A Private Tab Is Not a Private Browser

2026-08-26

Remote Browser already had owner-bound tabs. Alice could reconnect to her tab, Bob could not see it, and the Host could stop it without guessing which caller owned the session. It was tempting to put the new egress proxy on that tab and move on to navigation.

Then we looked at where Chromium accepts a proxy.

The durable profile and proxy belong to the browser context, not to our tab registry. A Remote Browser tab inside the ordinary co browser process would therefore share network authority with local tabs. Setting the gateway for the remote tab could redirect local browsing. Keeping the existing context could do the reverse: a local environment proxy or profile preference could become part of Remote Browser without the Host ever choosing it.

The tab was private in our database. The browser was not private at the layer that opens sockets.

We kept the implementation and changed the ownership boundary

The fix was not a second browser driver. The Host now starts the same BrowserDaemon and AsyncBrowserCore behind a different native endpoint, lock, profile, log, and Windows authentication key. Its launch inputs arrive as one immutable value instead of being rediscovered from process environment variables.

That separation gave startup an order we can test. The egress gateway must be serving before the browser object exists, and both must exist before the IPC endpoint becomes reachable. Shutdown reverses the authority: browser first, gateway second. If the gateway disappears, the daemon refuses commands before touching a tab. It never tries Direct because Direct is not a recovery path; it is a different security policy.

One regression made the boundary clearer. Our first endpoint helper protected its parent directory with mode 0700. That was correct for the private runtime directory and disastrously broad for an explicit legacy socket at /tmp/browser.sock: it tried to change /tmp itself. The adjacent local-daemon suite caught it. The helper now hardens only a directory it creates, while the private address factory owns and verifies its dedicated directory.

Configuration is evidence, not the verdict

The private launch asks Chromium to use one authenticated loopback proxy, block Service Workers, disable QUIC and non-proxied WebRTC UDP, subtract Chromium's implicit loopback bypass, and fail browser-side hostname resolution outside the gateway. Tests also prove that ordinary local browsing still honors its old environment-compatible configuration.

But a list of launch flags is not proof that Chromium cannot escape them. This slice deliberately leaves navigation unavailable. The next test must run the pinned browser on every supported operating system, attempt redirects, subresources, workers, WebSockets, downloads, and DNS rebinding, and observe zero connections at private sentinels.

A private session begins with identity. A private browser also needs exclusive ownership of the process boundaries that decide profile, proxy, and sockets. The word “private” is only earned at the lowest layer that can violate it.