Redoubt 157.0-3

Redoubt 157.0-3 fixes video playback. In 157.0-2, most web video did not play: anything encoded as H.264 video or AAC audio, which covers most sites. That includes plain MP4 files and the streaming players most video sites use. This hotfix makes them play again. It installs over 157.0-2 as an update and keeps your settings. Requires Android 8.0 or later.

Redoubt is an independent project. It is not affiliated with or endorsed by LibreWolf or Mozilla. Website: https://redoubtbrowser.org

What's new since 157.0-2

Videos play again. H.264 and AAC media now decode, both as plain video files and through the streaming players most sites use (Media Source Extensions). 157.0-2 played only VP8, VP9 and AV1 video with Opus audio.

A security trade-off, stated plainly: web content no longer runs in Android "isolated" processes. 157.0-2 ran web pages in Android isolated processes. This was a Redoubt change; stock Firefox for Android does not do it. In Firefox 157, a page running in an isolated process cannot use Android's video decoders, so nothing can play H.264 or AAC. This is a known upstream bug, Mozilla bug 1810736, and no setting works around it. Redoubt 157.0-3 runs web content the way Firefox for Android does.

• What this costs: web content processes now run under the app's own Android user. A content process taken over by a browser exploit could therefore read the app's own data (profile, cookies, saved logins). This is the same as in Firefox for Android.
• What is unchanged: Fission site isolation for high-value sites (locked on) and RLBox library sandboxing.
• What comes next: isolation will be turned back on once a Firefox release can decode video inside an isolated process.

Update check: no language header. The opt-in update check no longer sends an Accept-Language header, so the request no longer reveals your language. It still carries no identifier and no version.

Update check hidden on store installs. If an app store installed Redoubt (an F-Droid client, Accrescent or Google Play), the Check for updates setting is hidden and nothing is sent, because the store notifies you. Installs from this page are not affected.

Everything else carries over from 157.0-2: Firefox 157 with its Android security fixes, uBlock Origin 1.75.0 with the cookie-notice lists on by default, the same privacy configuration, and the same signing key.

Verify what you downloaded

sha256sum -c SHA256SUMS.signed
apksigner verify --print-certs fenix-<abi>-release.apk | grep -i SHA-256

The certificate digest must be:

64:14:EB:33:46:81:CF:6E:92:90:34:B5:6A:06:2D:2B:8D:A0:90:82:21:72:F7:A3:95:2C:85:FD:D1:28:3B:D0

Signed with APK signature schemes v2 and v3, no v1, using the same key as 157.0-2 and every beta.

Which file

• fenix-arm64-v8a-release.apk: almost any phone from the last several years.
• armeabi-v7a: older 32-bit devices.
• x86_64: emulators.
• The universal APK carries all three and is much larger.

Updates: use the in-app check, Obtainium with this repository, or watch the Releases page.

Known limitations

These are stated plainly; see docs/android/PARITY.md.

• Device testing: automated device testing ran on an x86_64 emulator. Real-device feedback comes from early adopters like you, and reports are welcome.
• No content-process sandbox on Android: Gecko's content sandbox does not exist on Android. As of this release, Android's isolated processes are not used either (see above). Redoubt ships the same privacy configuration and Gecko security patches as LibreWolf desktop, on a platform with weaker process containment.
• DNS over HTTPS: DoH configuration from preferences doesn't apply. Use the DoH screen in Settings.
• Signing key: one person holds the signing key.

Provenance

• Source: built from 19f866ea81aee14352b1c041108eb180b47f4848 against Firefox 157.0.
• Build: CI run 37441476096, with MOZ_BUILD_DATE 20261006090000.
• Signing: signed by the maintainer; CI never sees the key.
• Evidence: docs/android/evidence/lw-m7-01/release-157.0-3/ and docs/android/evidence/video-playback/.