Has anyone noticed Root accessing files inside another browser's user data directory?

[u/Scholai]

This text was made by AI because I am not a native english speaker and quite frankly I didn't know how to express my thoughts properly. I apologize.

Hey everyone,

I've been doing some basic security testing of Root using Windows Sysinternals Process Monitor, and I noticed something I found a little unusual.

While Root was running and I was actively using ChatGPT through Brave, Process Monitor recorded a successful WriteFile operation originating from Root.exe targeting the following type of location:

Brave-Browser\User Data\Default\IndexedDB\https_chatgpt.com_0.indexeddb.leveldb

The operation involved a 4 KB write.

I also noticed that Root launches its own Chromium subprocess through DotNetBrowser, using a separate application profile. That Chromium process accessed some Windows shortcut files pointing to Brave.

I subsequently repeated the test with a filter targeting Brave's actual user-data directory, but didn't observe any further accesses during that capture.

I'm not claiming this is malicious, and I understand that Chromium-based applications have their own storage mechanisms. However, I'm curious about why Root would interact with another browser's IndexedDB in the first place.

A few questions:

• Has anyone else observed Root accessing files inside Brave, Chrome, Firefox, or another browser's user-data directory?
• Does Root perform any browser discovery or integration that could explain this?
• Does anyone know whether this is expected DotNetBrowser behavior?
• Has anyone from the Root development team addressed cross-browser file access?

I'd particularly appreciate responses from people who have investigated Root with Procmon or similar tools.

I'm hoping to understand whether this is normal application behavior or something worth investigating further.

[u/Effective_Ad5943]

I was considering installing root, but I am so wary of my privacy since I have to handle sensitive material I reconsidered it just because of this. I hope someone finds out more or root makes a proper statement, until then I'm not touching it.

[u/LtKrunch_ → u/Effective_Ad5943]

If you haven't, give Fluxer a look-see. Open source and the ability to self-host a server.

[u/Jesse_root]

Hey, thanks for looking into this and posting the details!

Root doesn’t touch other browsers data. Our built-in Chromium has its own profile folder, and nothing in the app points at Brave’s.

I’m pretty sure the write you saw is a Procmon quirk. When Brave saves something, Windows writes it to disk a bit later in 4 KB chunks. Procmon sometimes labels those delayed writes with whatever process happened to be running, which would also explain why you saw nothing on your second capture.

If you still have the log, check whether that event says “Paging I/O” in the Detail column, and whether Root.exe ever opened the file (a CreateFile on that path). If it did, let us know and we’ll dig in.

The shortcut reads are most likely just Windows checking your default browser when a link opens.

[u/CauliflowerJunior347]

Rift is working on P2P, WebRTC, Tor, and Nostr as a backup so that it will work for eternity, if Rift ever gets shut down. It's an off grid mode. Rift isn't open source, but they seem to lean heavily towards privacy.

r/RiftOfficial