The Chromium Hardening Guide claims some Chromium packages are built without all the security features or are updated much less often. Apparently Arch and Fedora are fine but the guide doesn’t go into any detail on the current status for Ubuntu or Debian-family packages.
I was using Canonical’s Chromium Snap with uBOL for when I need a hassle-free browser which was also excluded from my VPN. But the new VPN service I switched to doesn’t have functional split tunneling for Snaps and I experience webapp issues with Flatpak browsers, so in case either the Snap or Flatpak packages were best I’d still need the next best native option.
inb4 off-topic replies
No I can’t switch to another distro.
Yes I’m aware I can try installing Brave or Brave Origin, disabling Brave shields, and install uBOL. I’m still interested in the answer to this question though.
I’d suggest brave origin. More importantly stop using browsers in flatpak or snap. Both of those weaken the security of the browser. The chromium hardening guide goes more in depth if you want to know more.
Vanadium developed by the GrapheneOS team is the most secure browser out there, though it only support android. It’s GOS, they definitely know what they are doing.
Secureblue made a similar project that does work on desktop like Ubuntu:
AFAIK this is the most secure browser on desktop, but it does not have many memory-hardening Vanadium has.
But if I did not misread the code, most of their patches to Chromium already exist as options in chrome://flags in original Chromium, so theoretically you can get most of its security benefit by customizing Brave or Chromium, as long as you know what you are doing and not making mistakes.
You can also put the browser into microvm like google crosvm, for maximum security.
If you also consider privacy, things get much more complicated. None of the options are ideal. The more you harden the browser, the more fingerprints you create. Half of the security patches Trivalent use do create fingerprints. If you are also worried about privacy, I think the arguably best balance between security and privacy is Brave with default settings, and with security options enabled that only affect the lower-level and does not create detectable fingerprints at javascript level.