FOSS Browser

FOSS Browser is a small interface around Android System WebView, the browser component already provided by Android. It adds tabs, bookmarks, profiles, a host-based blocker and controls for site capabilities without shipping a second Chromium engine inside the APK.

Version 24 moved the minimum to Android 10, removed legacy storage permissions, added camera support to the file chooser, and improved text-file and blob:/data: downloads. It also updated the standard profile defaults and changed search, ad-block updating and the interface.

What a fresh profile allows

The fixed version 24 source gives a clearer picture than a generic “privacy browser” label. A default profile starts with:

• host-based ad blocking and automatic cookie-banner denial enabled;
• third-party cookies, location, camera, microphone and pop-ups disabled;
• JavaScript, first-party cookies, DOM storage, images and browsing history enabled;
• dark/night handling and the Save-Data request header enabled;
• the optional fingerprint-protection setting disabled.

For top-level page loads initiated by the app, FOSS Browser adds Do Not Track and Global Privacy Control headers. It does not add them to every subresource request, and sites are not technically forced to honour either signal. The same top-level header set identifies X-Requested-With as DuckDuckGo’s Android package and includes the current page as Referer; FOSS Browser is not DuckDuckGo Browser. Defaults can be changed per profile, and an upgraded installation may keep the user’s prior choices.

Startpage is the default search engine. The initial home/bookmark links point to the project’s Codeberg documentation.

Blocking and privacy boundaries

The blocker works from a hosts list, but the APK carries no built-in list. On first use it tries to download StevenBlack’s consolidated hosts file from raw.githubusercontent.com; after that, files older than about one day are refreshed. Cookie-banner denial has a separate Mozilla rules file, also downloaded from GitHub on first use and refreshed after about three days. Before either first download succeeds, that part of the blocking has no rules to apply. A hosts list can stop requests to listed domains, but it cannot apply every page-specific cosmetic or script rule that a browser extension such as uBlock Origin can.

Our static scan found no known tracker SDKs. Websites can still track visitors using their own scripts, cookies, login accounts and fingerprinting, especially because JavaScript and first-party cookies start enabled. “No tracker SDK in the app” is not the same as anonymous browsing. Use Tor Browser if the goal is routing traffic through Tor and reducing linkability across sites.

The camera, microphone and location permissions exist for sites that request those features. They are disabled in the default browser profile and Android separately asks the user before granting the app sensitive access. The manifest also includes notifications and audio-settings access.

The engine comes from Android

FOSS Browser’s tiny size comes from using System WebView. Security fixes for HTML, JavaScript and rendering arrive with the WebView provider, not necessarily with a new FOSS Browser release. Check that Android System WebView—or the browser package acting as your WebView provider—is kept current on the device.

The fixed source explicitly enables Google Safe Browsing in WebView. It also sets mixed-content mode to always allow, so an HTTPS page can still load HTTP subresources. Safe Browsing is a useful warning layer, but it does not cancel that weaker mixed-content policy.

About this file

• Version 24, build 159, is 3.5 MB, needs Android 10 or later and contains no native CPU-specific libraries.
• It declares eight permissions. Camera, microphone, location and notifications need user approval on relevant Android versions; network and audio-settings access do not use the same runtime prompt.
• Its SHA-256 is 3cb274f869f777c8b420fd55a822eca72e11e22906161b07accd19b5c8be7b36, matching F-Droid’s signed index. F-Droid signs this build.
• F-Droid labels the app GPL-3.0-or-later, while the fixed source repository’s LICENSE.md says AGPL-3.0-or-later. This page records that metadata mismatch rather than choosing one label for both.

Versions currently kept in the F-Droid repository. We host and check only the newest one. Full changelog.