When you write code to parse, evaluate, or otherwise handle untrustworthy inputs from the Internet — which is almost everything we do in a web browser! — we like to follow a simple rule to make sure it's safe enough to do so. The Rule Of 2 is: Pick no more than 2 of
RKNF404/chromium-hardening-guide
Harden chromium (somewhat) for privacy and security (and performance)
b4a1ffc010a8aee9b98d4fdcf3d396b592cffa46 - chromium/src - Git at Google
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
secureblue/Trivalent
A security-focused, Chromium-based browser for desktop Linux inspired by Vanadium.
Announcing Supporters of Chromium-based Browsers
Since Google announced the Chromium project in 2008, we have been excited to build on the great foundations of open-source web browsers and contribute to the continued d…
More progress on Webium development (Google's rewritten Chromium interface in webui)
24 votes, 13 comments. 140K subscribers in the browsers community. Topics on web browsers.
Forget the Fate of Chrome, Focus on the Fate of the Browser
In debating what undoubtedly won't happen, we're looking past some key things that are -- and might...
2025 Chromium Embedding: Experiences and challenges
Web Engines Hackfest. Contribute to Igalia/webengineshackfest development by creating an account on GitHub.
The unreasonable effectiveness of HTML — examples
When you're not sure what you want yet. Ask the agent to fan out across several directions and lay them next to each other so you can point at one — instead of reading three sequential walls of text and trying to hold them all in your head. And once you've picked, turn the pick into a plan the implementer can actually read.
New Custom Handlers component for Chrome – make everything intensely
The HTML Standard section on Custom Handlers describes the procedure to register custom protocol handlers for URLs with specific schemes. When a URL is followed, the protocol dictates which part of the system handles it by consulting registries. In some cases, handlers may fall to the OS level and and launch a desktop application (eg. mailto:// may launch a native application) or, the browser may redirect the request to a different HTTP(S) URL (eg. mailto:// can go to gmail).
Decoupling Extensions from Chrome: The Journey to a Modular Extensions Layer · Issue #74 · Igalia/webengineshackfest
Facilitator(s) @MyidShin @ltilve Summary This talk presents the ongoing effort to decouple Chromium Extensions from the Chrome layer, enabling a more modular and embeddable architecture. We’ll cove...
How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865
In March, our system detected a severe vulnerability in V8, the JavaScript engine used by Chrome. This vulnerability enabled remote code execution against billions of Chrome users worldwide.
Web Tiles
Trust has been the defining constraint on the Web's evolution towards more powerful, more applicative capabilities. In a Web context, the user must be able to safely load any arbitrary URL, to safely click on any arbitrary link. The way in which this is achieved is that the runtime places strict limits on what a Web page can do, which in turn necessarily limits powerful capabilities. Could we get more power using a primitive that places more stringent constraints in what pages can do?
Web Tiles
Trust has been the defining constraint on the Web's evolution towards more powerful, more applicative capabilities. In a Web context, the user must be able to safely load any arbitrary URL, to safely click on any arbitrary link. The way in which this is achieved is that the runtime places strict limits on what a Web page can do, which in turn necessarily limits powerful capabilities. Could we get more power using a primitive that places more stringent constraints in what pages can do?
Stronger with every update: How we’re making Chrome and the web safer in the AI Era
Chrome uses Gemini AI to automate vulnerability discovery, triage, and patching, accelerating updates to match modern security risks.
ChromeAlone - A Browser Based Cobalt Strike Like C2 Tool That Turns Chrome Into a Hacker’s Playground
ChromeAlone — a Chromium-based browser Command & Control (C2) framework capable of replacing traditional offensive security implants like Cobalt Strike.
Position Paper for the W3C Workshop on Web Applications and Compound Documents
This document represents the consensus opinion of the Mozilla Foundation and Opera Software in the context of standards for Web Applications and Compound Documents.