Separate worlds. One browser.
CClone is a proposed Chromium-derived browser built around isolated browsing identities called Containers. The product goal is to combine strong account separation, explicit per-container network routes, tracking resistance, and productivity features without overstating what those controls can guarantee.
Milestone 0: Discovery and feasibility — complete and CI-validated.
This repository does not yet contain a browser binary or Chromium source. It is not suitable for browsing, privacy-sensitive activity, or security evaluation. The first implementation milestone is blocked until a Chromium-capable Windows build host is provisioned; see the feasibility report.
CClone will never describe account separation, fingerprint resistance, proxying, or Tor routing as “complete anonymity.” Signing in to an identifying account, opening external files, installing extensions, or making operational mistakes can still reveal identity.
- Feasibility report
- Architecture
- Threat model
- Privacy model
- Security policy
- Design system
- Brand guide
- Build and release strategy
- Container isolation matrix
- Architecture decisions
- Risk register
- Roadmap
- Implementation status
- Primary sources
- Preserve Chromium sandboxing, Site Isolation, renderer separation, and the network-service security model.
- Keep downstream Chromium patches small, reviewable, inventoried, and continuously rebased.
- Treat the container boundary, route enforcement, updater, and extension policy as security boundaries.
- Fail closed for Tor containers. Never silently fall back to a direct route.
- Never move cookies, authentication, or storage between Direct and Tor identities.
- Do not claim a privacy or performance property without a reproducible test.
- Keep unfinished controls visibly experimental.
The repository will hold CClone-owned code, build orchestration, tests, documentation, and a versioned downstream patch queue. It will not import the entire Chromium Git history. An exact upstream Chromium commit and dependency manifest must be pinned before the first engine patch is accepted.
Phase 0 validation has no third-party Python dependencies:
python scripts/validate_phase0.pyNo licence has yet been selected for original CClone code. Chromium and every redistributed dependency retain their own licences. See licensing status. Do not assume that publication of this repository grants a licence beyond rights provided by applicable law.