Project Fugu: Bridging the Gap Between Web and Native Apps

This article explores Project Fugu, a cross-company initiative aimed at giving web applications the same capabilities as native desktop and mobile software. We will cover the origins of the project, the specific technological hurdles it overcomes, the key Web APIs it has introduced to the Chromium browser engine, and how it maintains user security while granting websites deep access to device hardware and operating systems.

What is Project Fugu?

Project Fugu—officially known as the Web Capabilities Project—is a collaborative effort led by Google, Microsoft, Intel, and Samsung. Launched to improve the Chromium open-source browser engine (which powers Google Chrome, Microsoft Edge, Brave, and Opera), its primary goal is to make it possible for developers to build web apps that can do anything a native iOS, Android, Windows, or macOS app can do.

The project is named after the fugu (pufferfish), a Japanese delicacy that is delicious when prepared correctly by a master chef, but lethal if prepared incorrectly. This serves as a metaphor for the project's mission: exposing powerful, low-level device capabilities to the web is immensely beneficial when done right, but poses severe security and privacy risks if implemented poorly.

The Historical Limitation of Web Apps

Traditionally, web applications run inside a "sandbox." This security mechanism isolates the website from the rest of the user's computer or phone. While the sandbox keeps users safe from malicious websites, it also prevents legitimate web apps from performing basic tasks that native apps take for granted.

Before Project Fugu, a web app could not easily modify a file on your hard drive, communicate with a USB device, access the system clipboard seamlessly, or interact with Bluetooth hardware. To bypass these limitations, developers had to either build separate native apps for every operating system or wrap their web apps in heavy frameworks like Electron, which consumes significant system memory.

How Project Fugu Bridges the Gap

Project Fugu bridges the divide between the web and native software by designing, testing, and shipping new Web APIs (Application Programming Interfaces) directly into the Chromium browser. These APIs act as secure bridges out of the browser sandbox, allowing websites to interact directly with the underlying operating system and hardware.

Key capabilities introduced by Project Fugu include:

  • File System Access API: Allows web apps to read and save changes directly to files and folders on the user's device. Instead of downloading a new copy of a document every time you make an edit in the browser, web apps like Adobe Photoshop on the web can now open, edit, and overwrite local files just like a desktop app.
  • WebUSB, WebHID, and WebBluetooth: These APIs allow browsers to communicate directly with external hardware. Users can now configure gaming mice, update firmware on microcontrollers, or connect to medical devices and barcode scanners directly through a webpage without installing specialized drivers.
  • App Badging and Web Share APIs: These features allow Progressive Web Apps (PWAs) to integrate into the operating system. Web apps can now display notification badges on their home screen icons and use the device's native sharing menu to send content to other apps.
  • Multi-Screen Window Placement API: Enables web applications to detect multiple displays connected to a computer and place specific windows on specific screens, a crucial feature for financial trading platforms and presentation software.
  • Web NFC: Allows web applications on mobile devices to read and write to Near-Field Communication (NFC) tags, useful for inventory management, museum tours, and contactless interactions.

Empowering Progressive Web Apps (PWAs)

The ultimate vehicle for Project Fugu’s features is the Progressive Web App. PWAs are websites that can be installed on a device's home screen or desktop, run in their own window without a browser address bar, and work offline.

By combining the installability of PWAs with the hardware access of Project Fugu, the line between a website and native software disappears. Developers can write a single codebase using standard web technologies (HTML, CSS, and JavaScript) and deploy it across all platforms that support a Chromium-based browser, drastically reducing development costs and time.

Balancing Power with Security

To avoid the "poison" of the fugu fish, the project enforces strict security protocols before granting any web app access to native capabilities.

  1. HTTPS Requirement: Fugu APIs only function on secure, encrypted connections (HTTPS).
  2. User Gesture: Many APIs cannot be triggered automatically when a page loads; they require an explicit user action, such as clicking a button, to initiate.
  3. Explicit Permission Prompts: The browser acts as a gatekeeper. If a web app wants to access a local folder or a USB device, the browser displays a clear permission pop-up. The user must manually select the specific file or device they want the website to access.
  4. Restricted System Files: Even with user permission, the browser blocks web apps from accessing critical operating system directories to prevent accidental damage or malware installation.