# Security review record

This is an engineering review, not an independent penetration test or certification.

Addressed during implementation:

- Canonical, HTTPS-only origin/port comparison; credential, fragment, query,
  subpath, scheme, lookalike-host and TLS-downgrade regression cases.
- A main-frame POST can bypass Android's usual navigation callback. The request
  interception gate now rejects **all** cross-origin requests, not only subresources.
  The emulator regression was observed failing when the main-frame guard was
  deliberately removed, then rerun with the fix restored.
- TLS failures cancel by default. Native download redirects are refused before
  cookies can be replayed to another origin. Bootstrap requests use neither
  cookies nor automatic redirects and have bounded metadata reads/timeouts.
- Files use explicit system selection/content URIs; no filesystem or storage
  permission is granted to web content. Blob exports have no native JS bridge.
- Complete Android browsing-data deletion uses WebStorageCompat, with OS app
  reset for engines without that capability. WebStorage.deleteAllData alone was
  insufficient for service-worker CacheStorage/IndexedDB and is not relied upon.
- iOS server erase replaces the WKWebView, not only its URL, eliminating old
  history/back-forward contexts as well as persistent website data.
- iOS metadata uses typed decoding, rejecting numeric values masquerading as booleans.
- Native picker results are bound to the browsing generation/request. Android
  rejects stale upload/download selections, revokes camera URI grants, and clears
  capture cache on erasure. iOS ignores export-cancellation callbacks from an old
  download. Apple-specific callback regressions have not run without Xcode.
- KGP was upgraded after OSV identified CVE-2026-53914 in the original build tool.
  The final OSV scan found no listed advisories across 213 locked/direct Maven
  coordinates and build plugins. Rescan after resolution/lock updates.
- The inspected release APK is not debuggable, rejects cleartext, disables backup
  and trusts system CAs only. AndroidX's exported profile installer receiver is
  protected by the system DUMP permission; app providers are not exported.

Release gates still requiring evidence:

- Actual Xcode typecheck, simulator, archive, physical-device and accessibility review.
- End-to-end IdP flows, especially providers that prohibit embedded agents; no
  browser-to-native session transfer is supported by the current upstream protocol.
- iOS unknown-length download disk-pressure behavior; a post-download size check
  is not a streaming quota. Verify file picker/camera cancellation on real devices.
- Android file-picker/camera/rotation while a picker is outstanding; cancellation
  on process death intentionally loses the selection, never silently retries it.
- Offline sign-out/account switching, stale-worker updates and server erasure on
  current WebView/WKWebView versions. Upstream tests are not native device proof.
- Reverify final signed release manifests, signing, store ownership, private vulnerability contact
  and applicable privacy disclosures. No claim that all vulnerabilities are absent.