#!/bin/sh
# launch-hardened.sh -- Launch Chromium with all hardening flags
# Usage: ./launch-hardened.sh [additional-args]

CHROME_BIN="${CHROME_BIN:-/usr/bin/chromium}"

exec "$CHROME_BIN" \
  --disable-background-networking \
  --disable-breakpad \
  --disable-crash-reporter \
  --disable-default-apps \
  --disable-extensions-file-access-check \
  --disable-webgl \
  --disable-3d-apis \
  --disable-reading-from-canvas \
  --disable-client-side-phishing-detection \
  --disable-client-hints \
  --disable-component-update \
  --disable-component-extensions-with-background-pages \
  --disable-domain-reliability \
  --disable-external-intent-requests \
  --disable-file-system \
  --disable-hang-monitor \
  --disable-speech-api \
  --disable-sync \
  --disable-translate \
  --disable-preconnect \
  --disable-notifications \
  --disable-webrtc-hw-decoding \
  --disable-webrtc-hw-encoding \
  --disable-blink-features=AutomationControlled \
  --deny-permission-prompts \
  --no-pings \
  --no-first-run \
  --no-default-browser-check \
  --block-new-web-contents \
  --site-per-process \
  --dns-over-https-mode=secure \
  --dns-over-https-templates="https://dns.quad9.net/dns-query" \
  --enforce-webrtc-ip-permission-check \
  --webrtc-ip-handling-policy=disable_non_proxied_udp \
  --enable-features=BlockInsecurePrivateNetworkRequests,EncryptedClientHello \
  --disk-cache-size=52428800 \
  "$@"