Growser 153.26.912.0

Growser 153.26.912.0 — Chromium 153.0.8010.37.

A security update: it carries the V8 fixes for CVE-2026-85046 and CVE-2026-87491, both exploited in the wild, which the previous build (Chromium 153.0.8010.18) does not.

macOS (Apple Silicon) — signed with a Developer ID, notarized and stapled.

• Growser-mac-arm64.dmg — the download. Mount it and drag the app to Applications.
• Growser-mac-arm64.zip — the Sparkle auto-update enclosure; extracted by anything other than Sparkle it loses its seal.

Installed browsers take this automatically over the stable-arm64 feed.

Growser 153.26.909.0

Growser 153.26.909.0 — Chromium 153.0.8010.18.

macOS (Apple Silicon) — signed with a Developer ID, notarized and stapled.

• Growser-mac-arm64.dmg — the download. Mount it and drag the app to Applications.
• Growser-mac-arm64.zip — the Sparkle auto-update enclosure. It is not a manual-download artifact: extracted by anything other than Sparkle it loses its seal.

Installed browsers take this automatically over the stable-arm64 feed.

Growser 153.26.905.1

macOS build on Chromium 153.0.8010.18, signed with Developer ID, notarized and stapled. From fork commit 54ede1d.

Tor works on macOS. The client and its transports are components of ours now, served from backend.growser.org, and the browser offers a Tor window again (growser#163, growser#164). Verified end to end: the component installs at 0.4.9.11, tor runs from it, and check.torproject.org answers 'Congratulations. This browser is configured to use Tor.'

Also in this build:

• the sidebar's legacy block no longer scrolls when the window is short - pinned tabs move to the tabstrip instead (growser#182)

• the active pinned tab's green glow is gone from the light theme; the bar stays (growser#183)

• a pinned new tab page draws the same icon in the sidebar as in the tabstrip (growser#186)

• the About page's Revision names the commit this binary was built from (growser#169)

• Growser-mac-arm64.dmg - the download for people.

• Growser-mac-arm64.zip - the Sparkle auto-update payload, not a manual download (extracting it with Archive Utility breaks the seal, growser#167).

Growser 153.26.905.0

macOS build on Chromium 153.0.8010.18, signed with Developer ID, notarized and stapled.

• Growser-mac-arm64.dmg - the download for people. Mount it and drag Growser to Applications.
• Growser-mac-arm64.zip - the Sparkle auto-update payload; not a manual-download artifact (extracting it with Archive Utility breaks the seal - see growser#167/brave#170).

Both carry the same notarized build, from fork commit 8698252.

Growser 152.26.831.0

The first OFFICIAL Windows build: the full shipping optimization tier (DCHECKs off, PGO with V8 builtins profiles, ThinLTO opt 2, is_official_build) with Growser install identity everywhere (brave#120, brave#128). Speedometer 3.1 on the reference machine: 6.06 -> 42.7, at parity with stock Chrome and Brave of the same milestone. Plus the reviewed NTP icon pack (brave#96), the warm instant New Tab Page (brave#119), and ~14 MB of dead code and media out of the paks (brave#112, brave#116, brave#121, brave#125-brave#127).

Windows ships through the Microsoft Store; GrowserSetup.exe here is the open-source verification artifact (build from source and compare). The macOS assets are carried over from v152.26.826.0 under their stable names per the release rule; the mac session will replace them when its mirror build (brave#129) lands.

Growser 152.26.905.0

macOS build (Apple Silicon), notarized and stapled.

The clean-quit fix (brave#167). Until now the Sparkle update payload carried a broken code-signature seal, so the installed browser took a minute to quit behind a spinner, recorded every clean quit as exit_type=Crashed, offered tab restore as if it had crashed, and left crash dumps behind.

The cause was in how the update archive was packed, not in the browser: the app is copied out of the mounted DMG, a DMG is an HFS+ image where every file carries Finder info in its catalog, and cp/ditto preserve it. codesign --verify --deep --strict refuses a bundle carrying it. The DMG download path was never affected - Finder does not carry that field across when you drag the app out.

Also in this build:

• A manual update check no longer depends on the About page: Sparkle checks shortly after launch, so restarting is a way out of a stale build (brave#168).
• The About page itself no longer crashes (brave#161) - it was the only manual update trigger, which is what made updates undeliverable together with the above.
• Official-build packaging no longer embeds a provisioning profile that never existed for this fork (brave#172).
• The macOS keychain item is ours - "Growser Safe Storage" - migrated once from the pre-rebrand item so saved passwords keep decrypting (brave#138).
• The encryption promo sits in the bottom-right offer corner instead of covering the search box (brave#118).
• The first new tab page shows its default search engine right away (brave#138).

Windows ships through the Microsoft Store.

Growser 152.26.901.0

macOS build (Apple Silicon), notarized and stapled.

Performance: the full shipping recipe lands on both platforms (brave#120) - DCHECKs off, PGO from Chromium public profiles, ThinLTO at opt level 2. Speedometer 3.1 on an M-series Mac: 7.93 -> 47.6 (peers ~41-51 on the same machine).

Fixes (the first-launch bug batch, brave#138):

• The macOS keychain item is ours now - "Growser Safe Storage", with a one-time migration from the pre-rebrand item so saved passwords keep decrypting (brave#138).
• The encryption promo no longer covers the NTP search box - it is a bottom-right offer card (brave#118).
• The first NTP of a fresh profile shows the default search engine right away (TemplateURLService load race, brave#138).
• The warm NTP preload (brave#119) is verified on macOS; the engine list no longer races its load (brave#123).
• check-brave-hosts now actually scans macOS binaries (it silently skipped before) - 2 Google endpoints left with the local_ai removal.

The NTP opens warm: a pre-rendered new tab page is adopted on the first [+].

Windows ships through the Microsoft Store; GrowserSetup.exe for this version follows with the Windows build cycle.

Growser 152.26.826.0

Российские банки снова открываются.

Западные удостоверяющие центры отозвали сертификаты российских банков, и Сбер, ВТБ, ПСБ, Россельхозбанк, Открытие, Совкомбанк и другие перешли на корень НУЦ Минцифры. Без доверия к нему браузер эти сайты просто не открывал.

Growser теперь ему доверяет — но только для списка из 4682 доменов, собранного из публичных журналов сертификатов. За пределами списка этот корень не подтверждает ничего, поэтому подменить им произвольный сайт нельзя. Это важное отличие от популярного совета «поставьте корень в системное хранилище»: там он становится действителен для любого домена.

Если сайт на таком сертификате всё же не открылся, страница ошибки теперь объясняет, почему именно, и просит написать нам — список пополняется.

Блокировщик заработал в полную силу. Четыре механизма, которые молчали с самого начала, ожили:

• вырезание трекинговых параметров из ссылок — fbclid, gclid и ещё под семьдесят;
• скриптлеты, без которых часть правил в списках фильтров ничего не делала;
• пропуск редиректоров-трекеров: переход происходит сразу на нужный сайт, к промежуточному браузер не обращается вовсе;
• каталог списков фильтров в настройках: 62 списка, включаются и работают.

Один логотип везде — в панели задач, в меню, в настройках и на экране приветствия. До этого их было три разных.

Установщик не подписан — Windows покажет предупреждение SmartScreen один раз.

sha256 GrowserSetup.exe: 7a0777459864ed25d11775dac56b4fcc514e4ecf62b18b98eabde677f999dad8

Tor client component 0.4.9.11

The Tor client Growser installs as a component (growser#157).

Repackaged from the Tor Project's Tor Expert Bundle for Windows x86_64, version 15.0.21, verified before packing: the bundle's sha256 matches their signed checksum list, and that list's signature is theirs (Tor Browser Developers, EF6E286DDA85EA2A4BA7DE684E2C6E8793298290).

• Tor 0.4.9.11
• component id magogemiibiafhlbpenemlaomhplhiok
• CRX sha256 15ce9c9f35482fd09e6288f7224be05afd9725959a3750d5bef391d5cc1cb013

Built by scripts/make-tor-component.py. Users never fetch this URL directly - backend.growser.org/crx/ proxies it.

Icon pack 26.908.2

Growser icon pack component, version 26.908.2.

Gmail is one brand again (growser#190): mail.google.com was drawn as a brand of
its own beside gmail.com - two drawings, two tile colours, one service wearing
two faces on the same board. The curation now groups them, and the grouping is
honoured for service hosts, which it was not before.

590 brands over 695 domains, 518 drawings.