# Site isolation of Gecko-based browsers on Android **URL:** https://discuss.privacyguides.net/t/site-isolation-of-gecko-based-browsers-on-android/8590 **Category:** General **Tags:** software **Created:** 2022-11-05T12:57:20Z **Posts:** 15 ## Post 1 by @anon50057427 — 2022-11-05T12:57:20Z As we know Gecko browsers don’t have site isolation on Android. I really want to use Mull on Android, but some questions preventing me from switching. Is site isolation a big security concern? Are there many sites out there that can exploit this vulnerability? Should I open only one site per session when using Gecko-based browsers to mitigate the site isolation issue? What threat model is suitable for using Gecko browsers? --- ## Post 2 by @jji77860 — 2022-11-05T15:42:35Z Don’t use Mull. The arkenfox user.js they are using, it is specifically made for desktop Firefox. Use any chromium browser, or the best Bromite. --- ## Post 3 by @anon86352167 — 2022-11-05T15:47:12Z Personally I just use default Firefox and its fine for me but its mostly threat model based. Ultimately you can use whatever you want if you deem it worth the hassle or “risk” for you. --- ## Post 4 by @jji77860 — 2022-11-05T15:53:59Z Firefox android standsout a lot with uBO and is literally the best. But lack of features and slowness bothers me. I will try it next year when it matures enough. --- ## Post 5 by @anon50057427 — 2022-11-05T15:59:25Z Is Bromite still worth using despite the fact that it is not up-to-date? Bromite chromium version is 106.0.5249.163 and the latest chromium version is 107.0.5304.94. --- ## Post 6 by @anon86352167 — 2022-11-05T16:39:31Z Personally I’d just use Brave. It seems a lot of people have lost faith in Bromite for whatever reason --- ## Post 7 by @anon50057427 — 2022-11-05T16:41:44Z I’d use it too, but Bitwarden autofill doesn’t work in Brave for me. --- ## Post 8 by @anon86352167 — 2022-11-05T16:44:42Z Really? When I used Brave it worked fine for me. Are all your toggles in bitwarden enabled? --- ## Post 9 by @anon50057427 — 2022-11-05T16:54:19Z It’s probably due to the lack of google services. Autofill works with accessibility service though, but sometimes it can be buggy. --- ## Post 10 by @jji77860 — 2022-11-06T10:33:00Z > It seems a lot of people have lost faith in Bromite for whatever reason It depends on your definition of faith. Bromite disables JIT by default, JavaScript RCE will have hard time escaping sandbox, plus all GrapheneOS patches are applied to it. Lead dev of ROM didn’t like that they were accepting patches from their competing ROM, and instantly dismissed the project without second thought. --- ## Post 11 by @anon63378630 — 2022-11-06T15:45:03Z This thread is awful. Isolation is clearly defined on my tables: [https://divestos.org/index.php?page=browsers](https://divestos.org/index.php?page=browsers) Bromite is consistently behind: [https://divestos.org/misc/ch-dates.txt](https://divestos.org/misc/ch-dates.txt) Bromite does _NOT_ include all of the Vanadium patches: - https //github[.]com/bromite/bromite/tree/master/build/patches - https //github[.]com/GrapheneOS/Vanadium/tree/13/patches > The arkenfox user.js they are using, it is specifically made for desktop Firefox. This statement is meaningless. You’d think I’d maintain Mull for the past five years if it didn’t do anything? edit: to actually elaborate on this: Fenix compared to desktop: - RFP does not have letterboxing - RFP mangles languages and will always(?) send the system language - RFP does not allow the user to allow canvas access for a website - dFPI is not available, FPI is - FPI doesn’t partition service workers, Mull however disables them - mDNS protections for WebRTC are not available, Mull disables WebRTC - ETP Strict cannot be set via config, Mull changes the default in the code instead * * * > JavaScript RCE will have hard time escaping sandbox This doesn’t make it acceptable to fall behind and leave zero days hanging around. --- ## Post 12 by @anon86352167 — 2022-11-06T16:00:51Z Oh wow are you the creator/maintainer of Mull? Very impressive! I appreciate the work you do! Is there a good place to see the changelog for Mull? --- ## Post 13 by @Gunther — 2022-11-06T16:58:29Z Thanks for this reply. The impression I have from PrivacyGuides is that Firefox’s site isolation is worse than Chromium’s on both desktop and Android, but even moreso on Android. I’ve had trouble finding technical, in-depth info comparing the site isolation of the two browser engines so if you have any more info on the topic that pushes against this orthodoxy, I would love to hear them. I see that on [What are the best private browsers on Android in 2025?](https://privacytests.org/android.html) Mull performs nearly as well as Brave/Bromite in the “State Partitioning tests.” Does this give the full picture in terms of how effective the site isolation is or is there more too it? --- ## Post 14 by @anon63378630 — 2022-11-06T18:08:03Z @Gunther please read my tables link, it details the difference between per-site process isolation and per-site data isolation. [privacytests.org](http://privacytests.org) only takes into account per-site data isolation. --- ## Post 15 by @Xoxohelloes — 2023-05-09T14:48:15Z What do you mean by “standsout”?