Can e/ consider to change the webview for having a more secure one?

Is GeckoView can be an alternative/solution ?

GeckoView is not a system WebView provider.

It would technically be possible, but would require an extensive amount of work to actually make available all the necessary calls.

1 Like

Why not just use FireFox? Would broaden the appeal as well. Its important to remember, that if /e/ is to succeed, it cant be only for the tech savvy. When there are non-gogol mainstream alternatives, why not go for them?

@Macrophag You can’t replace the system WebView with Firefox.

btw another zero-day for Chromium was just announced, /e/OS WebView/browser known security vuln count is up to 274

4 Likes

Okay Ladies and Gentlemen, I just came across a method to get Bromite Webview unto the system without Magisk or the framework-res editing craziness.

[GUIDE]How to install Bromite SystemWebView without Magisk (Android 12+ included) | XDA Forums

Historically speaking I was never a fan of Magisk for a number of reasons. Didn’t start using it until /e/OS Pie on the Essential PH-1. Lineage SU was insufficient on a system-as-root setup (would not work with AdAway or Substratum for instance). With Pie and above, if one wanted root, Magisk was pretty much the only game in town.

On my Moto devices, where I was still multibooting, Magisk was definitely a no-go. When Bromite Webview changed package names I could only now use the updated vanilla/chromium webview. As mentioned earlier, we get WebRTC leaks and whatnot.

So I tried method 1 on crDroid Oreo, Moto G5s Plus sanders, non A/B SAR device. Has TWRP so adb wasn’t necessary. Flashing the zip didn’t work. No errors but I believe the zip expects system-as-root, treble compatible setup or something. The apk didn’t get installed to /vendor/overlay/.
Method 2, on the other hand, was a success. Manually placed the apk to the overlay location, bromite webview already installed as a user app. Now developer options showed both webviews. Selected Bromite and did WebRTC check. No leaks.

There you go, another way to possibly get Bromite WebView onto one’s system.

3 Likes

Thank you @marcdw.
I have a FP4, without root, so I think I can only wait this:

:crossed_fingers:

As far as I see, the second method uses Rooted Debugging. This isn’t plain root, it’s a switch in the Developer options which enables ADB to work as root if wanted or needed.
Not every /e/OS build might support Rooted Debugging, though, I’m not sure about the current status.

1 Like

Thank you for exaplaine for me. I did not understand and because of this I did not follow the link of @marcdw post. I have ADB root so I will try method 2 step by step.

Tried:
1 “Enable Rooted debugging by navigating to *Settings > Developer options > Rooted debugging.”
2 “Connect your phone to your PC and type”
then, after “adb root”, stop at:
3 “Mount the vendor folder: adb shell mount -o rw,remount /vendor”
with this message: “mount: ‘/dev/block/dm-11’->’/vendor’: I/O error”
:slightly_frowning_face:

Can you access or list the contents of /system/vendor/? If so you can try and use that location.
On my old device I believe /vendor is a symlink to /system/vendor (??).

1 Like

Hi @marcdw
I just look at the contents of system/vendor, there’s a link to vendor, not the opposite:

FP4:/system # ls -l
total 88
drwxr-xr-x  2 root root   4096 2009-01-01 01:00 addon.d
drwxr-xr-x  2 root root   4096 2009-01-01 01:00 apex
drwxr-xr-x 45 root root   4096 2009-01-01 01:00 app
drwxr-x--x  4 root shell  8192 2009-01-01 01:00 bin
-rw-------  1 root root   6297 2009-01-01 01:00 build.prop
drwxr-xr-x 17 root root   4096 2009-01-01 01:00 etc
drwxr-xr-x  2 root root   8192 2009-01-01 01:00 fonts
drwxr-xr-x  5 root root   4096 2009-01-01 01:00 framework
drwxr-xr-x  5 root root  12288 2009-01-01 01:00 lib
drwxr-xr-x  5 root root  20480 2009-01-01 01:00 lib64
drwxr-xr-x 45 root root   4096 2009-01-01 01:00 priv-app
lrw-r--r--  1 root root      8 2009-01-01 01:00 product -> /product
lrw-r--r--  1 root root     11 2009-01-01 01:00 system_ext -> /system_ext
drwxr-xr-x  7 root root   4096 2009-01-01 01:00 usr
lrw-r--r--  1 root root      7 2009-01-01 01:00 vendor -> /vendor

Tried also the first method (sideload Bromite flashable .zip), this the result:

adb sideload BromiteSystemWebViewOverlay.zip
adb: sideload connection failed: closed
adb: trying pre-KitKat sideload method...
adb: pre-KitKat sideload connection failed: closed

I will wait: stay with @GaelDuval new WebView is cooming soon.
Thank you and @AnotherElk for the attention.

I believe I see that kind of adb errors when sideloading (apply update?) was not started on the recovery side.
Maybe.

1 Like

Since a few days, my bank app tells me to install uptodate webview, and refuses to work.

Another issue with the webview is that it does not support css rotate property. Not dangerous, just not-so-good.

Small subsidiary question, what about the Webview update? Does anyone have any information on this subject?

in /e/ 1.7 or 1.8 it received the 108.0.5359 update, check the ch-dates.txt posted up the thread, it has the current state. /e/ lags a bit, but not as outrageously as before. With a better build pipeline chances are it will not lag as gravely as before (it should be a checklist item on every release). To keep an eye on things is looking at browser repo commits and the apk lfs repo when the resulting build is incorporated. The updating brought some issues with banking sites along but were fixed in 1.9. For 1.10 there are some string changes again, but no Chrome/Bromite version rebase. This is a sports report.

5 Likes

Thank you for those infos :slight_smile:

This might be old news. A Mulch WebView version of the item mentioned previously has been available for some time.

Hadn’t been following that thread so was unaware of it. Didn’t notice 'til something similar was posted in the FOSS Lovers Telegram group

GitHub - A4Alpha/mulch-webview-overlay: Easily install the security-hardened Mulch SystemWebView from DivestOS

Similar to the previous with the flashing and manual methods. A Magisk module is also available.
Like as before, the overlay works on my Oreo ROM as well as the later ones.
Good stuff.

2 Likes

Unfortunately, that method doesn’t work (/e/OS v1.13 on Fairphone 4, all prerequisites met: Treble Info reporting “Project Treble Supported”, rooted adb debugging enabled)

$ adb reboot recovery
[reboot, then Apply Update, then Apply from ADB]
$ adb sideload MulchSystemWebViewOverlay.zip
Total xfer: 1.00x
[reboot from adb recovery]
$ adb shell cmd webviewupdate set-webview-implementation us.spotco.mulch_wv
Failed to switch to us.spotco.mulch_wv, the WebView implementation is now provided by com.android.webview.

Same deal from the debugging settings.

Am I missing anything here about the GSI? I certainly never flashed a new one of those after verifying Treble support :upside_down_face:

It is not clear if all of the steps and checks have been done.

Can you verify that the overlay apk was placed in /vendor/overlay/.
I remember the zip never working for me so I would place the overlay manually and making sure it had correct permission (644 or rw-r-r).

Mulch WebView itself must be installed before it can be selected as a webview I figure (if you haven’t already). If overlay and webview are installed then ‘Mulch System WebView’ should be shown in Developer Options.