Titanium Browser (Android)
A Chromium browser for Android by jqssun, built as patches on top of Vanadium, the hardened Chromium that GrapheneOS ships — with the one thing Vanadium refuses: extensions. Formerly "Helium Browser for Android", renamed to avoid a clash with the desktop Helium project. Read from the GitHub README; arrived by Telegram 2026-09-17. Repo only — no blog, no independent review.
What it is, concretely
- Base: Vanadium's generic and subproject patches over upstream Chromium, then Titanium's own layer: feature and UI overrides, Manifest V2 support plus "secure off-store install", and fixes.
- Extensions load from the Chrome Web Store, Opera Add-ons, Edge Add-ons, or as unpacked folders via
chrome://extensions— the desktop extension surface on a phone, including MV2 after Chrome dropped it. - Built in GitHub Actions on Ubuntu from an
args.gn; runners can be self-hosted; releases are attestable with the GitHub CLI. Distributed as APKs on GitHub Releases and on Google Play (io.github.jqssun.helium), with in-place updates between the two. - GPL-2.0; 2.5k stars, 113 forks, 98 commits on main at read time.
- The README's own limit: it "only attempts to improve security where possible", and points anyone who wants real hardening to GrapheneOS with Vanadium, where the kernel and OS carry the rest.
What it adds here
The spoke's privacy-first row (brave, vivaldi, ladybird) is desktop-and-mobile products with companies behind them. This is the other kind: one maintainer, a patch series on someone else's hardened fork, no monetisation, and a distribution story (Play plus attestable CI builds) that is more careful than the codebase is large. The interesting tension is in the README itself — the base it is built on omits extensions as a security decision, and this project's whole reason to exist is to add them back, MV2 included. That is a fork disagreeing with its upstream about what "secure" means for a browser, which is the argument brave's and Vanadium's designs settle in opposite directions.
Runner-up spoke: foss-applications (an Android app people install themselves). Routed here because the substance is browser design, not distribution.
Tier T3 — first-party README; star count and claims unverified elsewhere.