Yandex Browser: Modifying Chromium for Security and UI

This article explores the architectural modifications Yandex makes to the open-source Chromium project to build the Yandex Browser. Specifically, it examines how the developers strip out default Google integrations at the browser process level and inject proprietary C++ modules. These modifications allow Yandex to deeply integrate its "Protect" security system into the network stack and overhaul the standard Chromium windowing framework to deliver a customized user interface, all while retaining the core Blink rendering engine and V8 JavaScript engine.

Stripping the Base Chromium Architecture

Chromium uses a multi-process architecture divided primarily into the Browser Process (which controls the UI, network, and storage) and Renderer Processes (which run the Blink engine to display web pages).

To create its browser, Yandex leaves the Renderer Processes largely intact to ensure website compatibility and speed. The heavy modifications occur within the Browser Process. Yandex removes Google-specific APIs, such as Google Safe Browsing, Chrome Sync, and Google Updater, replacing them with custom hooks that communicate directly with Yandex’s cloud infrastructure and local proprietary modules.

Integrating the "Protect" Security System

Yandex Browser features an umbrella security suite known as "Protect." Rather than adding this as a simple browser extension, Yandex integrates it directly into Chromium's core C++ codebase, primarily targeting the network stack and I/O (Input/Output) threads.

  • Network Stack Interception: Chromium handles network requests through a dedicated Network Service. Yandex modifies this service to include a DNSCrypt client, which encrypts DNS traffic between the browser and Yandex servers to prevent DNS spoofing. It also injects a Wi-Fi security module into the network layer that automatically detects unencrypted public networks and forces HTTPS connections.
  • Process Isolation for Banking: When a user visits a financial website, Yandex modifies Chromium's standard site-isolation logic. It spawns a heavily restricted, sandboxed Renderer Process known as "Safe Mode." This locks down the clipboard, blocks third-party extensions from injecting scripts into the page, and prevents other system processes from reading the browser's memory.
  • Download Pipeline Hooks: Chromium's download manager processes files asynchronously. Yandex alters this pipeline by adding a security check before a downloaded file is finalized on the hard drive. The browser intercepts the file stream, sends file metadata and hashes to Yandex's cloud servers (and partner Kaspersky Lab's databases), and blocks execution if malicious signatures are detected.
  • DOM-Level Phishing Analysis: While standard Chromium relies mostly on URL blacklists to block phishing, Yandex modifies the Blink rendering interaction to analyze the Document Object Model (DOM) in real time. If a page mimics the structure of a known banking site or asks for passwords on an untrusted domain, the browser process halts rendering and displays a warning UI.

Overhauling the User Interface

Chromium builds its user interface using a native UI framework called "Views" and a hardware-accelerated window manager known as "Aura." Yandex heavily modifies the Views layer to move away from Chrome's minimalist design and create a distinct visual environment.

  • Replacing the Omnibox with SmartBox: In Chromium, the address bar (Omnibox) is tightly coupled with the local history database and search provider APIs. Yandex replaces the Omnibox UI component with "SmartBox." Architecturally, SmartBox alters the autocomplete controller to parse data from Yandex's search APIs, allowing the UI to render complex, formatted answers (like weather, currency rates, and encyclopedic snippets) directly inside the drop-down view before the user hits enter.
  • Customizing the Aura Window Shell: Yandex changes the standard Chromium window frame to allow flexible UI placement. For example, the address bar can be dynamically moved to the bottom of the screen, and tabs can be displayed below the content area. This requires rewriting the layout managers within the Chromium Views framework.
  • WebView Injection for the Sidebar: The browser features a persistent sidebar that gives quick access to messengers, music, and notes. Yandex implements this by embedding separate, lightweight WebView containers directly into the main browser frame. These containers run in their own isolated processes, allowing users to interact with mobile-style web apps without disrupting the main tab's rendering process.
  • Hardware-Accelerated Overlays: For its New Tab Page (called "Tableau"), Yandex bypasses the standard HTML-based page used by Chromium. Instead, it taps into the GPU process to render high-definition animated video backgrounds and translucent UI tiles, ensuring that the interface remains responsive without taxing the main CPU thread.