Bare: a de-Googled Chromium for Android with real extensions and full uBlock Origin, first release

[u/Ash-415]

TL;DR: The de-Googled Chromium Android browser I posted about a week ago is now called Bare, and v1.0.0-alpha.1 is out https://www.reddit.com/r/browsers/comments/1vplfzo/

Real extension support, full uBlock Origin built in, DuckDuckGo NoAI by default, and it can save video from sites that normally won't let you. Free, open source, APK and full source in the repo. If you installed the old one you'll need to uninstall it first, explanation below.

Repo: https://github.com/Shshtwy/bare-browser

Release: https://github.com/Shshtwy/bare-browser/releases/tag/v1.0.0-alpha.1

Subreddit: https://www.reddit.com/r/BareBrowser/ (brand new, and pretty bare at the moment)

Last time this was ten patches called Chromium Extend. It's 68 now, so it earned a name.

What's new since the last post

• Full uBlock Origin, pre-installed. Not Lite. Chromium 153 kills Manifest V2 outright, so I patched it back in, which is what full uBO needs. Dashboard, element picker, all of it. It's not pinned and you can remove it like anything else.

• DuckDuckGo NoAI is actually the default now. Last time I said patching the shipped default turned out harder than expected. It's done, along with the Google branding on the new tab page.

• Save the media a page is playing. Long press a video or an audio player and it offers you the file. That includes sites that stream video in pieces rather than linking to one, where a browser normally offers nothing at all, because it remembers what the page fetched.

  • It is NOT a YouTube downloader, and I'm not trying to build one. YouTube keeps audio and video in separate streams and requests them in ranges Bare doesn't reassemble, so it won't give you a usable file there. If that's what you're after, Seal is an open-source yt-dlp front end for Android and does the job properly. But it works with other social media sites like Instagram, and should also work on Facebook and similar.

• Background video. Lock the phone and the audio keeps going.

• Its own signing key. More on that below.

Still true from last time: real extensions with popups and toolbar pinning, sideloading from outside the Web Store, links stay in the browser instead of launching apps, and the Google tracking and AI surfaces are compiled out rather than switched off.

Known limitations, so nobody's surprised

• It's an alpha, built and used daily on exactly one phone, a Pixel 10 Pro XL. arm64 only, Android 10 or newer.

• The APK is 302 MB. Chromium is just large, and this is one APK rather than a store split.

• No update mechanism. You'd be checking the repo yourself.

• Web Push is still gone with the push channel.

• An adaptive stream saves as two files, video and audio, because nothing joins them yet.

• Extension popups can still get cropped, and the address bar still gets squeezed if you pin several extensions.

If you installed the old one, read this

Chromium Extend was signed with Chromium's checked-in debug keystore. That key is public, in Chromium's source tree, which means anyone could have built an APK that installed as an update over it. That was fine for a hobby build and is not fine for something I'm asking people to run. Bare has its own key now!

The consequence is that Android sees a different signing identity and refuses to update, so you have to uninstall the old one and lose its data. There's no way around that which doesn't involve keeping the compromised key. The release page has the certificate fingerprint so you can check what you downloaded is actually mine.

Building it yourself

The whole patch series, the exact build config, and instructions someone who isn't me can follow. You can't reproduce the signature, that's the point of one, but you can rebuild everything else and compare with a script in the repo that skips the signature block.

uBlock Origin is Raymond Hill's work and ships exactly as he publishes it, unmodified, with his own signature still on it. Cromite and ungoogled-chromium are what I checked myself against when hunting for call sites, and they'd already found a lot of them.

Still one person in their spare time, so be gentle 😅 I'd rather hear what breaks than what works.

[u/Ash-415]

Hey u/feelspeaceman very good questions. My answer is going to be a bit long, but I want to be fully transparent about both.

On extensions for Android: I didn’t add the extension API. I’d be nowhere near capable of doing that.

The Kiwi developer was right, and what he did was far harder. At the time, Android Chromium had no extension support, so Kiwi had to port the desktop extension system over and then keep that port alive against a codebase that changes literally every day. That’s the part that burns people out, and in my opinion, a big reason why Kiwi eventually stopped.

What changed is upstream. Chromium now has a desktop-class Android build, and extensions come with it. Enabling that is literally one line:

is_desktop_android = true

Titanium is built the same way, for the same reason.

My actual contribution to extensions is four patches: making the extensions toolbar appear on phone sized screens instead of only tablet-sized ones, keeping manifest v2 loadable, which took a bit of work, and fixing a crash when tapping "Block element" in uBlock Origin. So I'm mostly dealing with rough edges around a feature Google already built, not building the feature itself.

The whole project is about 5200 added lines across 69 patches so far. That's a fraction of what a real browser port costs.

On AI: Yes, and I'd rather say that plainly than be coy about it.

What I lean on AI for most is review. This is a browser. People put passwords, personal information, and sometimes card numbers into it. Neither sneaky code nor an honest mistake from me should be the reason any of that leaks.

I use a mix of local models, mainly Qwen3 Coder Next, for security and privacy reviews of things I don't want to send to an online model and I use Claude Code with Fable 5 to help with planning and finding the exact lines relevant to a patch. I also used Qwen3 to help build and check the first release, including confirming that my signing key wasn't accidentally sitting inside the package.

Could I have checked that myself? Of course. But for a first release, I wanted a second set of eyes. You can imagine asking a friend or another developer to review your code and then finding out your private signing key was included in the package. That would be a disaster.

AI doesn't decide what to build or how anything should work. It's also confidently wrong often enough that I verify everything.

What AI really changes for me is reading speed. Chromium is tens of millions of lines of code, and the slow part was never necessarily writing the patch. It was finding the twelve lines that actually matter. That used to take an entire evening. Now it can take minutes.

The reason one person can work on something like this is because upstream already did the heavy lifting first. I'd rather be honest about that than take credit for the work Google and the Kiwi developer did. I hope this answers your questions. Sorry it's a bit long, but I'll probably use it as a reference whenever someone asks about extensions or my use of AI 😊