Bromite - Take back your browser

Bromite is a Chromium fork with support for ad blocking and enhanced privacy.

Bromite is only available for Android Marshmallow (v6.0, API level 23) and above.

For the Frequently Asked Questions see F.A.Q..

For documentation see the wiki.

Goals

Bromite aims at providing a no-clutter browsing experience without privacy-invasive features and with the addition of a fast ad-blocking engine. Minimal UI changes are applied to help curbing the idea of "browser as an advertisement platform".

Donate

Please donate to support development of Bromite and the costs for the build system.

→ Support development with a donation:

BTC donations address: bc1qlx7h0lj9z88g2xfeuwsrtfs77sxuhrxf2t28sw

ETH donations address: 0x5d392F8FBf3465afe05B1Adc575e248D33B891F6

Features

customizable adblock filters via user-provided URL (see https://www.bromite.org/custom-filters)
automatically updated adblock filters
remove click-tracking and AMP from search results
DNS-over-HTTPS support with any valid IETF DoH endpoint
always-incognito mode
disable all field trials permanently
disable smart search by default, allow web search from incognito mode
always-visible cookies, javascript and ads site settings
remove Play integration binary blobs
use CFI on all architectures except x86
enable trivial auto var init
disable media router and remoting by default
disable dynamic module loading
show warnings for TLSv1.0/TLSv1.1 pages
enable site-per-process isolation for all devices with memory > 1GB
completely remove safe browsing and other privacy-unfriendly features
proxy configuration page with PAC and custom proxy lists support
settings to disable custom intents and clear session on exit
flags to toggle anti-fingerprinting mitigations for canvas, audio, client rects, webGL and sensor APIs (see full list below for all the new flags)
use frozen User-Agent to conceal real model and browser version
privacy enhancement patches from Iridium, Inox patchset, Brave and ungoogled-chromium projects
security enhancement patches from GrapheneOS project
disable scroll-to-text-fragment
reduced referer granularity
block gateway attacks via websockets
use 64-bit ABI for webview processes
make all favicon requests on-demand (supercookie mitigation)
enable all network isolation features (PartitionConnectionsByNetworkIsolationKey, PartitionHttpServerPropertiesByNetworkIsolationKey, SplitHostCacheByNetworkIsolationKey, AppendFrameOriginToNetworkIsolationKey, SplitCacheByNetworkIsolationKey, UseRegistrableDomainInNetworkIsolationKey, PartitionSSLSessionsByNetworkIsolationKey, PartitionExpectCTStateByNetworkIsolationKey, PartitionDomainReliabilityByNetworkIsolationKey)
ignore enterprise policies that disallow secure DNS
ask permission to play protected media
disable the DIAL repeating discovery
disable RTCGetCurrentBrowsingContextMedia by default
disable FLoC and privacy sandbox by default
disable feeds
disable reporting of certificate errors
use pre-defined phone model for client hints and Javascript
site settings to disable images
allow forcing external links to open in incognito
disable AGSA by default
allow disabling JIT (globally and per-site)
flag to enable Certificate Transparency
allow adding search engines from incognito mode
disable predictors
disable supervised users
disable safety check
disable capability to block view-source: URLs
disable SegmentationPlatformFeature, OptimizationHints, client hint headers

Features not related to privacy

browser automatic updates, enabled by default
native Android autofill support
import/export bookmarks
bookmark all tabs from tabs regroup menu
allow playing videos in background tabs and disable pause on switching tabs
all codecs included (proprietary, open H.264 etc.)
AV1 codec support
dav1d decoder enabled by default
built with official speed optimizations
increase number of autocomplete matches from 5 to 10
allow changing default download storage location
do not ignore save prompt for users without SD cards
disable articles and increase number of icons on new tab page
adding an URL as bookmark will clear its blocked status for the NTP tiles
history support in incognito mode
view source of pages
timezone customization
sticky desktop mode setting
disable video autoplay by default, reintroduce site settings
mobile/desktop user agent customization
accessibility preference to force tablet UI
use Alt+D to focus address bar
allow sharing to Bromite
UI for crash information collection

You can inspect all functionality/privacy changes by reading the patches and/or the CHANGELOG.

Flags

Flags which have been retired from upstream Chromium but are still available in Bromite.

#pull-to-refresh
#enable-search-ready-omnibox
#darken-websites-checkbox-in-themes-setting
#simplified-ntp, enabled by default
#enable-text-fragment-anchor, disabled by default
#num-raster-threads
#enable-image-reader, enabled by default
#enable-tab-groups and #enable-tab-groups-ui-improvements
#offline-indicator-v2

New flags:

#fingerprinting-canvas-image-data-noise, #fingerprinting-client-rects-noise and #fingerprinting-canvas-measuretext-noise, enabled by default
#enable-incognito-snapshots-in-android-recents, disabled by default
#max-connections-per-host
#resume-background-video
#ipv6-probing
#disable-webgl
#enable-device-motion and #enable-device-orientation
#show-legacy-tls-warnings
#save-data-header, disabled by default
#export-bookmarks-use-saf, disabled by default
#allow-user-certificates, disabled by default
#cleartext-permitted, enabled by default, can be used to disable all cleartext-HTTP traffic
#omnibox-autocomplete-filtering, can be used to restrict omnibox autocomplete results
#disable-external-intent-requests

Privacy limitations

Bromite's privacy features, including anti-fingerprinting mitigations (which are not comprehensive), are not to be considered useful for journalists and people living in countries with freedom limitations, please look at Tor Browser in such cases.

Releases

All built versions are available as releases; the official website points to those releases and - when browsing via Android - it will automatically highlight the one apt for your device (or none otherwise).

Each tag corresponds to a Chromium Stable release tag.

Bromite is currently built for ARM, ARM64 and x86 and for the Android SDK version 23+; Bromite SystemWebView is provided as well (SDK23+). For every Bromite build you can always find a matching vanilla Chromium build which is used for example to verify which issues are specific to Bromite or not.

You will automatically receive notifications about new updates (and be able to install them) via the auto updater functionality (enabled by default), see related wiki page.

All official releases are also available through the official third-party F-Droid repository.

Integrity and authenticity

You can verify the integrity of a downloaded APK file from this project with any sha256sum-compatible tool by downloading the corresponding brm_X.Y.Z.sha256.txt or chr_X.Y.Z.sha256.txt file, where X.Y.Z is the release version number. Example:

$ sha256sum --check brm_68.0.3440.54.sha256.txt
arm64_SystemWebView.apk: OK
arm64_ChromePublic.apk: OK
arm64_ChromeModernPublic.apk: OK

You can verify authenticity, e.g. that the author (csagan5) released the file, by using gpg2:

$ gpg2 --quiet --verify brm_68.0.3440.54.sha256.txt.asc
gpg: assuming signed data in 'brm_68.0.3440.54.sha256.txt'
gpg: Signature made Sun 08 Jul 2018 04:22:52 PM CEST using RSA key ID D85DC0C5
gpg: Good signature from "csagan5 <32685696+csagan5@users.noreply.github.com>"

You can download csagan5's public GnuPG key from here: csagan5.asc.

How to build

The Bromite main repository contains tags for each corresponding Chromium release (see https://chromium.googlesource.com/chromium/src.git).

Please refer to official Chromium build documentation to get started on how to build Chromium; if you can build Chromium for Android, you can build Bromite.

The Chromium version tag used as base for the patches is available here: RELEASE; this is always corresponding to the git tag for every release. The GN args used to build Bromite are available here: bromite.gn_args. The patches are to be applied second the order specified in the bromite_patches_list.txt file (you can use git am).

How to build the filters

See upstream documentation: https://github.com/chromium/chromium/blob/master/components/subresource_filter/FILTER_LIST_GENERATION.md

Bromite uses an unindexed filter file, which is periodically published at https://github.com/bromite/filters

Contributing

Please submit issues following the issue template; beware that GitHub does not display the templates from mobile.

Patches are welcome and accepted if they match the project goals.

For any usage or development discussion please use GitHub Discussions: https://github.com/bromite/bromite/discussions

Credits

Chromium project and developers
Iridium project for some patches
ungoogled-chromium for some patches
ungoogled-chromium-android for some patches
GrapheneOS for some security patches
Inox patchset for some patches (via ungoogled-chromium)
Brave Browser for some patches
Vadim Pleshkov for Bromite's logo

Filters credits

The URLs of the lists used are available at: https://github.com/bromite/filters/blob/master/lists.txt

License

The patches published as part of the Bromite project are released under GNU GPL v3.

InterstellarPotato20/bromite