uazo/cromiteFork
Cromite
Cromite is a privacy-focused browser built as a fork of Chromium that embeds a network-level content blocking engine to intercept advertisements, pop-ups, and tracking scripts before they reach the page. It applies community-maintained public filter lists directly within the browser, eliminating the need for external extensions, and uses a curated patch system applied to the Chromium source tree at build time to add or modify features without maintaining a separate codebase.
The browser is hardened against tracking and data leakage through a comprehensive set of privacy and security measures. It blocks browser fingerprinting by disabling or spoofing dozens of APIs including Canvas, WebGL, WebRTC, and the GamePad API, and prevents Google data collection by disabling all communication with Google servers for metrics, sync, translation, autofill, and updates. Additional protections include enforcing HTTPS connections, blocking third-party cookies, stripping URL tracking parameters, partitioning network state by site, and preventing WebRTC IP leakage. Users can enforce strict site isolation, disable JavaScript JIT compilation, and control certificate acceptance, while per-site permission overrides allow granular management of autoplay, cookies, JavaScript, and other features.
Cromite offers extensive configuration and customization options, exposing Chromium's internal feature flags through the UI so users can toggle individual browser capabilities without recompiling. It supports user script execution on Android, native Android autofill, bookmark import and export, and interface customization including toolbar position and tab management. The browser can be set to permanent incognito mode, clearing all session data on restart, and includes a privacy-first default configuration that disables telemetry, network predictions, and other privacy-invasive features at first launch.
The project provides a Docker-based build pipeline for Android, Linux, and Windows targets, with automated testing and automatic updates on Android. It is available for installation via an official F-Droid repository.
Features
- Patch-Based Forks - Applies a curated set of patches to the Chromium source tree at build time to add or modify features without maintaining a separate codebase.
- Browser Privacy Defaults - Sets a hardened set of Chromium preferences and command-line switches at first launch to disable telemetry, tracking, and network predictions by default.
- Process-Level Isolations - Forces every website into its own operating system process for security.
- Browser - Isolates cookies, caches, and other browsing data per top-level domain to prevent cross-site tracking, similar to Total Cookie Protection.
- Search Suggestions - Blocks the browser from sending typed input to search engines for autocomplete suggestions.
- Google Data Collection Blocking - Disables all communication with Google servers for metrics, sync, translation, autofill, updates, and other services to prevent data leakage.
- Google Service Integration Blocking - Disables integration with Google Play Services, Google Sign-In, Google Feeds, and other Google-specific features on Android and desktop.
- Browser Update Suppression - Prevents the browser from checking for updates or downloading components from remote servers unless the user explicitly activates the feature.
- Google Integration Blocking - Disables all built-in connections to Google services, including sync, translate, sign-in, and autofill.
- Tracking Parameter Removers - Removes known tracking query parameters from URLs before navigation.
- Site Permission Overrides - Controls per-site access to location, camera, and notifications with granular grant or deny options.
- Community Filter Lists - Blocks advertisements by applying community-maintained public filter lists that users configure in settings.
- Fingerprint Mitigation Tools - Disables dozens of browser APIs to block fingerprinting, a core privacy feature.
- Spoofing Tools - Provides built-in browser fingerprint spoofing to prevent device tracking.
- Fingerprint Mitigation Tools - Disables or mitigates dozens of browser APIs and features that can uniquely identify a user across sites.
- Exploit Mitigations - Implements strict site isolation, certificate transparency, DNS-over-HTTPS, and JIT disabling to harden the browser against exploits.
- Third-Party Tracking Restrictions - Blocks cookies set by domains other than the one the user is visiting to prevent cross-site tracking.
- Fingerprinting Defenses - Blocks the GamePad API to prevent a fingerprinting vector, enhancing user privacy.
- Browser Incognito Sessions - Provides a temporary in-memory browsing session that deletes history and cookies when the last incognito window is closed.
- Diskless Incognito Sessions - Ensures incognito browsing stores no history or cookies on disk, deleting them when the last incognito window closes.
- Forced Incognito Sessions - Forces all browsing sessions into incognito mode by overriding Chromium's tab creation logic and clearing session data on restart.
- Persistent Incognito Sessions - Forces all tabs and links to open in incognito mode by default, preventing browsing history and cookies from being saved.
- Security Policy Enforcers - Enables strict site isolation, certificate transparency, secure DNS, and disables JIT compilation.
- Security & HTTPS - Upgrades all HTTP requests to HTTPS automatically, encrypting traffic and protecting against man-in-the-middle attacks.
- HTTPS Enforcements - Blocks all non-HTTPS connections to ensure encrypted communication with every website.
- Site Permission Overrides - Provides per-site controls for autoplay, cookies, JavaScript, images, and ad blocking.
- Privacy and Ad Blocking - Blocks advertisements and all pop-up windows using a built-in adblock engine.
- Network-Level Content Blocking Engines - Embeds a network-level content blocking engine that applies community filter lists to intercept and block requests before they reach the renderer.
- Telemetry Blocking - Blocks the browser from sending usage metrics, crash reports, and other data to remote servers.
- Google Telemetry and Service Blocking - Disables all communication with Google servers for data collection, sync, translation, updates, and other integrated services.
- Browser Privacy Configurations - Disables or restricts browser features that can be used to track user behavior and habits across websites.
- Privacy Hardening Tools - Disables telemetry, preconnections, background services, and other features that send data or profile user behavior without explicit consent.
- Privacy Settings Interfaces - Provides a central place to toggle privacy features like fingerprinting protection, cookie controls, and WebRTC leak prevention.
- WebRTC IP Leak Protections - Prevents WebRTC from exposing the device's local and public IP addresses to websites.
- Omnibox Data Protections - Prevents the browser from sending credentials, file names, or encrypted URLs to search engines.
- JavaScript JIT Disablers - Disables Just-In-Time compilation by default to reduce the attack surface, with per-site re-enablement available.
- WebRTC IP Leak Protections - Prevents WebRTC from exposing the local IP address even when behind a VPN.
- Geolocation Leakage Prevention - Prevents the browser from sending location data to the default search engine or any website without explicit user consent.
- Feature Flag Toggles - Offers user-configurable flags and options to enable or disable experimental browser features and modify default behaviors.
- Session Data Clearing - Deletes all browsing history, cookies, and open tabs when the browser is closed.
- Feature Enablement Controls - Lets users choose which browser features to enable or disable, giving them control over functionality and privacy.
- Tracking Feature Limiters - Provides built-in controls to disable or restrict browser features that can track user behavior.
- Payments - Requires the user to enable the PaymentRequest API before it can be used for credit card purchases.
- Automatic Software Updates - Receives and installs new browser versions automatically on Android, with a prompt during first startup to enable the feature.
- API Blocking Mechanisms - Blocks the PaymentRequest API by default so no payment information is shared with merchants unless the user explicitly enables it.
- Web Bluetooth Permission Controls - Requires explicit user permission before websites can communicate with Bluetooth Low Energy devices.
- Android Application Update Systems - Checks for and installs new browser versions automatically on Android, notifying the user and requesting activation on first startup.
- Web-to-App Launch Restrictions - Prevents websites from opening external apps to avoid leaking browsing data, with an option to allow it.
- Browser Session Restorations - Restores the list of tabs from the last browsing session on startup and clears all browsing data when the browser closes.
- Prefetching Disablers - Prevents the browser from performing DNS prefetching, TCP/TLS preconnections, and page prefetching to avoid leaking browsing patterns.
- Local-Only Autofill Stores - Stores autofill and password data only on the device without sending any information to external services.
- Extension Update Restrictions - Prevents automatic extension updates that would send the list of installed extensions to Google servers.
- WebSocket Attack Blockers - Blocks gateway attacks via WebSockets and provides an internal firewall to block unauthorized calls to external servers.
- Certificate Acceptance Controls - Controls whether user-installed certificates are trusted for HTTPS connections, enhancing security against unauthorized interception.
- Cleartext Traffic Controls - Controls whether apps are allowed to send unencrypted HTTP traffic, enforcing a stricter security policy for network requests.
- User Interface Customizations - Provides extensive UI customization including toolbar position, tab management, and bookmark controls.
- Browser Interface Customizations - Provides extensive interface customization options including toolbar position and tab management.
- Geolocation Consent Requirements - Requires explicit user consent before any website can access the device's location information.
- Android User Scripts - Executes custom user scripts on Android to modify page behavior.
- Web Browsers - Privacy-focused browser based on Chromium with ad blocking.
- Media & Communication - Privacy-enhanced browser based on Chromium.
