1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
# ============================================================================
# Chromium Hardened Flags -- Place at ~/.config/chromium-flags.conf
# Or launch: chromium $(cat ~/.config/chromium-flags.conf | tr '\n' ' ')
# ============================================================================
# --- PRIVACY / TELEMETRY ---
--disable-background-networking # no background network requests
--disable-breakpad # no crash reporting
--disable-client-side-phishing-detection # no Google phishing detection
--disable-default-apps # no default app installs
--disable-domain-reliability # no domain reliability monitoring
--disable-extensions-except="" # allow only whitelisted extensions
--disable-hang-monitor # no hang detection reporting
--disable-sync # no Google sync
--disable-translate # no Google Translate
--disable-wake-on-wifi # no WiFi wake
--no-pings # no hyperlink auditing pings
--no-first-run # no first-run wizard
--metrics-recording-only # record but dont send metrics
# --- FINGERPRINTING ---
--disable-reading-from-canvas # block canvas fingerprinting
--disable-webgl # disable WebGL (fingerprint vector)
--disable-3d-apis # no 3D APIs
--disable-speech-api # no speech recognition
--disable-notifications # no push notifications
# --- WEBRTC (IP leak prevention) ---
--disable-webrtc-hw-decoding # no WebRTC hardware decode
--disable-webrtc-hw-encoding # no WebRTC hardware encode
--enforce-webrtc-ip-permission-check # require permission for WebRTC IP
--webrtc-ip-handling-policy=disable_non_proxied_udp # prevent IP leaks
# --- NETWORK ---
--disable-background-timer-throttling # no background throttling
--dns-over-https-mode=secure # force DNS over HTTPS
--dns-over-https-templates=https://dns.quad9.net/dns-query # Quad9 DoH
# --- SECURITY ---
--disable-features=AutofillServerCommunication # no autofill server calls
--disable-features=MediaRouter # no Cast/media routing
--block-new-web-contents # block popups
--site-per-process # strict site isolation
--enable-strict-mixed-content-checking # block mixed content
# --- PERFORMANCE ---
--process-per-site # one process per site
--disk-cache-size=52428800 # 50MB disk cache max
# --- PROXY (uncomment one) ---
# --proxy-server="http://127.0.0.1:8080" # Burp Suite
# --proxy-server="socks5://127.0.0.1:9050" # Tor
# --proxy-auto-detect # auto-detect proxy
# --- ADDITIONAL HARDENING (from Vanadium/ungoogled-chromium) ---
--disable-client-hints # disable UA Client Hints (fingerprint reduction)
--disable-crash-reporter # no crash data transmission
--disable-component-update # no background component updates
--disable-component-extensions-with-background-pages # no Google background extensions
--disable-domain-reliability # no domain reliability measurements to Google
--disable-external-intent-requests # block external intent requests
--disable-file-system # restrict FileSystem API access
--disable-hang-monitor # no hang detection reporting
--disable-speech-api # no speech recognition API
--deny-permission-prompts # deny all permission requests by default
--site-per-process # strict site isolation per origin
--enable-features=BlockInsecurePrivateNetworkRequests # block private network access from public sites
--enable-features=EncryptedClientHello # TLS 1.3 encrypted client hello
# --- PENTESTING ---
--allow-insecure-localhost # allow insecure localhost
--ignore-certificate-errors-spki-list="" # for testing with self-signed certs