Hot Take Zephium

[AFEH]

Zephium is an open-source browser built in Rust on your operating system's own web engine: WebKit on macOS, the engine Safari uses, and WebView2 on Windows.

It is not a fork of Chromium or Firefox.

It blocks ads and trackers natively, runs Chrome extensions, and puts tasks, notes and your time on the web one click away.

The download is about 30 MB.

GitHub - zephium-browser/Zephium: A fast, fully-featured browser and work environment reimagined for you and your agents

A fast, fully-featured browser and work environment reimagined for you and your agents - zephium-browser/Zephium

github.com

 

[LinuxFan58]

Interesting I asked AI to explain the difference between Chromium and Zephium security architecture on Windows.

I got a long read as answer, so here is TLDR extract

When I asked what about's Zephium using Rust as programming language which has the memory integrity advantage over c++

Okay but what about the attack surface, Zephium code base is 1/20 of Chromium?

And finally because WebView/2 is a Windows component would the OS-aware part of Microsoft Defender (what always runs no matter what Antivirus people have installed) have more access to WebView2 than to Chrome (or Chromium)?

So it is 9/10 for Chrome versus 8/10 for Zephium

 

[AFEH]

Interesting I asked AI to explain the difference between Chromium and Zephium security architecture on Windows.

I got a long read as answer, so here is TLDR extract
View attachment 300888

When I asked what about's Zephium using Rust as programming language which has the memory integrity advantage over c++
View attachment 300889
Okay but what about the attack surface, Zephium code base is 1/20 of Chromium?
View attachment 300890
And finally because WebView/2 is a Windows component would the OS-aware part of Microsoft Defender (what always runs no matter what Antivirus people have installed) have more access to WebView2 than to Chrome (or Chromium)?
View attachment 300891

So it is 9/10 for Chrome versus 8/10 for Zephium

Apart from Chrome and Edge, all the remaining browsers, including Brave, are vunlerable to sudden death.
I have only those two on my PC.

 

[Sunshine-boy]

This zephium is a promising project, but I wouldn’t call it daily driver secure yet. Tauri + OS WebView gives a much shorter path from a WebView exploit to the privileged core than Chromium’s multiprocess sandbox and Site Isolation, and a solo maintainer can’t match Chromium’s patch cadence. Good idea, but for banking/email I’d stick with Chromium until it has signed builds, a strict Tauri capability config, Evergreen WebView2, and a clear patch SLA.

On the user side, you could at least apply Windows Defender Exploit Protection rules to msedgewebview2.exe enabling CFG, Strict CFG, ASLR, DEP, and blocking child process creation which makes the WebView process harder to exploit even if a bug exists. But that’s a band aid, not a fix; it doesn’t change the architecture.

Ladybird

Ladybird is a truly independent web browser, backed by a non-profit.

ladybird.org

I'm waiting for this.

 

[AFEH]

but for banking/email I’d stick with Chromium

for those, Chrome and Edge, exclusively.
for the rest, I may play with any third browser.

 

[LinuxFan58]

This zephium is a promising project, but I wouldn’t call it daily driver secure yet. Tauri + OS WebView gives a much shorter path from a WebView exploit to the privileged core than Chromium’s multiprocess sandbox and Site Isolation, and a solo maintainer can’t match Chromium’s patch cadence. Good idea, but for banking/email I’d stick with Chromium until it has signed builds, a strict Tauri capability config, Evergreen WebView2, and a clear patch SLA.

On the user side, you could at least apply Windows Defender Exploit Protection rules to msedgewebview2.exe enabling CFG, Strict CFG, ASLR, DEP, and blocking child process creation which makes the WebView process harder to exploit even if a bug exists. But that’s a band aid, not a fix; it doesn’t change the architecture.

Ladybird

Ladybird is a truly independent web browser, backed by a non-profit.

ladybird.org

I'm waiting for this.

Good idea and only allowing DLL's signed by Microsoft, WebView can also be run in AppContainer. Depends how Tauri has implemented it:

But IMO all second thoughts mentioned by Sunshine-boy are valid and would prevent me from using Zephium as my primary browser.
I use the much simpler (compared to Brave) Web Gnome Browser in flatpak as secondary (in Linux Mint).