# ============================================================================
# Chromium Hardened Flags -- Place at ~/.config/chromium-flags.conf
# Or launch: chromium $(cat ~/.config/chromium-flags.conf | tr '\n' ' ')
# ============================================================================

# --- PRIVACY / TELEMETRY ---
--disable-background-networking             # no background network requests
--disable-breakpad                          # no crash reporting
--disable-client-side-phishing-detection    # no Google phishing detection
--disable-default-apps                      # no default app installs
--disable-domain-reliability                # no domain reliability monitoring
--disable-extensions-except=""              # allow only whitelisted extensions
--disable-hang-monitor                      # no hang detection reporting
--disable-sync                              # no Google sync
--disable-translate                         # no Google Translate
--disable-wake-on-wifi                      # no WiFi wake
--no-pings                                  # no hyperlink auditing pings
--no-first-run                              # no first-run wizard
--metrics-recording-only                    # record but dont send metrics

# --- FINGERPRINTING ---
--disable-reading-from-canvas               # block canvas fingerprinting
--disable-webgl                             # disable WebGL (fingerprint vector)
--disable-3d-apis                           # no 3D APIs
--disable-speech-api                        # no speech recognition
--disable-notifications                     # no push notifications

# --- WEBRTC (IP leak prevention) ---
--disable-webrtc-hw-decoding               # no WebRTC hardware decode
--disable-webrtc-hw-encoding               # no WebRTC hardware encode
--enforce-webrtc-ip-permission-check       # require permission for WebRTC IP
--webrtc-ip-handling-policy=disable_non_proxied_udp  # prevent IP leaks

# --- NETWORK ---
--disable-background-timer-throttling       # no background throttling
--dns-over-https-mode=secure               # force DNS over HTTPS
--dns-over-https-templates=https://dns.quad9.net/dns-query  # Quad9 DoH

# --- SECURITY ---
--disable-features=AutofillServerCommunication  # no autofill server calls
--disable-features=MediaRouter              # no Cast/media routing
--block-new-web-contents                    # block popups
--site-per-process                          # strict site isolation
--enable-strict-mixed-content-checking      # block mixed content

# --- PERFORMANCE ---
--process-per-site                          # one process per site
--disk-cache-size=52428800                  # 50MB disk cache max

# --- PROXY (uncomment one) ---
# --proxy-server="http://127.0.0.1:8080"   # Burp Suite
# --proxy-server="socks5://127.0.0.1:9050" # Tor
# --proxy-auto-detect                      # auto-detect proxy

# --- ADDITIONAL HARDENING (from Vanadium/ungoogled-chromium) ---
--disable-client-hints                      # disable UA Client Hints (fingerprint reduction)
--disable-crash-reporter                    # no crash data transmission
--disable-component-update                  # no background component updates
--disable-component-extensions-with-background-pages  # no Google background extensions
--disable-domain-reliability                # no domain reliability measurements to Google
--disable-external-intent-requests          # block external intent requests
--disable-file-system                       # restrict FileSystem API access
--disable-hang-monitor                      # no hang detection reporting
--disable-speech-api                        # no speech recognition API
--deny-permission-prompts                   # deny all permission requests by default
--site-per-process                          # strict site isolation per origin
--enable-features=BlockInsecurePrivateNetworkRequests  # block private network access from public sites
--enable-features=EncryptedClientHello      # TLS 1.3 encrypted client hello

# --- PENTESTING ---
--allow-insecure-localhost                  # allow insecure localhost
--ignore-certificate-errors-spki-list=""    # for testing with self-signed certs