When you run the web launcher from Downloads, macOS runs it from a read-only mount.
show vpn-sessiondb anyconnect
show webvpn anyconnect
debug webvpn anyconnect 255 (Look for "downloader failed" messages)
Modern Windows Defender Application Control (WDAC) or AppLocker may block any .exe running from %AppData% or %Temp%. failed to launch downloader cisco anyconnect 4.10
Kill processes that may hold file locks on the downloader: When you run the web launcher from Downloads,
Windows:
taskkill /f /im vpnui.exe
taskkill /f /im vpnagent.exe
taskkill /f /im vpndownloader.exe
macOS:
sudo killall vpnagentd
sudo killall vpnui