Flecha Browser

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  chromium/scripts/dmg-layout.py, line 37

  out = subprocess.run(['osascript', '-l', 'JavaScript', '-e', script, path], check=True, capture_output=True, text=True)

  chromium/shell/hub.ts, line 27

  const fn = commands.get(name);

  chromium/shell/hub.ts, line 37

  const fn = commands.get(name);

  Show more

  chromium/shell/hub.ts, line 72

  const fn = commands.get(message.name);

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  chromium/scripts/check-patches.sh, line 4

  # scratch repo. CI runs this; it needs curl and git, not the build volume.

  chromium/scripts/check-patches.sh, line 21

  curl -fsS --retry 3 "https://chromium.googlesource.com/chromium/src/+/refs/tags/$version/$f?format=TEXT" | base64 --decode >"$f"

  chromium/scripts/fetch-sparkle.sh, line 35

  curl --fail --location --silent --show-error --proto '=https' -o "$archive" "$sparkle_url"

  Show more

  chromium/scripts/publish-release.sh, line 48

  old="$(curl --fail --silent --location "$prefix$release_feed" | listed || true)"

  chromium/shell/build-adblock.mjs, line 57

  const res = await fetch(url, { signal: AbortSignal.timeout(30000) });

  chromium/shell/favicons.ts, line 15

  const response = await fetch(iconFor(pageUrl));

  chromium/shell/siteIcons.ts, line 78

  const res = await fetch(`https://${host}/`, { credentials: 'omit', signal: AbortSignal.timeout(6000) });

  chromium/shell/siteIcons.ts, line 88

  const res = await fetch(url, { credentials: 'omit', signal: AbortSignal.timeout(6000) });

  chromium/shell/windowUi.ts, line 129

  /** A data: URL as a Blob, without fetch (the page's CSP keeps connect-src to 'self'). */

  chromium/shell/features/adblock.ts, line 39

  const excludes = await fetch(chrome.runtime.getURL(COSMETIC_EXCLUDES))

  chromium/shell/features/localServers.ts, line 22

  const res = await fetch(`http://localhost:${port}/`, {

  chromium/shell/features/localServers.ts, line 38

  const res = await fetch(`http://localhost:${port}/`, { signal: AbortSignal.timeout(1500), cache: 'no-store', credentials: 'omit' });

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_UNCONFIRMED

  chromium/shell/lib/environments.ts, line 38

  switches: [...env.targets.slice(index + 1), ...env.targets.slice(0, index)].map((t) => ({

  chromium/shell/ui/settings.ts, line 184

  name.addEventListener('change', () => saveEnvironments({ ...env, name: name.value }, i));

  chromium/shell/ui/settings.ts, line 185

  targets.addEventListener('change', () => saveEnvironments({ ...env, targetsText: targets.value }, i));

  Show more

  chromium/shell/ui/settings.ts, line 215

  environmentList.querySelector<HTMLInputElement>('.env-card:last-child .env-name')?.focus();

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  chromium/branding/dmg/background.tiff, line 1

  MM*�h�
  
  
  �
  ��
  
  ��<�ϐ�0�C�������

  chromium/branding/mac/app.icns, line 1

  icnsN�ic12�PNG

  chromium/shell/manifest.json, line 6

  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9emn2yaklQs6XFSayFO7A5Z/isGHzvL5vhaS8k+SNCT6mLBtBq0sq2uyLZ6dCU9AMZvhPh/orvZBczDRztTXWTVUToZPCJRXf6J9x9PNHbU3hsEMYGGFx/nFmrx2v3O/

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit ab4e24c89797. requests shell access. The manifest names this permission. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 27 Oct 2026

Read how this letter is chosen