Privacy Browser 3.7 has been released. It includes a major refactor of how Privacy Browser interacts with the Android file system. Beginning with Android 11 (API 30), Android is enforcing new storage restrictions called scoped storage. Under scoped storage, the Storage Access Framework allows apps to access files without requiring the READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE permissions. It does this by requiring that every interaction with a file requires the user to directly interact with a system UI to grant access for that action. This means that the user needs to press the Browse button for every download or other file action. It also means that the default download location was removed from the settings as it now no longer has any function.

The URIs returned by the system browser start with content:// instead of being direct file paths.

With the change to using the Storage Access Framework, Privacy Browser can bump the target API to 30 and remove the READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE permissions. This has been an important goal for a while, and I am quite pleased to finally accomplish it. If a webpage were to exploit a weakness in Privacy Browser and run arbitrary code (in almost all cases, this would be because of a flaw in the JavaScript engine—don’t run JavaScript on untrusted websites), then previously it could read and write any public file on the phone. Now it would be limited to the information that is available to Privacy Browser unless it were also able to exploit a separate bug in the Android OS to gain system level permissions. Defense in depth.

Unfortunately, WebView’s save web archive functionality does not currently support the Storage Access Framework. As such, that feature has been temporarily removed from Privacy Browser. I have submitted a couple of bug reports to Google. Hopefully it is something they choose to address.

About > Permissions has been updated to reflect the change in permissions, as well as to update the list of permissions automatically added by AdMob for the free flavor. Quoting from the updated text:

Run at startup
android.permission.RECEIVE_BOOT_COMPLETED

Lets AdMob start when the phone boots even if you don’t open Privacy Browser Free. This is a concerning permission because it can allow Google to spy on you. I would either like to find a different ad provider or drop the free flavor of Privacy Browser entirely.

When downloading files, the snackbar used to display the download percentage and the file path. With the change to the Storage Access Framework, the file path is now nearly useless. Hence, the snackbar has been updated to display the download percentage, the downloaded and total bytes, and the URL being downloaded.

MetaGer has been added to the list of search engines. There is also a feature request to consider making it the default homepage and search engine, but it does not yet rise to that level, as described in the feature request itself. Those interested in this decision process will also be interested in reading the requirements for being included in the list of search engines.

A bug was fixed that caused Privacy Browser to use the installation status of Orbot to determine whether to display the warning about I2P not being installed. Hence, if a user had installed I2P but not Orbot, they would still see this error message when attempting to proxy via I2P.

Previously, in dialogs with radio groups, the icons and the radio buttons were misaligned if the descriptive text wrapped to multiple lines. That has been fixed.

The URL bar is now updated when switching tabs even if it is currently being edited. This used to cause problems if the URL was being edited, then Privacy Browser was placed in the background and a URL was loaded from another app that created a new tab in Privacy Browser.

The password can now be displayed in the HTTP authentication dialog.

A number of rare crashes were fixed. Also, a bug was fixed that caused the navigation menu hamburger menu to turn into an arrow if the drawer was opened when the app was restarted.

The main options menu code was optimized so it can open more quickly.

The Brazilian Portuguese translation was updated by Thiago Nazareno Conceição Silva de Jesus, the French translation was updated by Kévin L. The German translation was updated by Bernhard G. Keller. The Italian translation was updated by Francesco Buratti. The Spanish translation was updated by Jose A. León. The Russian translation was also updated.

The next release of Privacy Browser will (as long as I can make it work well) include the option to move the app bar to the bottom of the screen.