Sol

Security

Keeping Sol Secure

A browser handles your credentials, private sessions, and daily work. Sol is designed around a simple rule: minimize what leaves your computer, strip out background tracking services, and verify every package or command that crosses the boundary between a web page and the native host.

Because Sol runs without a user account or a central cloud server, we cannot read, lose, or sell your browsing history, bookmarks, or passwords.

Browser engine & upstream patches
Sol renders web content through the Microsoft Edge WebView2 (Chromium) runtime on Windows. This gives every tab Chromium process sandboxing, Site Isolation, and continuous upstream security patches delivered automatically through Windows Update.

Strict host-UI bridge validation
The browser interface communicates with the native C# host through a typed JSON message channel (CommandParser). Every incoming command is validated against an explicit allowlist of actions and parameter bounds before the host executes it.

List of Built-In Privacy Protections

  • uBlock Origin Lite enabled by default (GPLv3, updated automatically)
    • Blocks third-party ad networks, popups, and cross-site tracking scripts before they run
    • Includes full access to filter lists and per-site exceptions in Settings > Security
  • Zero telemetry, usage analytics, or crash-reporting daemons
  • No mandatory cloud account: bookmarks, history, and passwords stay in your local profile folder
  • Toggleable online search suggestions so address bar typing stays local until you press Enter
  • Isolated Private browsing windows with extensions disabled and session data wiped on close

Permissions, Extensions & Backups

Cryptographically verified extensions (CRX3)
Sol only downloads extensions from the official Chrome Web Store endpoint, never from arbitrary URLs. Before unpacking an extension, Sol parses the CRX3 binary header, verifies the SHA-256 cryptographic signature against the package public key, and confirms that the key derives to the exact 16-byte extension ID.

Before any extension is enabled, Sol displays the exact permissions it requests. If a new version of an installed extension asks for additional permissions, Sol pauses the update and prompts you to review the new access first.

AES-256-GCM encrypted local backups
Instead of syncing your profile to a third-party cloud, Sol lets you export an encrypted backup file in Settings > Data. Your profile files are compressed and encrypted locally with AES-256-GCM using a 256-bit key derived from your passphrase via PBKDF2-SHA256 (600,000 iterations, 16-byte random salt). The file header is authenticated with the ciphertext, so any tampered file is rejected. On restore, Sol only extracts known profile filenames into a staging folder and applies them on the next startup.

Granular site permissions & one-click reset
No website receives camera, microphone, location, or notification access without asking first. In Settings > Security, you can review every origin that holds a saved permission, forget a single site in one click, or clear all site permissions and browsing data at once.

Reporting & Open Source

Security claims are easier to trust when you can read the code yourself. Sol's native host, extension verifier, backup encryption, and UI bridge are open source and available to inspect on GitLab.

How to Report a Vulnerability

If you identify a security or privacy vulnerability in Sol Browser, please report it by opening a confidential issue on our GitLab issue tracker with steps to reproduce so we can ship a fix promptly.

FAQ