diff --git a/core/input/keyboard.js b/core/input/keyboard.js
index 68da2312b..ff14de849 100644
--- a/core/input/keyboard.js
+++ b/core/input/keyboard.js
@@ -203,7 +203,7 @@ export default class Keyboard {
         if ((code === "ControlLeft") && browser.isWindows() &&
             !("ControlLeft" in this._keyDownList)) {
             this._altGrArmed = true;
-            this._altGrTimeout = setTimeout(this._handleAltGrTimeout.bind(this), 100);
+            this._altGrTimeout = setTimeout(this._interruptAltGrSequence.bind(this), 100);
             this._altGrCtrlTime = e.timeStamp;
             return;
         }
@@ -218,11 +218,7 @@ export default class Keyboard {
 
         // We can't get a release in the middle of an AltGr sequence, so
         // abort that detection
-        if (this._altGrArmed) {
-            this._altGrArmed = false;
-            clearTimeout(this._altGrTimeout);
-            this._sendKeyEvent(KeyTable.XK_Control_L, "ControlLeft", true);
-        }
+        this._interruptAltGrSequence();
 
         // See comment in _handleKeyDown()
         if ((browser.isMac() || browser.isIOS()) && (code === 'CapsLock')) {
@@ -249,14 +245,20 @@ export default class Keyboard {
         }
     }
 
-    _handleAltGrTimeout() {
-        this._altGrArmed = false;
-        clearTimeout(this._altGrTimeout);
-        this._sendKeyEvent(KeyTable.XK_Control_L, "ControlLeft", true);
+    _interruptAltGrSequence() {
+        if (this._altGrArmed) {
+            this._altGrArmed = false;
+            clearTimeout(this._altGrTimeout);
+            this._sendKeyEvent(KeyTable.XK_Control_L, "ControlLeft", true);
+        }
     }
 
     _allKeysUp() {
         Log.Debug(">> Keyboard.allKeysUp");
+
+        // Prevent control key being processed after losing focus.
+        this._interruptAltGrSequence();
+
         for (let code in this._keyDownList) {
             this._sendKeyEvent(this._keyDownList[code], code, false);
         }
diff --git a/eslint.config.mjs b/eslint.config.mjs
index c88e7b758..13b1a32a4 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -79,7 +79,7 @@ export default [
                 ...globals.node,
                 ...globals.mocha,
                 sinon: false,
-                chai: false,
+                expect: false,
             }
         },
         rules: {
diff --git a/karma.conf.js b/karma.conf.js
index 1ea17475a..54380ebd2 100644
--- a/karma.conf.js
+++ b/karma.conf.js
@@ -27,15 +27,22 @@ module.exports = (config) => {
 
     // frameworks to use
     // available frameworks: https://npmjs.org/browse/keyword/karma-adapter
-    frameworks: ['mocha', 'sinon-chai'],
+    frameworks: ['mocha'],
 
-    // list of files / patterns to load in the browser (loaded in order)
+    // list of files / patterns to load in the browser
     files: [
+      // node modules
+      { pattern: 'node_modules/chai/**', included: false },
+      { pattern: 'node_modules/sinon/**', included: false },
+      { pattern: 'node_modules/sinon-chai/**', included: false },
+      // modules to test
       { pattern: 'app/localization.js', included: false, type: 'module' },
       { pattern: 'app/webutil.js', included: false, type: 'module' },
       { pattern: 'core/**/*.js', included: false, type: 'module' },
       { pattern: 'vendor/pako/**/*.js', included: false, type: 'module' },
+      // tests
       { pattern: 'tests/test.*.js', type: 'module' },
+      // test support files
       { pattern: 'tests/fake.*.js', included: false, type: 'module' },
       { pattern: 'tests/assertions.js', type: 'module' },
     ],
diff --git a/package.json b/package.json
index 9fa8c312d..e28850a8d 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,6 @@
     "karma-mocha-reporter": "latest",
     "karma-safari-launcher": "latest",
     "karma-script-launcher": "latest",
-    "karma-sinon-chai": "latest",
     "mocha": "latest",
     "node-getopt": "latest",
     "po2json": "latest",
diff --git a/tests/assertions.js b/tests/assertions.js
index 739f63753..a70122717 100644
--- a/tests/assertions.js
+++ b/tests/assertions.js
@@ -1,3 +1,12 @@
+import * as chai from '../node_modules/chai/chai.js';
+import sinon from '../node_modules/sinon/pkg/sinon-esm.js';
+import sinonChai from '../node_modules/sinon-chai/lib/sinon-chai.js';
+
+window.expect = chai.expect;
+
+window.sinon = sinon;
+chai.use(sinonChai);
+
 // noVNC specific assertions
 chai.use(function (_chai, utils) {
     function _equal(a, b) {
diff --git a/tests/test.base64.js b/tests/test.base64.js
index 04bd207b7..e5644dcdb 100644
--- a/tests/test.base64.js
+++ b/tests/test.base64.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Base64 from '../core/base64.js';
 
 describe('Base64 Tools', function () {
diff --git a/tests/test.browser.js b/tests/test.browser.js
index 1beeb48d5..692cc23b2 100644
--- a/tests/test.browser.js
+++ b/tests/test.browser.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import { isMac, isWindows, isIOS, isAndroid, isChromeOS,
          isSafari, isFirefox, isChrome, isChromium, isOpera, isEdge,
          isGecko, isWebKit, isBlink } from '../core/util/browser.js';
diff --git a/tests/test.copyrect.js b/tests/test.copyrect.js
index a10cddce7..60c395287 100644
--- a/tests/test.copyrect.js
+++ b/tests/test.copyrect.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import Display from '../core/display.js';
 
diff --git a/tests/test.deflator.js b/tests/test.deflator.js
index a7e972ec0..b565b9075 100644
--- a/tests/test.deflator.js
+++ b/tests/test.deflator.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import { inflateInit, inflate } from "../vendor/pako/lib/zlib/inflate.js";
 import ZStream from "../vendor/pako/lib/zlib/zstream.js";
 import Deflator from "../core/deflator.js";
diff --git a/tests/test.display.js b/tests/test.display.js
index e6c0406f9..d2c51793b 100644
--- a/tests/test.display.js
+++ b/tests/test.display.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Base64 from '../core/base64.js';
 import Display from '../core/display.js';
 
diff --git a/tests/test.gesturehandler.js b/tests/test.gesturehandler.js
index 73356be36..d2e27ed2a 100644
--- a/tests/test.gesturehandler.js
+++ b/tests/test.gesturehandler.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import EventTargetMixin from '../core/util/eventtarget.js';
 
 import GestureHandler from '../core/input/gesturehandler.js';
diff --git a/tests/test.helper.js b/tests/test.helper.js
index 9995973fd..2c8720c77 100644
--- a/tests/test.helper.js
+++ b/tests/test.helper.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import keysyms from '../core/input/keysymdef.js';
 import * as KeyboardUtil from "../core/input/util.js";
 
diff --git a/tests/test.hextile.js b/tests/test.hextile.js
index cbe6f7b5a..f788fd4dc 100644
--- a/tests/test.hextile.js
+++ b/tests/test.hextile.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import Display from '../core/display.js';
 
diff --git a/tests/test.inflator.js b/tests/test.inflator.js
index 304e7a0fd..11a02f2f4 100644
--- a/tests/test.inflator.js
+++ b/tests/test.inflator.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import { deflateInit, deflate, Z_FULL_FLUSH } from "../vendor/pako/lib/zlib/deflate.js";
 import ZStream from "../vendor/pako/lib/zlib/zstream.js";
 import Inflator from "../core/inflator.js";
diff --git a/tests/test.int.js b/tests/test.int.js
index 084d68abd..378ebd589 100644
--- a/tests/test.int.js
+++ b/tests/test.int.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import { toUnsigned32bit, toSigned32bit } from '../core/util/int.js';
 
 describe('Integer casting', function () {
diff --git a/tests/test.jpeg.js b/tests/test.jpeg.js
index 8dee48912..5cc153f90 100644
--- a/tests/test.jpeg.js
+++ b/tests/test.jpeg.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import Display from '../core/display.js';
 
diff --git a/tests/test.keyboard.js b/tests/test.keyboard.js
index efc84c306..11c8b6eb7 100644
--- a/tests/test.keyboard.js
+++ b/tests/test.keyboard.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Keyboard from '../core/input/keyboard.js';
 
 describe('Key Event Handling', function () {
@@ -480,6 +478,22 @@ describe('Key Event Handling', function () {
             expect(kbd.onkeyevent).to.not.have.been.called;
         });
 
+        it('should release ControlLeft on blur', function () {
+            const kbd = new Keyboard(document);
+            kbd.onkeyevent = sinon.spy();
+            kbd._handleKeyDown(keyevent('keydown', {code: 'ControlLeft', key: 'Control', location: 1}));
+            expect(kbd.onkeyevent).to.not.have.been.called;
+            kbd._allKeysUp();
+            expect(kbd.onkeyevent).to.have.been.calledTwice;
+            expect(kbd.onkeyevent.firstCall).to.have.been.calledWith(0xffe3, "ControlLeft", true);
+            expect(kbd.onkeyevent.secondCall).to.have.been.calledWith(0xffe3, "ControlLeft", false);
+
+            // Check that the timer is properly dead
+            kbd.onkeyevent.resetHistory();
+            this.clock.tick(100);
+            expect(kbd.onkeyevent).to.not.have.been.called;
+        });
+
         it('should generate AltGraph for quick Ctrl+Alt sequence', function () {
             const kbd = new Keyboard(document);
             kbd.onkeyevent = sinon.spy();
diff --git a/tests/test.localization.js b/tests/test.localization.js
index 916ff8462..a1cb45474 100644
--- a/tests/test.localization.js
+++ b/tests/test.localization.js
@@ -1,4 +1,3 @@
-const expect = chai.expect;
 import _, { Localizer, l10n } from '../app/localization.js';
 
 describe('Localization', function () {
diff --git a/tests/test.raw.js b/tests/test.raw.js
index 4a634ccd0..19b2377f7 100644
--- a/tests/test.raw.js
+++ b/tests/test.raw.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import Display from '../core/display.js';
 
diff --git a/tests/test.rfb.js b/tests/test.rfb.js
index 62b80ca3f..2be3bfbfc 100644
--- a/tests/test.rfb.js
+++ b/tests/test.rfb.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import RFB from '../core/rfb.js';
 import Websock from '../core/websock.js';
 import ZStream from "../vendor/pako/lib/zlib/zstream.js";
diff --git a/tests/test.rre.js b/tests/test.rre.js
index c55d7f397..7b5f73d0e 100644
--- a/tests/test.rre.js
+++ b/tests/test.rre.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import Display from '../core/display.js';
 
diff --git a/tests/test.tight.js b/tests/test.tight.js
index 141d7b6e2..3d6b555da 100644
--- a/tests/test.tight.js
+++ b/tests/test.tight.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import Display from '../core/display.js';
 
diff --git a/tests/test.tightpng.js b/tests/test.tightpng.js
index 02c66d93b..e7edc8fa6 100644
--- a/tests/test.tightpng.js
+++ b/tests/test.tightpng.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import Display from '../core/display.js';
 
diff --git a/tests/test.util.js b/tests/test.util.js
index cd61f248a..eb7240951 100644
--- a/tests/test.util.js
+++ b/tests/test.util.js
@@ -1,6 +1,4 @@
 /* eslint-disable no-console */
-const expect = chai.expect;
-
 import * as Log from '../core/util/logging.js';
 import { encodeUTF8, decodeUTF8 } from '../core/util/strings.js';
 
diff --git a/tests/test.websock.js b/tests/test.websock.js
index dc361b749..53145b360 100644
--- a/tests/test.websock.js
+++ b/tests/test.websock.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import FakeWebSocket from './fake.websocket.js';
 
diff --git a/tests/test.webutil.js b/tests/test.webutil.js
index df8227aef..9151a0603 100644
--- a/tests/test.webutil.js
+++ b/tests/test.webutil.js
@@ -1,7 +1,5 @@
 /* jshint expr: true */
 
-const expect = chai.expect;
-
 import * as WebUtil from '../app/webutil.js';
 
 describe('WebUtil', function () {
@@ -182,16 +180,15 @@ describe('WebUtil', function () {
                 window.chrome = chrome;
             });
 
-            const csSandbox = sinon.createSandbox();
-
             beforeEach(function () {
                 settings = {};
-                csSandbox.spy(window.chrome.storage.sync, 'set');
-                csSandbox.spy(window.chrome.storage.sync, 'remove');
+                sinon.spy(window.chrome.storage.sync, 'set');
+                sinon.spy(window.chrome.storage.sync, 'remove');
                 return WebUtil.initSettings();
             });
             afterEach(function () {
-                csSandbox.restore();
+                window.chrome.storage.sync.set.restore();
+                window.chrome.storage.sync.remove.restore();
             });
 
             describe('writeSetting', function () {
diff --git a/tests/test.zrle.js b/tests/test.zrle.js
index be0464093..f7c6089d5 100644
--- a/tests/test.zrle.js
+++ b/tests/test.zrle.js
@@ -1,5 +1,3 @@
-const expect = chai.expect;
-
 import Websock from '../core/websock.js';
 import Display from '../core/display.js';