v0.4.3

Cobalt 0.4.3 — release notes

Build: versionCode 7, 0.4.3, Chromium 140.0.7339.264, debug-signed (no release key until stable).
APK: modules/app/build/outputs/apk/release/app-release.apk

New

Incognito. Tabs on the primary off-the-record profile, destroyed when the last one closes. The whole shell recolours rather than showing a badge — being wrong about which mode you're in is an asymmetric mistake. Windows are FLAG_SECURE, so they stay out of screenshots and the recents preview.

History. Reads Chromium's own history service. This exposed a real gap: Chrome attaches its 89 tab helpers only for a TabAndroid, which Cobalt doesn't have, so no visits were being recorded at all. HistoryTabHelper is now attached through the WebContents delegate bridge. The other 88 helpers remain a known gap.

Fuzzy search in history. Chromium's own history search matches word prefixes only — "assembly" never found "WebAssembly". Search now runs in the shell: every word you type must appear as a subsequence, ranked by consecutive letters and word starts, with an optional regex mode (.* toggle). An invalid pattern is reported with its reason instead of throwing.

The toolbar belongs to the page. Settings, Downloads, Bookmarks and History no longer carry the address bar, tab count and ⋮ — none of those act on what's on screen there. Each of those screens gained the back arrow Settings already had.

Security — 28 backports

Three from the watcher's second batch (#27, #28, #34) and 25 from the third (#36–#150), covering V8, ANGLE, the GPU process, the network stack, navigation, downloads, workers, media and image decoding, CSS, DevTools, WebUI and the File System Access API.

Most of these fixes were never on a release branch — they landed on main before Chrome 153 branched — so scanning release branches found only 45 of 122. A second scan, 55,000 commits deep, found fixes for all but four.

Selection was deliberate: nothing that changes a .mojom (each turns a ~1,500-step incremental build into ~26,500), no Blink runtime flags, nothing that ports a feature. 16 apply exactly as upstream wrote them; 9 are re-expressed against M140, each patch header saying what differed.

Two were written and then dropped: #147 and the GPU half of #65 live in the validating decoder, which Cobalt never runs — taking them would have claimed a fix for dead code.

docs/security-backports.md lists all 28 with upstream commits, ~33 issues that don't apply with a reason each, and the deferrals.

Fixed

• TalkBack crashed the app. Chromium's accessibility code calls androidx.core 1.17 API; the shell shipped an older one. Now on androidx.core 1.17.0, which required AGP 8.9.1.

In progress

• De-GMS: tools/build/strip-gms-aar.py removes 4,170 GMS/Firebase/datatransport classes (8.5 MB). The stripped variant still crashes at startup on two Firebase InstanceID token requests; the source is unconfirmed (probably the invalidation listener). The normal build is unaffected.

Verified on device (SM-M315F)

Browsing, WebGL 2, WebAssembly, JPEG decoding, a 1 MB download completing and ording and search (plain, fuzzy, regex, invalid pattern), incognito includingthe secure-window check, all four sections with their back arrows, and the toolbar still present while browsing. No crash, renderer death or GPU process exit; the crash buffer has nothing from Cobalt. All 30 unit tests pass. The patch series applies with 76 entries,y backport "already applied" on a second run.

Known gaps

• 88 of Chrome's 89 tab helpers are still unattached (HTTPS-Only, favicons, find-in-page, Safe Browsing observers, permission managers).
• #26 (CacheStorage) is written but deferred — it's a .mojom change; it lands
• #19 (V8 Maglev) still needs specialist review and may force a rebase.

v0.4.2

Cobalt 0.4.2

Your tabs survive

• Open tabs come back after the app is closed, swiped away, killed by Android, crashed or updated. Each tab keeps its back and forward history.
• Restored tabs only load when you open them, so many saved tabs cost almost no memory.
• Incognito tabs are never saved.
• A link from another app now opens in a new tab instead of replacing the page you were on.

Bookmarks

• Tap Bookmark in the ⋮ menu to save the page. The star fills in and the label reads "Saved".
• Bookmarks in the menu lists them, newest first. Tap one to open it, or remove it with the red button (it asks first).
• They're kept in Chromium's own bookmark store on your phone.

Clear a site's data

• The lock icon has a new option: Clear cookies and site data. It deletes that site's cookies and everything it stored on the phone, then reloads the page, which signs you out of it. Other sites are untouched.

Share

• Share in the ⋮ menu sends the page address to any app.
• The menu's page actions are now two rows of three, so every label fits.

Security: 7 more fixes, 17 of 25 in total

• 3 WebGL fixes for PowerVR GPUs (CVE-2026-87464, -87438, -85050). PowerVR is used in many budget MediaTek phones (Helio G35, G37 and similar).
• GPU (CVE-2026-84351): stops a crafted reply from the GPU writing past memory it shouldn't.
• File System Access (CVE-2026-84354): a website can no longer rename your files without write permission to their folder.
• DevTools (CVE-2026-85042) and address bar suggestions (CVE-2026-84357).
• Only one CVE from that batch is left: a V8 issue (CVE-2026-85045) that may need a newer Chromium. It's waiting on review by someone who knows V8 well.

Full record: docs/security-backports.md.

Known limitations

• The PowerVR fixes haven't been tested on PowerVR hardware yet.
• The APK is signed with the debug key. Don't rely on it as an update path until there's a project release key.

v0.4.1

Cobalt 0.4.1-nightly

Security

• Ten fixes backported from Chrome 152 and 153 to Chromium 140:
  • two critical: CVE-2026-87488 (WebGL/ANGLE) and CVE-2026-87628 (Cast);
  • eight high: CVE-2026-84324, 84326, 84333, 85043, 85048, 85049, 85051 and 85052.
• They cover ANGLE, V8, Dawn, Skia, the compositor, the network stack and crash reporting.
• Every backport lists its upstream commit in docs/security-backports.md.

Downloads

• Downloads work now. They go to the phone's Downloads folder, and a notice appears when one finishes.
• A new Downloads page lets you pause, resume, cancel, open and delete. Delete is red and asks first, because it removes the file.

PDFs

• pdf.js is built in, preinstalled like uBlock Origin, with its telemetry turned off.
• PDFs from websites open in the browser.
• Other apps can offer Cobalt as a PDF viewer.
• A PDF on your phone shows a green lock.

Browsing

• You can search from the address bar: DuckDuckGo by default, or Google, set in Settings → Search engine.
• The address bar selects everything when you tap it.
• Links that open a new tab now open a Cobalt tab.
• Both engines now send Chromium's own user agent, with nothing added.

Fixes

• The address bar no longer keeps showing a download's URL.
• Fixed a crash on every download (a missing androidx.browser library).

v0.4.0

Cobalt 0.4.0 (nightly)

Cobalt's own interface now runs on Chromium. Kotlin and Compose on top, Chromium 140.0.7339.264 underneath: Blink draws every page, V8 runs every script, and uBlock Origin blocks ads.

New

• A bottom-first layout. The page fills the screen, with one toolbar underneath: the address (reload inside it), the tab count and ⋮. Nothing sits above the page or floats over it.
• Sheets rise from the toolbar.
  • Options: new tab, forward, reload and screenshot as tiles; Home, Extensions, Downloads, Bookmarks and Settings as a list.
  • Tabs: a two-column grid of cards with page previews.
• Tabs: open, switch and close. Each tab keeps its page and scroll position, and closing one really frees its renderer.
• Screenshot: saves the visible page (not the browser around it) to Pictures/Cobalt.
• The lock explains itself.
  • Security comes from Chromium's own verdict, so certificate errors and mixed content show correctly.
  • Tap it to see the connection state and the site's certificate: issued to, issued by, validity, chain length, SHA-256.
• Themes:
  • Four presets: Cobalt (the new default, a modified One Dark), One Dark, Solarized Light and Solarized Dark.
  • One theme for day and one for night, following the phone, or pin either.
  • Make your own on the phone by picking colours or typing hex values, with a live preview. Share themes as text, or paste one in.
  • Readability is checked with a one-tap fix, never blocked.
  • Incognito's look is derived from your dark theme, so it always stays distinct.
• Settings → About: version, engine, licence, and links to the source, the issue tracker and the licences page.
• Extensions opens the extensions page, with uBlock Origin installed and enabled.
• Links from other apps open in Cobalt.

Fixed

• The app icon now appears in the launcher, recents and the launch screen; before, it showed Android's stock icon.
• No white flash on launch: the first frame matches the theme.
• Status bar icons follow the theme, so they're readable on light themes.
• chrome://extensions and Chromium's other built-in pages are readable at phone size.

Known issues

• The open-source licences page is a placeholder. This build doesn't include the third-party licence text, which blocks any public distribution until Chromium is rebuilt with credits enabled.
• Typing words that aren't an address shows "not a web address". Search needs a default search engine, which is still to be chosen.
• Downloads, Bookmarks and Incognito aren't built yet; their places in the interface say so.
• Extension cards scroll sideways on the extensions page.
• Google Play Services is still present. It will be removed when it blocks the interface work, or after it.
• The release APK is about 410 MB (Chromium's engine is uncompressed and not yet shrunk). It's signed with the debug key because there's no project release key yet.

Requirements

Android 10 or later on an arm64 device. Built and tested on a Galaxy M31 (4 GB RAM).

Installing the release APK over the Chromium-interface Cobalt (app.auriel.cobalt) requires uninstalling that build first, and its browsing data goes with it.