Cromite Browser: Key Privacy Patches for Chromium

This article provides a comprehensive overview of the privacy-focused patches that the Cromite project applies to the Chromium web browser for both Android and desktop platforms. Serving as the successor to the discontinued Bromite project, Cromite modifies the open-source Chromium codebase to strip away Google telemetry, block advertisements natively, prevent browser fingerprinting, and disable privacy-invasive web APIs, resulting in a hardened and secure browsing experience.

Telemetry Removal and De-Googling

Standard Chromium makes numerous background connections to Google servers the moment the browser is launched. Cromite applies extensive patches to sever these ties on both Android and desktop versions.

  • Metrics and Crash Reporting: All code responsible for gathering usage statistics and sending crash reports to Google is completely disabled.
  • Field Trials: Chromium uses "Field Trials" (Finch) to remotely enable or disable features on a user's browser for A/B testing. Cromite disables this system entirely, ensuring the browser's configuration cannot be remotely altered by Google.
  • Safe Browsing Disabled: While Google Safe Browsing protects against phishing, it also requires communication with Google servers. Cromite disables this feature to prevent data leakage.
  • Removal of Google Integrations: Features that rely heavily on Google infrastructure, such as Google Lens, Google Translate prompts, and Chrome Sync, are either stripped out or deactivated by default.

Anti-Fingerprinting Mitigations

Browser fingerprinting allows trackers to identify users based on unique hardware and software configurations, even when cookies are cleared. Cromite incorporates patches from the Bromite and Brave projects to standardize or randomize the data websites can read.

  • Canvas and WebGL Spoofing: Cromite adds subtle, imperceptible noise to HTML5 Canvas and WebGL readouts. Because the noise changes per session, trackers cannot generate a consistent graphic hardware fingerprint.
  • AudioContext Randomization: Similar to Canvas spoofing, Cromite introduces tiny variations into the Web Audio API signals to prevent audio-based device tracking.
  • User-Agent Freezing: The browser alters the User-Agent string to report a standardized operating system and device model, masking the specific phone model on Android and the exact OS build on desktop.
  • Client Hints Disabled: User-Agent Client Hints, a newer Google mechanism that exposes detailed system information to servers upon request, is turned off by default.
  • Font and Screen Mitigations: Cromite restricts the enumeration of locally installed fonts and modifies how screen dimensions are reported to websites to prevent viewport fingerprinting.

Native Ad and Tracker Blocking

Unlike standard Chromium, which does not allow extensions on Android and is restricting ad-blockers on desktop via Manifest V3, Cromite builds an ad-blocking engine directly into the browser's core C++ code.

  • Subresource Filter Engine: Cromite modifies Chromium’s native subresource filter to act as a full-featured content blocker.
  • Custom Filter Lists: Users on both desktop and Android can add custom filter URLs using standard Adblock Plus syntax (such as EasyList and EasyPrivacy) to block ads, trackers, and malware domains at the network level.

Removal of Privacy-Invasive APIs

Modern web standards include many APIs that give websites access to local hardware and user behavior data. Cromite patches the browser to disable or restrict these interfaces.

  • Google Privacy Sandbox: Cromite completely disables Google’s "Privacy Sandbox" initiatives, including the Topics API, Protected Audience API (formerly FLoC), and Attribution Reporting, which are designed to track user interests for advertising purposes.
  • Hardware Access APIs: WebUSB, WebBluetooth, WebNFC, and the Serial API are disabled by default to prevent websites from interacting with local hardware devices and using them as tracking vectors.
  • Idle Detection and Battery Status: Websites are blocked from using the Idle Detection API to see when a user is away from their device, and the Battery Status API is disabled to prevent trackers from using battery levels as a short-term identifier.
  • Sensor Restrictions: Access to device motion, orientation, and ambient light sensors—particularly relevant on Android—is heavily restricted.

Network and Session Hardening

Cromite alters the default network and storage behaviors of Chromium to ensure that browsing sessions remain isolated and metadata is not leaked.

  • State Partitioning: Cookies, local storage, and network caches are strictly partitioned by the top-level site. This prevents embedded third-party trackers from following a user across different websites.
  • WebRTC IP Leak Protection: WebRTC is patched to prevent it from exposing the user's local and public IP addresses when using a VPN or proxy.
  • Referrer Trimming: When navigating from one website to another, Cromite strips the Referer header down to the origin domain or removes it entirely, preventing sites from seeing the exact URL a user just visited.
  • No Speculative Connections: Network prediction, DNS prefetching, and page pre-rendering are disabled. The browser will only connect to a server when the user explicitly clicks a link.
  • Enhanced Incognito Options: Cromite adds an "Always Incognito" mode, forces links opened from external apps to launch in Incognito, and provides a toggle to automatically clear all browsing data, cookies, and tabs the moment the browser is closed.