# Cromite (Bromite fork)

**URL:** https://discuss.privacyguides.net/t/cromite-bromite-fork/13274
**Category:** Tool Suggestions
**Tags:** completed
**Created:** 2023-07-20T16:31:23Z
**Posts:** 82

## Post 1 by @qwq — 2023-07-20T16:31:24Z

One of the main contributors to Bromite has now officially forked it and created Cromite.

> **[GitHub - uazo/cromite: Cromite a Bromite fork with ad blocking and...](https://github.com/uazo/cromite)**
>
> Cromite a Bromite fork with ad blocking and privacy enhancements; take back your browser!

Uazo has been maintaining a Bromite dev/test build for a while now over at [GitHub - uazo/bromite-buildtools: my build machine for bromite development](https://github.com/uazo/bromite-buildtools). In the latest release there’s an announcement that new releases will be in the new Cromite repository linked above.

Note: there aren’t any binaries released in the Cromite “releases” page yet.

---

## Post 2 by @anon30510143 — 2023-07-20T16:43:35Z

We’ll probably want to wait and see how the project does for a while before considering it.

---

## Post 3 by @anon63378630 — 2023-07-20T17:10:53Z

still no 32-bit support and updates can take up to two weeks

---

## Post 4 by @not_a_homosapien — 2023-07-22T06:40:47Z

Cromite seems to be promising but It blocks automatic https upgrades and Content Security Policy reports; which harm security

---

## Post 5 by @jonah — 2023-07-26T02:35:29Z

I don’t see how blocking CSP reports harms security, and HTTPS-only mode is enabled by default. CSP reports can be used to fingerprint installed extensions:

> <https://github.com/LiCybora/NanoDefenderFirefox/issues/196>
>
> Many websites nowadays use a security technology called [Content Security Policy… (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) to limit what attackers can do in case of compromise on the site. When deployed with strict settings this prevents any use of `eval` or `<script>` tags to execute JavaScript code on-the-fly: All of the page's scripts (and also CSS, etc) must be served from a set of trusted origins specified in the policy instead. This rule also applies to any scripts injected by extensions using `window.eval` or `document.createElement("script")`.
> 
> The above would only render NanoDefender Pro ineffective on such sites, however CSP includes another feature that many sites use to monitor the issues caused by their CSP in the field called `report-uri`: Using this, a site can specify an arbitrary URL to be pinged whenever the browser detects a CSP violation. This again includes violations caused by extension scripts, like on the following example page (https://mm-csp-example.herokuapp.com/ was set up to test a related CSP issue with another extension):
> 
> ```json
> {
> "csp-report": {
> "blocked-uri": "inline",
> "column-number": 33,
> "document-uri": "https://mm-csp-example.herokuapp.com/",
> "line-number": 214,
> "original-policy": "default-src 'self'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; script-src 'self'; style-src 'self'; report-uri https://mm-csp-example.herokuapp.com/report_csp",
> "referrer": "",
> "source-file": "moz-extension://22f938b7-43d7-410d-91c6-80262d30dbd7/content/core.js",
> "violated-directive": "script-src"
> }
> }
> ```
> 
> This can even include “samples” of the blocked content like in the following real-world example of undisclosed origin:
> 
> ```json
> {
> "csp-report": {
> "blocked-uri": "inline",
> "column-number": 33,
> "document-uri": "…",
> "line-number": 214,
> "original-policy": "default-src 'none'; connect-src 'self' …; font-src 'self' … data:; img-src 'self' … data: …; script-src 'report-sample' 'self' 'unsafe-eval' …; object-src …; manifest-src …; media-src …; style-src 'self' 'unsafe-inline'; frame-src …; worker-src …; report-uri …/csp",
> "referrer": "…",
> "script-sample": "(() => {\n try {\n let _…",
> "source-file": "moz-extension://22f938b7-43d7-410d-91c6-80262d30dbd7/content/core.js",
> "violated-directive": "script-src"
> }
> }
> ```
> 
> If that isn't a textbook example of a perfect fingerprinting vector based on the list of installed non-CSP-compliant extensions then I don't know. Even without the “script sample”, the combination of “just” the script name and line and column numbers is likely enough to unique identify every CSP violating extension in existence. And as I've discovered today, yours is by far not the only extension causing these kinds of reports to be generated.
> 
> So how to fix this? Well, the [inject](https://github.com/LiCybora/NanoDefenderFirefox/blob/2006d69afdefbbb2dcd1b2dca31bb2a516efc4d1/src/content/core.js#L209-L224) function and everything calling it will have to be rewritten in terms of the recommendations of the MDN article on [Sharing objects with page scripts](https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/Sharing_objects_with_page_scripts). In particular this means: Accessing page objects only through the `.wrappedJSObject` accessor (“X-Ray Vision”) and exporting objects from the content-script to the page scope using `exportFunction`/`cloneInto` only. Unfortunately, this whole concept is completely foreign to Chromium-based browsers (where using `window.eval` and related techniques is indeed the right thing to do), so the whole code currently in place needs to be retained if you want to continue supporting non-Firefox browsers as well.

[Further reading…](https://github.com/gorhill/uBlock/wiki/Dashboard:-Settings#block-csp-reports)

---

## Post 6 by @L_ishere670 — 2023-09-11T07:15:26Z

I found a fork of Bromite browser called Cromite which was mentioned in [Libreware channel on Telegram](https://t.me/Libreware/1178?single)  
Cromite is the uptodate version of Bromite but how could i trust this developer like the developer of Bromite??

Cromite github page: [GitHub - uazo/cromite: Cromite a Bromite fork with ad blocking and privacy enhancements; take back your browser!](https://github.com/uazo/cromite/)

---

## Post 7 by @lepras — 2023-09-11T12:54:36Z

I have been using bromite from quite a while now. It seemed to be the only good enough ungoogled chromium option on android.

When Bromite became unmaintained, sadness clouded me.

Cromite made me happy, atleast its better in UX perspective. the readme seems pretty nice, the issue resolutions seems nice. All in all, its giving me nice vibes but ofcourse time will tell.

---

## Post 8 by @Tech-Trooper — 2023-09-11T16:38:40Z

Why don’t you use Brave? If you disable crypto stuff and rewards, it there any advantages b/cromite provide over Brave?

---

## Post 9 by @anon63378630 — 2023-09-11T19:18:27Z

@Tech-Trooper  
Unlike Bromite/Cromite, Brave still contains proprietary components.

---

## Post 10 by @anonymous84 — 2023-09-11T21:07:57Z

the guy who is working on cromite was a major contributor to the original bromite

---

## Post 11 by @lepras — 2023-09-12T10:20:40Z

> [@anon63378630](#):
>
> Unlike Bromite/Cromite, Brave still contains proprietary components.

We need cromite vs brave mobile showdown fr fr

---

## Post 12 by @obzen — 2023-09-12T15:34:07Z

To get an answer to your question, you should explain why did you trust the main developer of Bromite.

---

## Post 13 by @jonah — 2023-10-17T20:10:35Z

> [@anon63378630](#):
>
> updates can take up to two weeks

Quickly looking through the releases since July I’m not seeing examples of this being the case… I found a couple releases which were ~4 days delayed around a month ago, but otherwise I’m largely seeing updates in about a day. It looks like they (semi?) automated updates with GitHub Actions, which is cool.

Also your excellent [https://divestos.org/misc/ch-dates.txt](https://divestos.org/misc/ch-dates.txt) page shows Cromite at 117 despite them releasing 118 5 days ago. Not to like tell you what to do or anything, but if you added a Cromite column to the more detailed history section I’m sure I and others would appreciate it, since Bromite is dead and Cromite’s gained ~1000 GitHub stars in the last 2 months :slight_smile:

---

## Post 14 by @anon63378630 — 2023-10-17T20:00:02Z

> [@Mull (Android Browser) + Criteria Change](https://discuss.privacyguides.net/t/mull-android-browser-criteria-change/14460/19):
>
> FWIW I think [Cromite](https://github.com/uazo/cromite) being recommended would make much more sense than Vanadium or Mulch, I’m surprised it hasn’t been mentioned or brought up already in these discussions.

Cromite does not enable CFI any longer: [Drop cfi support · uazo/cromite@579060f · GitHub](https://github.com/uazo/cromite/commit/579060fe5105c0cfcb35e5ee35a3f6c921ec0791)

---

## Post 15 by @Sharply — 2023-10-17T20:05:36Z

Hmmm, wasn’t aware of that. Does Brave enable CFI on their Android builds in comparison?

---

## Post 16 by @anon63378630 — 2023-10-17T20:25:41Z

> [@jonah](#):
>
> but if you added a Cromite column to the more detailed history section I’m sure I and others would appreciate it

The issue with this and also comparing dates, is that they do not ship the actual stable channel versions.  
This makes it difficult to line up with the rest and while updated may not actually be updated.  
I covered this version issue previously back in the Bromite days: [106.0.5249.163 is missing the recent zero-day fix · bromite/bromite · Discussion #2421 · GitHub](https://github.com/bromite/bromite/discussions/2421)

---

## Post 17 by @yes — 2023-10-17T20:29:37Z

to my understanding, CFI is.. a good thing?

may you elaborate?

---

## Post 18 by @anon63378630 — 2023-10-17T20:30:16Z

@yes

CFI largely eliminates an entire class of security vulnerabilities.

@Sharply  
I don’t think Brave ships with CFI.

---

## Post 19 by @Sharply — 2023-10-17T20:36:58Z

I think its still worth considering then, since Brave is the current recommendation, so it wouldn’t be a decrease from that. Though it would be nice if they did enable CFI, it appears they don’t due to it causing issues and crashing, see [here](https://github.com/uazo/cromite/discussions/292).

---

## Post 20 by @anon63378630 — 2023-10-17T20:39:45Z

@Sharply  
yes, but while Brave may not have CFI, at least it has a small army of developers behind it to quickly push out updates.

> [@Sharply](#):
>
> Though it would be nice if they did enable CFI, it appears they don’t due to it causing issues and crashing

Vanadium has fixed these issues twice now.

---

## Post 21 by @jonah — 2023-10-17T20:39:55Z

> [@anon63378630](#):
>
> they do not ship the actual stable channel versions.

Thanks, yes I was wondering if that was the issue because of the mismatched versions. It [looks like](https://github.com/uazo/cromite/blob/68de8daee6bc4cb3f3bd095cc3c7fb7124a5322d/.github/workflows/build-images.yaml#L75) they’re grabbing the current `win64` stable channel version though, shouldn’t that approach work?

---

## Post 22 by @Sharply — 2023-10-17T20:48:54Z

> [@anon63378630](#):
>
> yes, but while Brave may not have CFI, at least it has a small army of developers behind it to quickly push out updates.

That is a fair point, it is nice Brave has a whole team vs. Cromite being only maintained by 1 person. I guess it just comes down to how well uazo by himself can maintain the browser and keep it updated. You’ve proven it can be successfully done through your projects, so I wonder if he’s also able to keep up.

> [@anon63378630](#):
>
> Vanadium has fixed these issues twice now.

I wonder if uazo is aware? Seems like he should consider re-enabling it then for sure if it can be fixed.

---

## Post 23 by @thomascoven — 2023-10-18T04:29:02Z

I used to use Bromite - until it ceased active development.  
I currently use Cromite and Ungoogled Chromium ([Download latest stable Chromium binaries (64-bit and 32-bit)](https://chromium.woolyss.com/#android))  
Cromite indicates when an update is available, UC does not.  
Both seem quick to update to latest Chromium builds, but can lag for a few days at times.  
I presently use whichever of these two is most up to date as my default browser, with Mull (via F-Droid) as a fallback.  
There is very little mention on PG of the Android build of UC.  
It works very well and should also be discussed.

---

## Post 25 by @jonah — 2023-10-18T04:49:10Z

> [@thomascoven](#):
>
> Ungoogled Chromium

Those “ungoogled” Chromium releases on Android are just Cromite builds that are built by somebody else.

> Derived from [https://github.com/uazo/cromite/tree/002dc9166f20c34dc2ea87004712725e9e4bc3b0](https://github.com/uazo/cromite/tree/002dc9166f20c34dc2ea87004712725e9e4bc3b0)

> **[Release Chromium v118.5993.71-M118.0.5993.71-r1192594-Ungoogled-And64 ·...](https://github.com/macchrome/droidchrome/releases/tag/v118.5993.71-M118.0.5993.71-r1192594-Ungoogled-And64)**
>
> Chromium for 64-bit Android - Monday, 16 October 2023
> Chromium 118.0.5993.71 (Official Build) (64-bit)
> Revision e52f33f30b91b4ddfad649acddc39ab570473b86-refs/branch-heads/5993@{#1216}
> OS Android 9:...

---

## Post 26 by @thomascoven — 2023-10-18T05:03:15Z

That [woolyss.com](http://woolyss.com) site has been around a long time - well before uazo and Cromite.  
I don’t know enough to confirm if they previously used Bromite to build their UC or weather some Bromite patches only.  
Edit: are you saying that Android UC from woolyss is identical to Cromite from Uazo?

---

## Post 27 by @jonah — 2023-10-18T05:23:26Z

They did previously use Bromite, and now use Cromite yes. I don’t know if it’s identical or if they make other changes, because they don’t seem to publish their own source code (but that makes me assume it is identical).

In the link above it says that it’s built from Cromite’s source code :slight_smile:

---

## Post 28 by @thomascoven — 2023-10-18T05:34:56Z

Well, that’s one less app needed!  
Thanks Jonah!

---

## Post 29 by @anon63378630 — 2023-10-18T05:40:44Z

Those macchrome releases are worse than just rebuilds, they are longterm GPL violators: [Source code · Issue #5 · macchrome/droidchrome · GitHub](https://github.com/macchrome/droidchrome/issues/5)

---

## Post 30 by @anon28734771 — 2023-10-24T19:52:43Z

I just tried out Cromite, and I think it would be a good recommendation. Are there any concerns regarding Cromite?

---

## Post 31 by @You_will_own_nothing — 2023-10-24T21:53:13Z

> [@anon63378630](#):
>
> still no 32-bit support

That’s a [good thing](https://discuss.privacyguides.net/t/librewolf-browser-firefox-fork/148/94), no? :slightly_smiling_face:

---

## Post 32 by @anon63378630 — 2023-10-24T22:06:15Z

@You_will_own_nothing  
Different context.  
32-bit is dead on traditional computers, but most \<2017 phones are still 32-bit and are in active use.  
There are even some new budget phones today that are sadly still 32-bit.

edit: to add  
32-bit on Android is a bit worse than 64-bit compared to desktop  
Android 10 and higher adds the scudo hardened memory allocator which is far more effective under 64-bit. The GrapheneOS hardened\_malloc is also 64-bit only.

---

## Post 33 by @anon28734771 — 2023-10-25T04:52:43Z

> [@anon63378630](#):
>
> There are even some new budget phones today that are sadly still 32-bit.

My mom’s new Samsung phone is 32-bit. The moment I found out, I was furious. Not only is it full of bloatware, but it is also 32-bit. What a horrible company!

---

## Post 34 by @jonah — 2023-10-25T05:14:46Z

Well, ARM no longer makes new 32-bit CPU cores, so we won’t have to put up with that for too much longer.

---

## Post 35 by @Private_Plan — 2023-12-25T19:32:15Z

Is anything decided about Cromite?

I want to leave Brave, but I am yet to see how Cromite compares to it.

---

## Post 36 by @exaCORE — 2023-12-25T19:41:11Z

[https://divestos.org/pages/browsers](https://divestos.org/pages/browsers)

---

## Post 37 by @Private_Plan — 2023-12-25T22:02:00Z

As far as the link goes, Cromite is just as good as Brave, except Brave got better fingerprinting protection. How important is this difference between them?

 ![image](//forum-uploads.privacyguidesusercontent.com/original/2X/e/ef59a5d9a3a84bca6cbaaed38d4d022466df846d.png)

---

## Post 38 by @exaCORE — 2023-12-28T01:27:47Z

Personally I would go with the stronger fingerprinting protection, but I am no expert. You could also use a Gecko based browser if you are OK with that. You could also ask SkewedZepplin, the creator of DivestOS, your question if you have any specific qustions about the browser comparison page since they have an account on this forum.

---

## Post 39 by @anon51470692 — 2023-12-28T11:09:11Z

Off topic

1. Someone asked on X/Twitter regarding installing and configuring GrapheneOS.

2. An account disguising as official Cromite Browser account suggested instead to check eOS devices.

3. GrapheneOS account confronted.

4. Then that account added in his bio that it is an unofficial account.

I don’t have github account.  
Can someone please ping uazo about this?

[https://twitter.com/CromiteBrowser/status/1735653647428485314](https://twitter.com/CromiteBrowser/status/1735653647428485314)

 ![Screenshot-2c566b49ebaf](//forum-uploads.privacyguidesusercontent.com/original/2X/d/d616b5fa14ec08d23583a105eb2780f60bfdeec8.jpeg)

.  
.  
Is there any corelation between this ?  
[https://github.com/uazo/cromite/issues/442#issue-1955411579](https://github.com/uazo/cromite/issues/442#issue-1955411579)

---

## Post 40 by @anon97654407 — 2023-12-28T11:36:12Z

No problem! I’ll talk to him about this.

> [@anon51470692](#):
>
> Is there any corelation between this ?

Maybe, maybe not.

Edit : Done!

> **[Unofficial Twitter account with the branding of this browser spotted · uazo...](https://github.com/uazo/cromite/discussions/649)**
>
> Hello @uazo A user of the Privacy Guides forum actually spotted a Twitter Account called [@CromiteBrowser], it is now specified as 'unofficial fan-made user' on the bio. But before it wasn't, and b...

---

## Post 41 by @sha123 — 2023-12-29T21:42:17Z

> [@exaCORE](#):
>
> You could also use a Gecko based browser if you are OK with that.

These are not recommended on Android on PG, for good security reasons.

---

## Post 42 by @exaCORE — 2023-12-29T21:49:04Z

Fair enough, but i know there was a discussion about it here: [Mull (Android Browser) + Criteria Change](https://discuss.privacyguides.net/t/mull-android-browser-criteria-change/14460)

---

## Post 43 by @anon51470692 — 2024-01-03T11:28:24Z

> [@exaCORE](#):
>
> [https://divestos.org/pages/browsers](https://divestos.org/pages/browsers)

> [@Private_Plan](#):
>
> As far as the link goes, Cromite is just as good as Brave, except Brave got better fingerprinting protection. How important is this difference between them?

# uazo’s reply -

> 

> **[Uh oh! - Unofficial Twitter account with the branding of this browser spotted ·...](https://github.com/uazo/cromite/discussions/649#discussioncomment-8000904)**
>
> Hello @uazo A user of the Privacy Guides forum actually spotted a Twitter Account called [@CromiteBrowser], it is now specified as 'unofficial fan-made user' on the bio. But before it wasn't, and b...

> @anon97654407 in any case interesting discussion on that forum.  
> […]  
> with regard to the table where [Fingerprinting] protection is marked with enhanced and not strong, If it is the divestos one, it is made without any technical basis.  
> Divested-Mobile/DivestOS-Website#11 (comment)
> 
> > [Bromite Basic Fingerprinting Protection · Issue #11 · Divested-Mobile/DivestOS-Website · GitHub](https://github.com/Divested-Mobile/DivestOS-Website/issues/11#issuecomment-1595736849)
> > 
> > There is no study or in-depth technical analysis here or even definition of my categorization, the labels are just based off of my understanding.  
> > I’m not saying I am right here, I’m asking you as the author of many of the patches for clarification.

---

## Post 44 by @kocica180 — 2024-01-03T11:35:38Z

Same way: why shouldn’t we trust him?

---

## Post 45 by @Reset0609 — 2024-01-03T14:10:11Z

Theres a saying in Portuguese that would more or less translate to “the prudent die from old age”. In other words, one should have a skeptical/prudent approach toward life, and not blindly trust strangers

---

## Post 46 by @anon51470692 — 2024-01-06T04:00:54Z

Linux build is live. :hand_with_index_finger_and_thumb_crossed:

> <https://github.com/uazo/cromite/issues/621>
>
> can you please provide a linux build
> 
> flatpak or appimage

[https://github.com/uazo/cromite/commit/66746d261b8a655e434111021d55e1509b75030e](https://github.com/uazo/cromite/commit/66746d261b8a655e434111021d55e1509b75030e)

---

## Post 47 by @redoomed1 — 2024-02-02T19:57:03Z

Currently, there is an open [pull request for adding Cromite](https://github.com/privacyguides/privacyguides.org/pull/2381) to the [Mobile Browsers](https://www.privacyguides.org/en/desktop-browsers/) recommendations page.

I think that @jonah and @dngray asked about the timeliness of Cromite’s updates in the PG main Matrix room, so here is a simple table comparing how quickly some Android browsers apply updates from upstream Chromium, based on data from the recent Chromium releases:

| Downstream Android browser | Chromium version | Release date for new Chromium version[[1]](#footnote-35412-1) | Release date for downstream Android browser[[2]](#footnote-35412-2) | Catch-up time for downstream Android browser[[3]](#footnote-35412-3) |
| --- | --- | --- | --- | --- |
| Vanadium | 121.0.6167.164 | 2024-02-05 19:52:41 | 2024-02-06 16:48 UTC | ~ 1 day |
| Cromite | Same as above | Same as above | 2024-02-09 07:07 UTC | ~ 3 days |
| Brave | Same as above | Same as above | 2024-02-07 07:16 UTC | ~ 1 day |

* * *

1. Sourced from [Refs - chromium/src - Git at Google](https://chromium.googlesource.com/chromium/src/+refs) [↩︎](#footnote-ref-35412-1)

2. Sourced from GitHub releases [↩︎](#footnote-ref-35412-2)

3. The times listed here are approximate since the pages documenting the Chromium releases use static times for their release dates. That is, the pages show the same release time when viewing them on Mullvad Browser (which reports timezone to be UTC) and non-Arkenfox Firefox (which reports timezone to be the one set by the system). [↩︎](#footnote-ref-35412-3)

---

## Post 48 by @pika — 2024-02-10T12:13:26Z

Just to bring light to a small con of cromite that it does not support webuthn or passkeys probably due a proprietary blob used in upstream chromium for implementing webuathn/fido2 . This issue existed in Bromite as well and the developers are trying to look for an alternative implementation without using proprietary blobs.

> <https://github.com/uazo/cromite/issues/329>
>
> ### Preliminary checklist
> 
> - [X] I have read the [README](https://github.com/u…azo/cromite/blob/master/README.md).
> - [X] I have searched the existing issues for my problem. This is a new ticket, NOT a duplicate or related to another open issue.
> - [X] I have read the [FAQs](https://github.com/uazo/cromite/blob/master/FAQ.md).
> - [X] I have updated Cromite to the latest version. The bug is reproducible on this latest version.
> - [X] This is a bug report about the Cromite browser; not the website nor F-Droid nor anything else.
> 
> ### Can the bug be reproduced with corresponding Chromium version?
> 
> No
> 
> ### Cromite version
> 
> 117.0.5938.89
> 
> ### Device architecture
> 
> arm64-v8a
> 
> ### Platform version
> 
> Android 13
> 
> ### Android Device model
> 
> Google Pixel 6 (with GrapheneOS and Sandboxed Play Services installed!)
> 
> ### Is the device rooted?
> 
> No
> 
> ### Changed flags
> 
> no flags changed
> 
> ### Is this bug happening in an incognito tab?
> 
> Yes
> 
> ### Is this bug caused by the adblocker?
> 
> No
> 
> ### Is this bug a crash?
> 
> not a crash
> 
> ### Describe the bug
> 
> WebAuthn just does not work. After trying to authenticate or register, I get an error (see screenshots)
> 
> ### Steps to reproduce the bug
> 
> 1. Go to any website that supports WebAuthn authentication, like [WebAuthn.io](https://webauthn.io) 
> 2. Try to authenticate/register/use passkeys
> 3. Get an error
> 
> ### Expected behavior
> 
> Get a Google Play Services (or similar) popup asking me to authenticate, like this:
> <details><summary>Details</summary>
> <p>
> 
> ![Screenshot_20230922-190907](https://github.com/uazo/cromite/assets/51029895/b4a5e9a6-e6c1-49f2-8ae9-2dfd58696ee5)
> ![Screenshot_20230922-190912](https://github.com/uazo/cromite/assets/51029895/2d2bde28-7cda-41a9-a019-846dcac1d688)
> ![Screenshot_20230922-191040](https://github.com/uazo/cromite/assets/51029895/09235e9e-ce51-4b72-9d84-43b765f3fa52)
> 
> </p>
> </details> 
> 
> ### Screenshots
> 
> <details><summary>Details</summary>
> <p>
> 
> ![Screenshot_20230922-190609](https://github.com/uazo/cromite/assets/51029895/aeea7a68-088a-4005-a780-fbf810472d28)
> ![Screenshot_20230922-190551](https://github.com/uazo/cromite/assets/51029895/5e005e81-06c5-4a1c-8d42-3f133dc7fbcf)
> ![Screenshot_20230922-190440](https://github.com/uazo/cromite/assets/51029895/ee784db7-fe50-4b57-81cf-a26aa25b9aa8)
> 
> 
> </p>
> </details>

Passkeys are becoming popular and more websites are brining support for it.  
Not a deal breaker for me currently but i hope the devs work through this and implement this in near future so i don’t have to be dependent on Brave.

---

## Post 49 by @anonymous159 — 2024-03-05T20:30:49Z

Cromite should be recommended because it provides something Brave doesn’t - native android autofill without play services. This is a massive thing they patched that brave hasn’t done and I dont think that will change anytime soon

---

## Post 50 by @Sharply — 2024-03-05T21:23:47Z

There might actually be some work being done on this, based off [the GitHub issue](https://github.com/brave/brave-browser/issues/26733) being randomly self-assigned last week. I do hope it is resolved, it’s definitely an issue.

---

## Post 53 by @anon80779245 — 2024-04-04T00:46:04Z

I tested Cromite yesterday and noticed it removed completely Safe Browsing option. I prefer Brave that is proxying it trough their own servers, rather than disabling it completeky.

---

## Post 54 by @anon63378630 — 2024-04-04T09:18:26Z

@anon80779245  
Cromite can’t have Safe Browsing because it doesn’t include proprietary Google Play Services library.

> [@I clicked on a virus link, What to do now?](https://discuss.privacyguides.net/t/i-clicked-on-a-virus-link-what-to-do-now/14877/4):
>
> re safe browsing:
> 
> - Chrome, Vanadium, and Mulch only have Safe Browsing if you have real Google Play Services installed.
> - Bromite, Cromite, Mull, and Fennec F-Droid do not support Safe Browsing.
> - Official Firefox on Android doesn’t depend on Google Play Services for Safe Browsing.

---

## Post 55 by @anon80779245 — 2024-04-04T09:56:37Z

Fair enough, Brave do NOT proxy on Android [https://support.brave.com/hc/en-us/articles/15222663599629-Safe-Browsing-in-Brave](https://support.brave.com/hc/en-us/articles/15222663599629-Safe-Browsing-in-Brave)

I ran a test on [coveryourtracks.eff.org](http://coveryourtracks.eff.org)  
and **Cromite** was significantly **worse** than **Brave**. Why using AdBlock Plus instead of uBo ?

 ![Screenshot_20240404_174857_Brave](//forum-uploads.privacyguidesusercontent.com/original/2X/7/7cf426c39d1bd3f75024c0f6241db48fad48d24b.jpeg)  
 ![Screenshot_20240404_174730](//forum-uploads.privacyguidesusercontent.com/original/2X/1/1f72e9150d6055d4d195b6963e66dcf21b17160c.jpeg)

---

## Post 56 by @KeepItSimple — 2024-04-04T16:56:28Z

You can add additional filters to block more ads and trackers. That is Cromite:

 ![Screenshot_20240404-195242](//forum-uploads.privacyguidesusercontent.com/original/2X/1/1fcdaf8397a4343bffa88af52377b42451a76b76.jpeg)

---

## Post 57 by @sha123 — 2024-04-04T17:33:58Z

> [@anon80779245](#):
>
> I ran a test on [coveryourtracks.eff.org](http://coveryourtracks.eff.org)  
> and **Cromite** was significantly **worse** than **Brave**. Why using AdBlock Plus instead of uBo ?

Coveryourtracks test results are _not_ meaningful. It’s best to ignore this site. But yeah, Brave’s Adblocker is superior, also because it is more secure.

---

## Post 58 by @FlipSid — 2024-04-04T20:23:12Z

> [@sha123](#):
>
> Coveryourtracks test results are _not_ meaningful.

Correct. Actually all fingerprint test sites  
Here’s why.

> **[Browser Tracking | Madaidan's Insecurities](https://madaidans-insecurities.github.io/browser-tracking.html)**

I have few more links. Whoever’s interested just send DM.  
Not the topic here.  
Just a reply on testing specific browsers, in this case Cromite, on those sites.

---

## Post 59 by @anon80779245 — 2024-04-05T01:32:14Z

I disagree that those test are meaningless. I guess to refer to the fingerprintabilty bits, which is effectively not representative of the reality since it only reflects this website visitor.

But the tracking tests are objective. Yes I can enable extra filters, but for a browser that blocks many privacy-harmful settings, it’s surprising to see it come at such a low tracking protection default.

Does AdBlock pays to be the default adblocker? Ms Edge Mobile also use Adblock instead of ubO

---

## Post 60 by @freyja — 2024-04-05T23:30:53Z

I remember uazo saying he chose adp because it was written in c++ , and adding support for ubO would require enabling extensions (as it’s written in JS). he also removed the Acceptable ads portion of the code. [link to the GitHub issue where it’s discussed](https://github.com/uazo/cromite/issues/560#issuecomment-1831428760)

---

## Post 61 by @rookie-ger — 2024-05-13T18:31:12Z

I have been using Cromite on Linux Mint for some time now and I must say that I like it. It is not as bloated as Brave is. I have changed some settings: I’ve enabled “System - Use hardware acceleration when available” and I’ve disabled adblocking to let the PiHole take care of it. However, I am not sure if I should re-enable the latter. Nevertheless, I am not sure if I should use it as my Chromium based daily driver on Linux for it seems being maintained only by one developer. So the same fate as Bromite might befall it one day.

---

## Post 62 by @Sharply — 2024-05-13T19:33:23Z

I’d recommend just leaving Cromite’s adblocking disabled and installing uBlock Origin. It’s always good to have a multilayered approach, it’s important to use content blocking on both a browser level and network level imo.

---

## Post 63 by @freyja — 2024-05-14T01:05:56Z

cromite currently does not support extensions. the only options are to use integrated ABP or don’t use it (and perhaps DNS based adblock)

---

## Post 64 by @anon63378630 — 2024-05-14T01:11:18Z

Cromite has Windows and Linux builds available which do support extensions

---

## Post 65 by @iamnotamonk — 2024-05-14T02:44:45Z

Well I also have done some test but I got better results in Chromite that in Brave. Maybe your config isn’t the best?  
Some things I did:

- random timezones for every page
- block webgl and webrtc
- block all popups

---

## Post 66 by @anon80779245 — 2024-05-14T09:03:37Z

The problem here is you still have an unique fingerprint. We shouldn’t recommend unless that is solved.

---

## Post 67 by @freyja — 2024-05-16T09:22:54Z

ah. yes very true. I was strictly speaking about Android. somehow missed the post talking about it being used on Linux, thought we were still talking about the Android version.

---

## Post 68 by @AbuMubarak — 2024-05-22T11:15:08Z

Interesting, considering that EFF is considered a major player in the privacy/security community. I would think they would know the pitfalls of their testing procedures

---

## Post 69 by @anon63378630 — 2024-05-22T11:33:05Z

@AbuMubarak  
Yes, but EFF is a legal/rights firm first and foremost.

---

## Post 70 by @Scolding0513 — 2024-06-22T02:45:31Z

Cromite is 100% amazing and awesome. please add.

---

## Post 71 by @anon80779245 — 2024-06-22T10:10:49Z

I see this has 19 votes, but please don’t add this browser. We still only recommend Safari for iOS because having another browser adds little. Cromite adds nothing compared to Brave. It doesn’t even have fingerprint resistance. Arbitrary arguments that one’s “doesn’t trust Brave” or that Brave is bloated are irrelevant. Firefox is also not great by default, but one can tweak it. Same with Brave.

---

## Post 73 by @Sharply — 2024-06-22T17:04:49Z

I agree with all of your points, but to further add on to this:

Cromite also:

- Allows disabling & toggling WebGL per-site

- Allows disabling & toggling WebRTC per-site

- Allows clearing history and cached data on exit (Why does Brave on Android still not have granular control like this???)

- Ability to randomize timezone

- Support for Userscripts (I don’t personally use any due to fingerprinting concerns, but I know people who do very heavily and this helps compensate for a lack of extension support on mobile)

Etc… This is only off the top of my head, you can see [here](https://github.com/uazo/cromite/blob/4d68d344d465d5b4683591838f526e17ebd0395b/docs/FEATURES.md) for their comprehensive list of features & additions.

Cromite definitely isn’t perfect, for instance, Adblock Plus was a very questionable choice for the included content blocker… but I think it absolutely has its merits over Brave.

---

## Post 74 by @anon48875053 — 2024-06-22T17:05:55Z

> [@Sharply](#):
>
> Allows clearing history and cached data on exit (Why does Brave on Android still not have this???)

There is an option for that.

> [@Sharply](#):
>
> Support for Userscripts (I don’t personally use any due to fingerprinting concerns, but I know people who do very heavily and this helps compensate for a lack of extension support on mobile)

Could this be used with Cromite? [GitHub - victornpb/undiscord: Undiscord - Delete all messages in a Discord server / channel or DM (Easy and fast) Bulk delete](https://github.com/victornpb/undiscord)

If yes, then this is a big W.

---

## Post 75 by @Sharply — 2024-06-22T17:20:10Z

> [@anon48875053](#):
>
> There is an option for that.

Where? I only see the option to clear all browsing data, rather than just ex. specifically history & cache like you can do with Cromite & Brave on desktop.

 ![image](//forum-uploads.privacyguidesusercontent.com/original/2X/a/a0ad345f7bc90e46f8285bc55958bbdae6669d9f.png)

> Could this be used with Cromite? [GitHub - victornpb/undiscord: Undiscord - Delete all messages in a Discord server / channel or DM (Easy and fast) Bulk delete](https://github.com/victornpb/undiscord)

Honestly I might test this, you’re right, that’d be pretty cool & useful if it works with Cromite.

---

## Post 76 by @anon48875053 — 2024-06-22T17:24:14Z

> [@Sharply](#):
>
> Where? I only see the option to clear all browsing data, rather than just ex. specifically history & cache like you can do with Cromite & Brave on desktop.

Yeah, you don’t get granular control like on desktop.

---

## Post 77 by @Viper — 2024-06-22T17:43:56Z

![Screenshot_20240623-034258](//forum-uploads.privacyguidesusercontent.com/original/2X/d/d5faab03ffb64592601d27047e531ce605d4b317.png)

It’s here but on startup

---

## Post 78 by @anon48875053 — 2024-06-22T17:45:37Z

I see, good to know.

---

## Post 79 by @anon80779245 — 2024-06-22T20:06:00Z

> [@Sharply](#):
>
> Allows clearing history and cached data on exit

Brave does have this option. Called Forgetful browsing. It Canbe disabled for websites you want to stay logged in.

You can also disable history and clear everything after exit.

 ![Screenshot_20240622_215632_Brave](//forum-uploads.privacyguidesusercontent.com/original/2X/e/e77b7b57b03a4c7b1974a0215d8d526a2607bfb2.jpeg)  
 ![Screenshot_20240622_215703_Brave](//forum-uploads.privacyguidesusercontent.com/original/2X/2/2d6dfdaf02d44a89f788025a99e7073da580d7f7.jpeg)

> [@anon48875053](#):
>
> there will still be people who will not use Brave because of the CEO.

Like some people will not use Signal or Firefox because they are “woke”. But they make amazing product regardless.

> [@Sharply](#):
>
> Ability to randomize timezone

This is useless. For so many reasons. One is that if timezone doesn’t match location per IP, then they can easily know you are using VPN or faking your time.

BTW even Cromite says that their fingerprint protection is

> **Cromite’s** privacy features, including **anti-fingerprinting mitigations** (which are **not comprehensive**

This compare to Brave, which does have comprehensive fingerprint mitigation.

I do agree about the customisation aspect and that Cromite more FOSS than Brave.

---

## Post 80 by @j9ax6s61 — 2024-06-22T21:34:30Z

> [@anon80779245](#):
>
> This compare to Brave, which does have comprehensive fingerprint mitigation.

Ah, yes … so you personally checked?

---

## Post 81 by @Sharply — 2024-06-23T00:10:54Z

> Brave does have this option. Called Forgetful browsing. It Canbe disabled for websites you want to stay logged in.

That’s for cookies & I actually think cache as well so that’s fair, but I still don’t see a way to disable history.

> This is useless. For so many reasons. One is that if timezone doesn’t match location per IP, then they can easily know you are using VPN or faking your time.

1: The only browsers that can defeat advanced fingerprinting are Tor Browser & Mullvad Browser. Cromite can’t defeat advanced fingerprinting. Therefore, since we’re talking about naive fingerprinting, I highly doubt any naive fingerprinters are actually going to the extent to check for this.

2: There’s no way to hide you’re using a VPN: your IP address & other factors easily reveal that.

So I do think this feature does help against fingerprinting to some extent.

That being said, I do agree Brave generally has stronger fingerprinting protection. @anon63378630 outlines this in [his table](https://divestos.org/pages/browsers#chromium-based).

---

## Post 82 by @batman — 2024-11-14T20:51:18Z

Cromite users will stand out more due to its unique fingerprint and smaller user base, especially when compared to Brave. For privacy, it’s important to blend in with the crowd and become one with them.

---

## Post 83 by @redoomed1 — 2024-11-14T20:55:05Z

Closing this thread since Cromite is now recommended on the site as of the latest release

> <https://github.com/privacyguides/privacyguides.org/pull/2381>
>
> Changes proposed in this PR:
> 
> - add Cromite back. Logo (svg) is my own reprodu…ction of the official logo (which is in png).
> 
> 
> 
> 
> - [x] I have disclosed any relevant conflicts of interest in my post. (none other than being a user of it)
> - [x] I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project.
> - [] I am the sole author of this work. (Some are referenced from https://github.com/privacyguides/privacyguides.org/commit/b3ceb640525e1f53a3b5eaec766c48e1c49b4737 but it's y'all so I don't think there is a copyright issue)
> - [x] I agree to the [Community Code of Conduct](https://www.privacyguides.org/en/code_of_conduct/).
> 
> 
> 
> ---
> 
> Criteria:
> 
> > Must support automatic updates.
> 
> yes
> 
> > Must receive engine updates in 0-1 days from upstream release.
> 
> 0-1 days is a bit too strict for a one-person project. [DivestOS claims it's "within a week,"](https://divestos.org/pages/browsers#chromium-based) my personal observation is usually 1 day, occasionally up to 3. Maybe we can ask the maintainer for this
> 
> > Any changes required to make the browser more privacy-respecting should not negatively impact user experience.
> 
> doesn't appear to
> 
> > Android browsers must use the Chromium engine.
> 
> yes