The Most Secure, Fastest, and Most Extensible Lightweight Browser

+------------------------------------------------------------------+
|                        eBrowser v2.0                              |
+------------------------------------------------------------------+
|  UI Layer          | Tab Manager | Bookmarks | Downloads | DevTools|
|  (LVGL-based)      | Reader Mode | Theme Engine | Split View      |
+--------------------+----------------------------------------------+
|  Extension Engine  | WebExtensions V3 | Content Scripts | Storage |
|                    | Alarms | Context Menus | WebRequest API       |
+--------------------+----------------------------------------------+
|  Privacy Engine    | Tracker Blocker | URL Cleaner | Cookie Policy |
|                    | Referrer Strip | GPC/DNT | Incognito/Tor Mode |
+--------------------+----------------------------------------------+
|  Security Fortress | Sandbox (seccomp/ns) | Memory Safety         |
|                    | App Firewall | Anti-Fingerprint | W^X        |
+--------------------+----------------------------------------------+
|  Performance       | Thread Pool | LRU Cache | HTTP/2 Mux         |
|                    | Prefetcher | Brotli/Zstd | Profiling          |
+--------------------+----------------------------------------------+
|  Network           | HTTP/HTTPS | TLS 1.3 | DoH/DNSSEC | CORS    |
+--------------------+----------------------------------------------+
|  Engine            | HTML5 Parser | CSS3 | DOM | Layout | JS      |
|                    | SVG | GPU Renderer                           |
+--------------------+----------------------------------------------+
|  Crypto            | SHA-256 | AES-128 | HMAC | PBKDF2 | TLS 1.3 |
+--------------------+----------------------------------------------+
|  Platform          | Linux | macOS | Windows | EmbeddedOS | Web   |
+------------------------------------------------------------------+

• seccomp-BPF syscall filtering - only whitelisted syscalls allowed
• Linux namespaces - PID, network, mount, user, IPC isolation
• Capability dropping - minimal privilege principle
• W^X enforcement - no memory region is both writable and executable
• Guard pages - memory access violations immediately caught

• Canary values (0xDEADC0DE) before/after every allocation
• Quarantine zone - freed memory held to detect use-after-free
• Double-free detection with source location tracking
• Memory zeroing on free - prevents data leakage
• Pool allocator - zero-fragmentation for hot paths
• Allocation tracking with file:line for every malloc

• Domain blocklist with wildcard matching (*.tracker.com)
• CIDR IP filtering (192.168.0.0/16)
• Rate limiting per domain (requests/sec, requests/min)
• HTTPS-only mode - automatic HTTP→HTTPS upgrade
• Non-standard port blocking
• Blocklist file loading (hosts format compatible)

• Canvas noise injection - random bits per pixel channel
• WebGL spoofing - fake vendor/renderer strings
• Font enumeration restriction - Tor Browser font list
• Timing attack mitigation - jittered performance.now()
• Screen normalization - report standard resolution
• User-Agent randomization per session
• WebRTC IP leak prevention
• Battery/Bluetooth/USB API blocking
• 4 protection levels: Off → Standard → Strict → Tor-like

• DNS-over-HTTPS (DoH) enabled by default
• DNSSEC validation
• DNS rebinding protection - blocks private IP responses
• DNS cache with TTL management
• Multiple DoH providers (Cloudflare, Google)

• CSP enforcement with all directives
• XSS sanitizer with 7 threat categories
• CORS validation
• Mixed content blocking
• HSTS support
• Cookie security (SameSite, HttpOnly, Secure flags)

• -fstack-protector-strong - stack buffer overflow protection
• -D_FORTIFY_SOURCE=2 - runtime buffer overflow checks
• -fPIE + -pie - Position Independent Executable (ASLR)
• -Wl,-z,relro,-z,now - Full RELRO (GOT hardening)
• -Wl,-z,noexecstack - Non-executable stack

eBrowser supports Chrome/Firefox-compatible extensions via Manifest V3:

• Manifest V3 parsing with full validation
• Content script injection with URL match patterns (<all_urls>, *://*.example.com/*)
• Background service workers
• Per-extension sandboxing with capability-based permissions
• Extension-to-extension messaging (ports + one-shot)
• WebRequest interception for ad blockers, privacy tools
• Hot-reload for extension development
• Blocklist-based extension security

• Configurable worker threads (auto-detect CPU cores)
• Priority-based task queue
• Parallel HTML parsing, CSS computation, layout, rendering

• Configurable max entries and memory limit
• TTL-based expiration
• O(1) get/put with doubly-linked list

• Multiple concurrent streams over single connection
• Header compression (HPACK)
• Stream prioritization

• Predictive prefetch of linked resources
• Priority-based queue with deduplication

• Brotli, Zstd, Gzip, Deflate support
• Automatic content-encoding detection

• EasyList/EasyPrivacy compatible filter syntax
• Cosmetic filtering (element hiding via CSS selectors)
• Domain anchoring (||tracker.com^)
• Resource type filtering (script, image, XHR, etc.)
• Exception rules (@@||allowed.com)
• Per-domain rules with include/exclude
• CNAME uncloaking support

Automatically strips 25+ tracking parameters: utm_source, utm_medium, utm_campaign, fbclid, gclid, msclkid, twclid, igshid, etc.

• Do Not Track (DNT) header injection
• Global Privacy Control (GPC) header
• First-Party Isolation - storage partitioned by origin

• Tab groups with color coding and naming
• Split view - side-by-side tab comparison
• Tab pinning - persistent tabs
• Tab hibernation - auto-sleep inactive tabs (saves memory)
• Tab search - find tabs by title/URL
• Recently closed - reopen closed tabs
• Tab duplication
• Per-tab muting and zoom control

• Folder hierarchy with drag-and-drop
• Tag-based organization
• Full-text search across titles and URLs
• HTML export/import (Netscape bookmark format)
• Visit tracking and frequency sorting

• Parallel downloads with configurable concurrency
• Pause/Resume support
• SHA-256 verification
• Auto-retry on failure
• Progress tracking with speed calculation

• Console - log, warn, error, info, debug levels
• Network monitor - request/response timing, sizes, caching
• DOM inspector - node highlighting and inspection
• Performance profiler - page load timing breakdown
• Preserve log across navigations

• Article extraction (Readability algorithm)
• 3 themes: Light, Dark, Sepia
• Customizable font size, line height, max width
• Reading time estimation
• Word count display

• Light/Dark/Auto mode (follows system preference)
• Custom accent colors
• High contrast mode for accessibility
• Reduced motion mode
• Force dark mode on all websites
• Custom CSS injection

git clone --recursive https://github.com/embeddedos-org/eBrowser.git
cd eBrowser
chmod +x setup.sh
./setup.sh                        # builds and opens the browser
./setup.sh https://example.com    # opens directly to a URL

Windows:

git clone --recursive https://github.com/embeddedos-org/eBrowser.git
cd eBrowser
setup.bat

eBrowser/
├── include/ebrowser/           # Public API headers (37 files)
│   ├── sandbox.h               # Process sandboxing
│   ├── memory_safety.h         # Hardened allocator
│   ├── firewall.h              # Application firewall
│   ├── anti_fingerprint.h      # Anti-fingerprinting
│   ├── dns_security.h          # DoH/DNSSEC
│   ├── extension.h             # WebExtensions V3
│   ├── privacy.h               # Privacy engine
│   ├── tracker_blocker.h       # Ad/tracker blocker
│   ├── perf.h                  # Performance engine
│   ├── tab_manager.h           # Advanced tabs
│   ├── bookmark.h              # Bookmarks
│   ├── download.h              # Downloads
│   ├── devtools.h              # Developer tools
│   ├── reader_mode.h           # Reader mode
│   ├── theme.h                 # Theme engine
│   ├── security.h              # CSP/XSS/CORS
│   ├── crypto.h                # Cryptography
│   ├── tls.h                   # TLS 1.2/1.3
│   ├── dom.h                   # DOM tree
│   ├── html_parser.h           # HTML5 parser
│   ├── css_parser.h            # CSS3 parser
│   ├── layout.h                # Layout engine
│   ├── render.h                # Renderer
│   ├── js_engine.h             # JavaScript engine
│   └── ...                     # + 13 more
├── src/
│   ├── security/               # Security fortress
│   │   ├── sandbox/            # seccomp, namespaces, W^X
│   │   ├── memory/             # Hardened allocator
│   │   ├── firewall/           # App-level firewall
│   │   ├── anti_fingerprint/   # Canvas/WebGL/font protection
│   │   ├── dns/                # DoH, DNSSEC
│   │   ├── security.c          # CSP, XSS, CORS
│   │   ├── crypto.c            # SHA-256, AES, HMAC
│   │   └── tls.c               # TLS 1.2/1.3
│   ├── extensions/             # WebExtensions V3 engine
│   ├── privacy/                # Privacy + tracker blocker
│   ├── perf/                   # Thread pool, cache, HTTP/2
│   ├── ui/                     # Tab mgr, bookmarks, devtools
│   ├── engine/                 # HTML, CSS, DOM, layout, JS
│   ├── render/                 # LVGL rendering backend
│   ├── network/                # HTTP, URL, cookies, cache
│   ├── browser/                # Browser UI shell
│   └── ...
├── tests/                      # Comprehensive test suite
├── docs/                       # Documentation & book
├── enterprise/                 # Docker, Helm, deployment
└── platform/                   # Platform abstraction layer

• 50,000x smaller codebase (~25K vs ~35M lines)
• 60x less memory per tab
• Built-in tracker blocker (no extension needed)
• Built-in anti-fingerprinting (no extension needed)
• Built-in application firewall (unique to eBrowser)
• Hardened memory with canary + quarantine + guard pages
• Runs on embedded devices (IoT, ARM, RTOS)

• 800x smaller codebase
• 40x less memory per tab
• Stronger anti-fingerprinting (Tor-level available)
• Built-in firewall with CIDR + rate limiting
• Memory safety beyond what Rust provides at runtime

• Similar privacy features, but lighter
• More extensible - full WebExtensions V3 API
• Application firewall - unique security layer
• Embedded support - runs on microcontrollers

• Equal anti-fingerprinting protection (Tor-like mode)
• More features - extensions, tab groups, bookmarks, devtools
• Faster - no Tor network overhead
• Smaller footprint

master is the line of development; every PR lands here. release is a rolling pointer to the latest released vX.Y.Z tag, updated automatically by .github/workflows/sync-release-branch.yml. Tags are immutable.

See embeddedos-org/.github/STANDARDS.md for the org-wide tag scheme, release model, and the compliance frameworks every product targets.

MIT License - see LICENSE for details.

eBrowser v2.0 - Built for security. Designed for speed. Made for everyone.

The web-app/ directory contains a full-featured Progressive Web App browser built with React 18 + TypeScript + Vite.

• Multi-tab management with drag-and-drop, pinning, muting, and tab groups
• Smart address bar with URL/search autocomplete and history suggestions
• 12 languages with full RTL support (Arabic, Hebrew, etc.)
• Privacy dashboard — tracker/ad blocking, HTTPS-only, DoH, GPC, DNT, anti-fingerprinting
• Password manager with encrypted storage
• Notes — in-browser note-taking linked to pages
• Reading List — save articles for later
• GPS & Location — full geolocation API integration
• DevTools — Console, Elements, Network, Storage, Sources, Debugger panels
• Extensions system — WebExtensions V3 compatible
• Command Palette (Ctrl+K) — quick command launcher
• Find in Page (Ctrl+F)
• Zen Mode — distraction-free fullscreen
• PWA — installable, offline-capable, push notifications

cd web-app
npm install
npm run dev        # Development server at http://localhost:5173
npm run build      # Production build to dist/
npm run preview    # Preview production build

The extension/ directory contains a Manifest V3 browser extension compatible with Chrome, Edge, Brave, and Firefox.

• Tracker blocking — 20+ tracker domains via declarativeNetRequest
• Ad blocking — 10+ ad network domains
• Privacy controls — GPC, DNT, HTTPS-only, DoH toggles
• Custom New Tab — Clock, search, quick sites
• Context menus — Save bookmarks, add to reading list, search selection
• Statistics — Trackers/ads blocked counter
• Keyboard shortcuts — Ctrl+Shift+E to open, Ctrl+Shift+P privacy toggle

Chrome / Edge / Brave:

1. Go to chrome://extensions
2. Enable Developer mode
3. Click Load unpacked → select extension/ folder

Firefox:

1. Go to about:debugging
2. Click This Firefox → Load Temporary Add-on
3. Select extension/manifest.json

The mobile/ directory contains a React Native + Expo mobile browser for Android and iOS.

• Full WebView browser with multi-tab support
• Smart address bar with URL/search
• Native navigation gestures (swipe back/forward)
• Share integration, geolocation, biometric auth
• Dark mode (system theme)
• Push notifications
• File downloads

cd mobile
npm install
npm start          # Expo development server
npm run android    # Android emulator
npm run ios        # iOS simulator (macOS required)

npm install -g eas-cli
eas login
eas build --platform android --profile production
eas build --platform ios --profile production
eas submit --platform android
eas submit --platform ios

Web App, Extension, and Mobile App added in v2.0 — EmbeddedOS Organization