A browser, built well

What it is

A web browser for the desktop. It is written in C against GTK 4 and libadwaita, and it renders pages with WebKitGTK, the same engine that Safari and most other GTK browsers use. It has tabs, a history, bookmarks, a private mode, a password manager, a reader mode, a built-in ad blocker, web apps, and Firefox Sync.

There is no account to make, no telemetry, and nothing running in the background that you did not ask for.

Where it comes from

GNOME Web is a good browser and a well-run project, and this one is built on it. Upstream, WebExtension support was experimental: it was hidden behind a setting, and the code behind it had a number of problems that turned up as soon as an extension was actually installed and used.

The work here is on the parts that needed it. Where a fix belongs upstream, it is sent upstream; the changes made here are recorded in the NOTICE file, as the GPL asks, and the original copyright notices are still in the source.

If none of the differences below matter to you, GNOME Web is worth using.

What we've changed

WebExtensions are on by default, and the Extensions page has a switch to turn them off again. The extension implementation was read through and fixed. The most serious things found were a JavaScript injection in downloads.search(), where a filename with a quote in it could run code in the user interface process, a path traversal in downloads.download(), where a filename of ../../foo could be written outside the Downloads directory, and the extension API being installed in cross-origin frames, which would have handed the extension's identity to the page embedding it.

The application ID, the executable name and the profile directory changed too, so that a SparkyBin Browser installation and a GNOME Web installation on the same machine do not share history, cookies, bookmarks or extensions.

The extension code is not finished. Manifest V3 is not supported, storage.onChanged is missing, and the architecture write-up in the repository says what is known to be broken.

Where it is going

0.1 is the first release of SparkyBin Browser. It is a working browser with the fixes in it, not a finished product, and the icon and the screenshots are still placeholders. The plan for what comes next is in PLAN.md in the repository.

If something is missing or broken, the issue tracker is the place to say so.