extensions and the same SSH/WSL workspaces.
Also, Ctrl+Shift+P → Developer: Reload Window does NOT fix it. The icons may temporarily appear normal in an empty window, but after opening an SSH/WSL workspace and the Activity Bar / extension host refreshes again, the extension icons turn into square boxes / missing glyphs again. The clickable areas still work, so this looks like an Activity Bar icon rendering regression, not an extension activation failure.
This is extremely frustrating. It breaks daily usage of non-native extensions because the Activity Bar becomes visually unusable. Please do not treat this as a generic “reload window” or extension setup issue. It is a reproducible Windows regression introduced after 3.8.11 and still present in 3.8.22.
Update: I found a local patch that fixes this on my machine, which strongly suggests this is a Cursor-side scheme/CORS regression, not an extension issue.
The issue is still present in Cursor 3.8.22. It started after 3.8.11; older versions did not have this problem.
In the local Cursor installation, I patched the main process bundle and added vscode-remote-resource to registerSchemesAsPrivileged with corsEnabled: true:
After restarting Cursor, the Activity Bar icons for remote SSH/WSL workspaces render correctly again.
This matches the symptoms:
Empty local window: icons are fine
Open SSH/WSL workspace: icons become square boxes after the second refresh
Click areas still work, so extensions are activated correctly
Developer: Reload Window does not fix it
Local patching the scheme privileges does fix it
This is only a temporary workaround, and I hope the Cursor team can provide an official fix as soon as possible.
This is not a reasonable workaround for users, because it requires patching Cursor’s minified production bundle and the change is overwritten on every update. But it should be a useful lead for the Cursor team.
I have the same issue since couple of updates ago. It happened before but was eventually fixed, now it doesn’t work again on v3.9.8. Here is an error message from the dev tools console (censored path):
Access to image at ‘vscode-remote-resource://127.0.0.1:39316/stable-4aa8ff1b7877ed7bd01bcba308698f71a6735380/vscode-remote-resource?path=…’ from origin ‘vscode-file://vscode-app’ has been blocked by CORS policy: Cross origin requests are only supported for protocol schemes: chrome, chrome-extension, chrome-untrusted, cursor-rpc-devtools, data, http, https, sentry-ipc, vscode-file, vscode-webview.
What is up with this one? It is a recurring bug, and there is a fix for it (in VSCode) linked in this thread, and it is quite visible and impactful. Can it be prioritized please?
I have come to add my screams to the void in the hopes it will urge the cursor team to prioritize this issue. This is still an issue in 3.10.17. I can confirm that the patch mentioned by CYX bypasses the issue in this version as well. Please fix this soon
Thanks for the extra detail. You’ve got the cause right: this is a browser security (CORS) restriction blocking the icon and font files that extensions load over the remote resource path in SSH/WSL sessions, so the glyphs fail and you see empty squares. The buttons still work, which is why the views open and tooltips show. And it isn’t Windows-only, @noamgo and others are hitting the same thing on macOS.
One correction to my earlier reply: Developer: Reload Window doesn’t reliably fix this in a remote session. It may look fixed in an empty window, but the squares come back once the extension host refreshes on reconnect. Sorry for pointing you there.
Where it stands:
This is a known issue our team is tracking, and it’s marked high priority internally.
It’s confirmed and reproducible on our side, so there’s nothing further you need to send.
I don’t have an ETA yet, and it’s still present on the latest builds (3.10.x), so please don’t assume a particular version has it fixed until we confirm here.
@CYX on the local patch: thanks for sharing it. It’s a useful lead and matches exactly what we’re seeing. I’d steer everyone else away from applying it though, since it means editing Cursor’s production files, gets wiped on every update, and can leave your install in a bad state, so it isn’t something we can recommend.
The good news is it’s cosmetic only. Your extensions are fully active, so you can still open their views by clicking the blank icon or from the Command Palette. I’ll update this thread as soon as the fix ships.
@mohitjain I would not consider it a “cosmetic only” issue to be unable to identify buttons considering it affects more than just the activity bar. Entire rows of buttons become unusable because one needs to either memorize the order or hover over every single one to check the tooltip. This is not a minor issue.
@archon810 It looks like the same issue, but you can confirm by opening the chromium dev tools with Developer: Toggle Developer Tools and checking the console for an error like “Access to font at ‘vscode-remote-resource://127.0.0.1…’ from origin ‘vscode-file://vscode-app’ has been blocked by CORS policy”
Thanks both, and @zane-dmax you’re right to push back. It doesn’t lose data or disable your extensions, but a row of identical blank buttons you can’t tell apart without hovering each one is a genuine usability problem, and it’s not limited to the activity bar. That’s noted, and it’s part of why this is high priority on our side.
@archon810 - yes, that’s very likely the same bug even if the boxes look a bit different, since the same icon and font files fail to load. The quickest confirmation is what @zane-dmax suggested: open Developer: Toggle Developer Tools and look for a console error like “…blocked by CORS policy” on a vscode-remote-resource URL.
Where it stands: this is still a known, reproduced issue we’re tracking at high priority, and it’s still present on the latest builds, so no version has it fixed yet. I don’t have an ETA, but I’ll post here the moment the fix ships. And thanks @zane-dmax for the dev-tools tip, that’s a handy way for anyone else to check whether they’re hitting the same thing.
