v0.1.1

WWW > 0.1.1

Privacy

• App identifier blanked on every request. WebView tags every request with X-Requested-With: <package name> — a stable identifier that survives clearing cookies, changing the user agent, and incognito mode. www now blanks it for every request, including subresources (images, CSS, scripts, fonts), via WebView's profile-level custom-header API. Verified empty end-to-end. No exceptions, no toggle to turn it back on.
• User-agent spoofing now holds up under inspection. The UA templates (Chrome Android, Firefox Android, Desktop Safari, etc.) previously only rewrote the User-Agent string — the Sec-CH-UA client-hint headers still reported the real WebView engine underneath, so a site checking hints could see straight through the spoof. Each template now carries matching client-hint metadata.
• WebView usage-statistics upload to Google disabled, app-wide and unconditionally, regardless of the device's own diagnostics setting.
• data: page navigation blocked. A page (or the address bar) can no longer navigate to a data: URL as the whole document — the classic "paste this into your address bar" phishing shape, where the resulting page has no real origin for the URL bar to describe. Inline data: images and fonts are unaffected.

New

• Three light themes: Rosé Pine, Everforest, and Kanagawa — each with its own accent palette, alongside the existing System / Catppuccin / Dracula / Ptyxis 30+ set.
• Long-press menu for links and images: open in a background tab, or copy the address. Works the same on plain links and on images wrapped in a link (e.g. image search results).

Fixed

• The top bar's rounded corners no longer flash the wrong colour when switching pages, especially under force-dark or a slow-loading page.
• Settings now opens with every section collapsed, so it reads as an index instead of a wall of switches. Font Family and Text Size — previously two rows with no section header at all — now live under their own Text section.
• About now shows the installed version number.

Performance

• Removed a per-request string-allocation hot spot in the tracker blocker.
• The third-party-request check no longer re-derives the page's registrable domain on every subresource.
• Dropped a blanket ProGuard/R8 keep rule that exempted the entire Kotlin standard library from shrinking.

v0.1.0

www 0.1.0

First public release. www is a private, security-hardened Android browser built on
android.webkit.WebView, forked from RSS — the feed reader is
gone, replaced by a full browser built on the same encrypted-storage, biometric-lock foundation.

Highlights

• Sandboxed rendering, verified not assumed — the WebView renderer runs under a distinct
  Android UID (sandboxed_process0), confirmed directly on-device via process inspection, not
  taken on faith
• Encrypted local history and bookmarks — SQLCipher AES-256, passphrase-gated, never touches
  disk unencrypted
• App Lock — PIN, password, or pattern as an alternative to biometric-only, wrapping the real
  database passphrase rather than sitting in front of it as a UI-only gate
• Per-domain overrides — user-agent, JavaScript, cookies, and images can be set per-site,
  independent of global defaults
• Advanced Protection Mode aware — detects Android's device-wide Advanced Protection Mode
  (API 36+) and locks Safe Browsing, Force HTTPS Only, Block Downloads, and Screenshot Protection
  on while it's active
• Local network access closed by default — no ACCESS_LOCAL_NETWORK declared (Android 17+),
  verified live: page content cannot reach the device's own LAN or router at all

Privacy controls

• Block third-party requests, per-toggle
• Strip tracking parameters (utm_*, fbclid, gclid, and similar) from every URL before load
• Choice of DNS-over-HTTPS resolver (Cloudflare 1.1.1.1 by default)
• Incognito mode — cookies, storage, and cache wiped after every page load, not just on close
• Granular clear-on-exit (cookies, site data, cache, this app's own logcat buffer, independently)
• IDN homograph protection — punycode conversion and script-mixing detection against lookalike
  domains
• Site Info panel — tap the address-bar shield for certificate issuer, validity dates, and
  per-page blocked-request count
• Block Downloads — refuse all file downloads outright, matching the AOSP reference WebView
  shell's behaviour

Security

• Camera, microphone, and geolocation denied outright — no per-site prompt, because nothing is
  ever declared to grant
• No JavaScript bridge exposed to page content
• allowFileAccess/allowContentAccess disabled — pages cannot reach local files
• network-security-config trusts system CAs only — rejects user-installed CAs, closing the
  common MITM-via-sideloaded-certificate path most browsers leave open
• Cleartext traffic forbidden at the OS level, independent of the in-app HTTPS-only toggle
• StrongBox / TEE hardware key isolation on supported devices; AES-256-GCM via Google Tink
• Signing-certificate tamper detection — refuses to run if re-signed with an unexpected key
• R8/ProGuard minification and resource shrinking enabled; reflection-dependent libraries
  (SQLCipher, Tink, Room, EncryptedSharedPreferences) verified to survive shrinking intact

Appearance

• Themes: System / Catppuccin / Dracula / Ptyxis, multiple accent palettes
• Force-dark web content, wide viewport, swipe-to-refresh
• Collapsible Settings sections

Known limitations

• No extensions, no about:config, no true per-profile incognito storage isolation — inherent to
  building on WebView rather than a standalone engine
• Request interception limited to shouldInterceptRequest (no POST body access, no net-stack
  hooks)
• No find-in-page, no filter-list (EasyList/EasyPrivacy) parsing, no certificate pinning, no
  Tor/Orbot proxying yet

Requirements

Android 13+ (minSdk 33). Built against compileSdk 37 / targetSdk 37.

---