Can e/ consider to change the webview for having a more secure one?

Thank you for exaplaine for me. I did not understand and because of this I did not follow the link of @marcdw post. I have ADB root so I will try method 2 step by step.

Tried:
1 “Enable Rooted debugging by navigating to *Settings > Developer options > Rooted debugging.”
2 “Connect your phone to your PC and type”
then, after “adb root”, stop at:
3 “Mount the vendor folder: adb shell mount -o rw,remount /vendor”
with this message: “mount: ‘/dev/block/dm-11’->’/vendor’: I/O error”
:slightly_frowning_face:

Can you access or list the contents of /system/vendor/? If so you can try and use that location.
On my old device I believe /vendor is a symlink to /system/vendor (??).

1 Like

Hi @marcdw
I just look at the contents of system/vendor, there’s a link to vendor, not the opposite:

FP4:/system # ls -l
total 88
drwxr-xr-x  2 root root   4096 2009-01-01 01:00 addon.d
drwxr-xr-x  2 root root   4096 2009-01-01 01:00 apex
drwxr-xr-x 45 root root   4096 2009-01-01 01:00 app
drwxr-x--x  4 root shell  8192 2009-01-01 01:00 bin
-rw-------  1 root root   6297 2009-01-01 01:00 build.prop
drwxr-xr-x 17 root root   4096 2009-01-01 01:00 etc
drwxr-xr-x  2 root root   8192 2009-01-01 01:00 fonts
drwxr-xr-x  5 root root   4096 2009-01-01 01:00 framework
drwxr-xr-x  5 root root  12288 2009-01-01 01:00 lib
drwxr-xr-x  5 root root  20480 2009-01-01 01:00 lib64
drwxr-xr-x 45 root root   4096 2009-01-01 01:00 priv-app
lrw-r--r--  1 root root      8 2009-01-01 01:00 product -> /product
lrw-r--r--  1 root root     11 2009-01-01 01:00 system_ext -> /system_ext
drwxr-xr-x  7 root root   4096 2009-01-01 01:00 usr
lrw-r--r--  1 root root      7 2009-01-01 01:00 vendor -> /vendor

Tried also the first method (sideload Bromite flashable .zip), this the result:

adb sideload BromiteSystemWebViewOverlay.zip
adb: sideload connection failed: closed
adb: trying pre-KitKat sideload method...
adb: pre-KitKat sideload connection failed: closed

I will wait: stay with @GaelDuval new WebView is cooming soon.
Thank you and @AnotherElk for the attention.

I believe I see that kind of adb errors when sideloading (apply update?) was not started on the recovery side.
Maybe.

1 Like

Since a few days, my bank app tells me to install uptodate webview, and refuses to work.

Another issue with the webview is that it does not support css rotate property. Not dangerous, just not-so-good.

Small subsidiary question, what about the Webview update? Does anyone have any information on this subject?

in /e/ 1.7 or 1.8 it received the 108.0.5359 update, check the ch-dates.txt posted up the thread, it has the current state. /e/ lags a bit, but not as outrageously as before. With a better build pipeline chances are it will not lag as gravely as before (it should be a checklist item on every release). To keep an eye on things is looking at browser repo commits and the apk lfs repo when the resulting build is incorporated. The updating brought some issues with banking sites along but were fixed in 1.9. For 1.10 there are some string changes again, but no Chrome/Bromite version rebase. This is a sports report.

5 Likes

Thank you for those infos :slight_smile:

This might be old news. A Mulch WebView version of the item mentioned previously has been available for some time.

Hadn’t been following that thread so was unaware of it. Didn’t notice 'til something similar was posted in the FOSS Lovers Telegram group

GitHub - A4Alpha/mulch-webview-overlay: Easily install the security-hardened Mulch SystemWebView from DivestOS

Similar to the previous with the flashing and manual methods. A Magisk module is also available.
Like as before, the overlay works on my Oreo ROM as well as the later ones.
Good stuff.

2 Likes

Unfortunately, that method doesn’t work (/e/OS v1.13 on Fairphone 4, all prerequisites met: Treble Info reporting “Project Treble Supported”, rooted adb debugging enabled)

$ adb reboot recovery
[reboot, then Apply Update, then Apply from ADB]
$ adb sideload MulchSystemWebViewOverlay.zip
Total xfer: 1.00x
[reboot from adb recovery]
$ adb shell cmd webviewupdate set-webview-implementation us.spotco.mulch_wv
Failed to switch to us.spotco.mulch_wv, the WebView implementation is now provided by com.android.webview.

Same deal from the debugging settings.

Am I missing anything here about the GSI? I certainly never flashed a new one of those after verifying Treble support :upside_down_face:

It is not clear if all of the steps and checks have been done.

Can you verify that the overlay apk was placed in /vendor/overlay/.
I remember the zip never working for me so I would place the overlay manually and making sure it had correct permission (644 or rw-r-r).

Mulch WebView itself must be installed before it can be selected as a webview I figure (if you haven’t already). If overlay and webview are installed then ‘Mulch System WebView’ should be shown in Developer Options.

Yeah, looks like the Installation guide I followed didn’t drop the overlay APK into /vendor/overlay or /system/product/overlay.

Trying the Manual installation guide, I find I’m not able to remount /vendor as rw:

$ adb shell mount -o rw,remount /vendor
mount: '/dev/block/dm-11'->'/vendor': I/O error
$ adb shell mount | grep ' /vendor '
/dev/block/dm-11 on /vendor type ext4 (ro,seclabel,relatime,discard)

so that’s kind of a no-go as well. Same thing with /.

On my Teracube 2e emerald trying to do something unrelated to webview, while in the ROM, I found I was unable to mount system, vendor, or product. I use the dev builds and even adb remount failed to mount those three. Didn’t think to try remounting / rw at the time. Seems to work for some.
In recovery, however, I found I was able to mount /system via /mnt. In fact I believe they were all already mounted/visible under that location.

So maybe something like
adb shell mount -o rw,remount /mnt/vendor ??