Skip to main content
ITISYOU
Menu
In developmentIn development — public engineering record

ITISYOU Browser

Can a browser put the sandbox, the privacy boundaries and the AI off-switch in place before adding a single feature that depends on trusting them?

ITISYOU Browser is a Chromium-based desktop browser built on the Chromium Embedded Framework, currently at 0.1.0-dev. Phase 1 of a planned four — the foundation — is complete on Windows, with the sandbox on and AI structurally off by default. Linux and macOS are not yet verified, and there is nothing to download.

Where it stands

0.1.0-dev, Phase 1 of a planned 4 complete. It is not released: there is no installer and nothing to download. Phases 2 through 4 have not started.

Last verified

Public engineering record: browse.itisyou.app

What it is, in plain terms

ITISYOU Browser is a desktop web browser I am building on top of Chromium, the same open-source engine underneath most major browsers. It is currently at version 0.1.0-dev, and it is in development, not released: there is no installer, nothing to download, and no date for when there might be. What exists today is Phase 1 of a plan with four phases, and Phase 1 — the foundation — is complete on Windows. Linux and macOS are not yet verified. Phases 2, 3 and 4 have not started.

In practical terms, that means the browser I have today genuinely renders real web pages over real HTTPS connections, in tabs, with back and forward and reload working, with the Chromium security sandbox switched on rather than disabled for convenience, and with an AI system built into the code but currently making zero calls to any AI provider anywhere. It is a real, working thing you could point at a website and watch it load — it is just not yet a finished product, and it is not something I am distributing.

I keep a public site for this project at browse.itisyou.app, which states its own status honestly: Phase 1 of 4, foundation complete, no releases yet, nothing to download. That site is a public engineering record, not a demo or a download page.

Why I built it

I wanted to find out whether it is possible to build a real, functioning browser where the privacy and safety boundaries — what a web page can and cannot touch, whether an AI feature can silently reach out to a server, whether one tab can affect another — are designed in from the very first working build, rather than added as a later hardening pass once a product already exists and has users depending on it.

A specific instinct behind this project is that a lot of browsers today treat AI as something to bolt onto an existing product, with broad access to browsing history and behaviour granted by default because it is convenient for the feature to have it. I wanted to try the opposite ordering: build the browser to be fully useful with AI structurally absent, and only ever let AI in later behind a boundary that has to be deliberately opened rather than one that starts open and has to be deliberately closed.

None of this is a claim that the finished product will be better than existing browsers, or that it will ever ship widely. It is the question this phase of the project was built to test, and the honest answer so far is that the foundation can be built this way — that is what Phase 1 demonstrates, no more and no less.

The problem underneath

A browser sits in a genuinely difficult position: its entire job is to render content from strangers, at speed, while keeping that content from ever touching anything it should not. Every browser built on a serious engine like Chromium already does a great deal of this well — process separation between tabs, a sandbox around the part of the program that parses untrusted content, and so on. The part that is easy to get wrong is everything layered on top of that foundation: a custom internal settings interface, a command palette, an AI assistant, workspace data — any of these can accidentally create a shortcut that lets untrusted web content reach something it should never see, if the boundary between "the browser's own trusted interface" and "a web page" is not enforced as strictly as the boundary Chromium already enforces for you.

That is precisely the category of problem this project ran into and fixed during Phase 1, described below, and it is the reason I think the underlying question — can these boundaries hold up under scrutiny from day one, rather than being patched in after the fact — is worth spending real engineering time answering properly rather than assuming.

How it works, without the jargon

The browser is built using the Chromium Embedded Framework, a way of taking the real Chromium engine — the actual code that renders web pages, runs JavaScript, and keeps different pages isolated from each other — and wrapping a custom interface around it, rather than writing a browser engine from scratch or using a lighter-weight substitute that does not carry Chromium's full security model. When you open a tab, that tab is a genuine, isolated Chromium browser view; the security separation between the part of the program that talks to the operating system and the part that renders potentially hostile web content is the same separation Chromium ships with, not a simplified stand-in.

On top of that engine sits the browser's own interface — the tab strip, the address bar, a command palette, and a handful of internal pages like history and settings. Those internal pages are served from a separate, privileged address scheme that ordinary web content cannot reach, is not allowed to load inside an iframe, and can only be talked to by code running in that same privileged context. That separation exists specifically so a hostile website cannot pretend to be part of the browser's own interface, or sneak a request through to something a web page should never be able to touch.

Anything that touches your data locally — browsing history, saved sessions, workspace state — is written to its own separate store rather than one shared file, and written using a pattern that keeps a backup copy in case the write is interrupted partway through, say by a crash or a forced shutdown. Whether a session actually comes back correctly after the browser restarts is something the automated tests check directly, rather than something I merely assume works because the code that writes it looks correct.

And the AI system, which does exist in the code as an interface, currently has only one thing plugged into that interface: a provider that is permanently disabled and makes no network calls at all. If something in the code tries to switch AI on in this phase, that attempt is rejected, and rejected honestly — the system does not pretend to comply while quietly doing nothing.

What building it taught me

The most useful thing that happened in this phase was not a feature going right, but a deliberate adversarial review after the browser was already considered functionally complete for the phase — and that review finding something real. It discovered that a hostile website could load the browser's own privileged internal pages inside an invisible iframe and, through that, reach the internal interface meant only for the browser's trusted UI to use. Nothing about the individual pieces of code looked obviously wrong on their own; the gap was in what was missing, not in what was present.

The fix, which I applied the same day it was found, was deliberately layered rather than single-point: the privileged interface pages were marked as display-isolated so other pages cannot easily reference them, a strict framing policy now refuses to let them be embedded at all, any attempt by an embedded subframe to navigate to them is blocked outright, and the internal bridge itself independently checks that a request is genuinely coming from the main frame of a privileged page before it does anything. I did that deliberately, on the theory that a single fix at a single layer is exactly the kind of thing that gets quietly bypassed later when something else changes nearby — four independent checks are harder to accidentally undo all at once.

I also learned, again, that writing the tests before the first real launch pays for itself quickly rather than eventually. The unit test suite caught three genuine bugs in the very first hour it existed as a complete suite — including one where a command's identifier was read from an object in the same expression that moved the object elsewhere in memory, and the compiler was free to do those two things in either order. It happened to move the object first, which meant every single command in the browser was silently registering under an empty identifier. That is not a bug you would necessarily notice by reading the code; it is exactly the kind of bug a test that actually exercises the running behaviour is built to catch.

A smaller but telling lesson: every tab rendering completely blank turned out to be a framework limitation rather than a bug in my own code — the underlying engine only permits one browser view of a particular hosting style per window, and the shell was quietly violating that. The fix required switching to a different view-hosting approach for the whole window, which sounds architectural and slightly alarming until you realise the actual security model — the sandbox, the process separation — was never at risk; only how views are hosted inside a window changed.

Where it stands today

Phase 1 of the plan's four phases is complete, verified on Windows on 2 September 2026. The browser builds in release mode with the Windows sandbox enabled, renders real HTTPS pages in isolated tabs, supports basic navigation and tab management, has a working command palette, a foundation for separate workspaces, local browsing history, and a permission system that denies capability requests by default. Thirty of thirty unit tests pass, and a 24-step smoke test suite that exercises the actual running binary against real websites — including the fix for the internal-page embedding issue — also passes in full, with session restoration across a process restart separately verified.

That is a genuinely functioning browser, and it is also a genuinely early one. Nothing about Phase 1 completion means the product is close to ready for anyone else to use. Linux and macOS builds are configured but have never actually been compiled or run, because I do not yet have working build environments for either. Phases 2 through 4 of the plan — which cover deeper browser services, real workspace and data systems, and whatever follows after that — have not started, and I am deliberately not detailing their scope publicly before the work exists to back it up.

The AI-off claim is one I want to be precise about, because it is easy to state weakly. It is not that AI features are hidden behind a settings toggle that happens to be off. The AI runtime's only wired-in provider in this phase is a disabled one, and the code path that would make an AI provider network call does not exist in a reachable state — attempts to enable it are refused rather than routed anywhere. That is a stronger and more specific claim than "AI is off by default", and it is the one the evidence actually supports.

Where it may go

  • Next: begin Phase 2, covering browser services, workspace persistence and underlying data systems.
  • Next: get a working Linux build environment in place and actually run the existing Linux build configuration for the first time, then do the same for macOS.
  • Then: go beyond the framework's default Windows sandbox settings with a dedicated hardening pass.
  • Then: consider extending the AI runtime past its current, permanently disabled state, only behind an explicit and reviewable boundary rather than a default that starts open.
  • Later: Phases 3 and 4 of the plan, whose scope I am not detailing yet because the work to back it up does not exist.

This project shares a habit of mind with a much lower-level piece of work I am also doing, an operating-system kernel described on its own page, ITISYOU OS — both are attempts to get privilege boundaries right at the foundation, before building anything on top that would make changing them later expensive.

For developers: the engine choice and the isolation model underneath it

The browser is built on a pinned, checksum-verified binary distribution of the Chromium Embedded Framework rather than a from-source Chromium checkout. That decision was made explicitly against the constraints of the development environment at the time — a full Chromium source build needs a disk footprint the project's machine did not have — with a documented migration path to a source-based build recorded for later, should the product ever need engine-level changes the framework cannot expose. Electron was ruled out as a permanent runtime on different grounds: it is documented upstream as not designed to act as a security boundary for arbitrary untrusted content, which is disqualifying for a browser whose whole purpose is safely handling exactly that.

The browser's own interface — tabs, address bar, settings, history, diagnostics — is implemented as trusted content served over a dedicated internal address scheme, rendered in a privileged view that is kept structurally apart from ordinary web content. The bridge that lets that trusted interface call into native browser code is origin-gated, and is checked independently at more than one point: bindings that expose it are only installed for the privileged scheme in the first place, the browser process itself verifies the origin of any request that reaches it, and navigation into the privileged host from an untrusted context is blocked outright. The framing and embedding protections added after the adversarial review sit alongside these as a fourth, independent layer.

Permission handling for capabilities like camera and location access is centralised in one service that applies a default-deny policy, rather than being implemented independently wherever a given browser feature happens to need a permission check. That centralisation is what makes "default deny" an enforceable property of the whole browser instead of a convention that individual features are merely expected to follow. Local data — session state, browsing history, workspace configuration, settings — is kept in separate stores, each written with an atomic-write-and-backup pattern specifically so a write interrupted by a crash cannot leave that store, or any other, in a corrupted state; the recovery path itself is covered by unit tests rather than assumed to be correct.

Test coverage for this phase spans two layers: a unit test suite exercising the underlying C++ core in isolation — covering things like JSON parsing correctness, address-bar classification, atomic persistence and recovery, and the AI-off invariant directly — and a smoke test suite that drives the actual compiled binary against real HTTPS sites, checking navigation, tab lifecycle, workspace switching, history recording, and the specific security regression from the adversarial review. Both suites are re-run to a full pass whenever a fix like that is made, rather than trusting that a targeted fix alone is sufficient evidence.

How it works

Can a real, sandboxed, Chromium-based browser be built with privacy boundaries and an AI off-switch designed in from the very first line of code, rather than retrofitted once the product already exists?

The loop, step by step

  1. Chromium is embedded through the Chromium Embedded Framework, with the sandbox enabled
  2. The browser shell renders tabs, an address bar and navigation in a Tab Mode design
  3. Each tab runs its own isolated Chromium browser view
  4. A permission service checks every request against a default-deny policy
  5. History, sessions and workspace data are written to separate, atomically-saved stores
  6. Automated unit tests and a browser smoke suite exercise the running binary
  7. The build and its tests run again in continuous integration before anything is called verified

The principle underneath

AI is optional and structurally off, not just switched off

The browser is a fully working browser first, with AI treated as removable rather than required. In Phase 1 the AI runtime exists in code, but it makes zero calls to any AI provider — the disabled state is enforced in the code path itself, not by a setting that could be silently flipped.

What exists today

Implemented in the current code. Nothing here is a plan.

  • chromium

    A real Chromium engine, sandbox intact

    The browser is built on the Chromium Embedded Framework, running actual Chromium — the same browser, renderer, GPU and network process separation as the upstream project, with the sandbox enabled rather than disabled for convenience.

  • tabs

    Per-tab isolated rendering

    Each tab runs in its own Chromium browser view. Tested navigation includes real HTTPS pages, back and forward, reload, and tab creation, switching, closing and reopening.

  • ai-off

    AI structurally off by default

    The AI runtime's interfaces exist, but only a disabled provider is wired in for Phase 1. There is no code path in this phase that makes a network call to any AI service, and attempts to enable it are honestly rejected rather than silently ignored.

  • permissions

    A default-deny permission service

    Requests for camera, location and similar capabilities are routed through one central service that denies by default, rather than being scattered across the codebase where a gap could go unnoticed.

  • sessions

    Sessions that recover after a crash or restart

    Session, history and workspace data are written with an atomic-save pattern that keeps a backup copy, and restoring a session across a process restart is exercised by the test suite rather than assumed to work.

What was verified

Each result carries the weight its level allows and no more. These are the project's own records of itself — nobody else has reproduced them.

DemonstratedRun on the verified device and observed to work.
  • The browser is a real, sandboxed, Chromium-based application that renders live web pages on Windows

    It ran real HTTPS pages, including navigation, back and forward, reload, and multiple tabs, with the Windows sandbox enabled throughout.

  • AI makes zero calls to any provider in Phase 1

    Only a disabled provider is wired into the AI runtime for this phase, and attempts to enable it are rejected rather than silently permitted.

TestedCovered by automated or repeated manual testing.
  • 30 of 30 unit tests and 24 of 24 browser smoke steps pass, with session restore verified across a process restart

    This is the Phase 1 completion evidence recorded on 2 September 2026, run against the actual built binary rather than only against source code.

Not claimedExplicitly outside what this prototype does or asserts.
  • The browser runs correctly on Linux and macOS

    The build configuration exists for Linux and is documented for macOS, but neither has an actual build environment yet, so neither has been run or verified.

  • A finished, releasable product

    This is Phase 1 of a planned four. Phases 2 through 4 have not started, there is no release, and nothing is available to download.

  • Independent review of the browser's security posture

    The adversarial review that found and led to fixing the internal-page embedding issue was carried out by the project itself, not by an outside party.

Rules it holds to

Decisions made on purpose, so none of them has to be inferred from silence.

A web page tries to reach the browser's own privileged internal interface
The request is refused. The privileged interface is only reachable from the browser's own trusted pages, checked at more than one layer.
A capability like camera or location access is requested
It is denied by default and routed through one central permission service rather than granted implicitly.
Code attempts to enable the AI runtime in Phase 1
The attempt is rejected and the rejection is honest about why, rather than the runtime quietly staying off while claiming otherwise.
The Chromium sandbox would need to be weakened to make something easier to build
It is not weakened. The sandbox stayed on throughout Phase 1, including through a redesign needed to keep it intact.

Web content is always untrusted

Arbitrary web pages never receive privileged browser APIs. The browser's own trusted interface pages are kept in a separate, isolated scheme that ordinary web content cannot navigate to or embed.

AI is optional, and Phase 1 proves it can be genuinely absent

The browser is fully functional with the AI runtime completely inert, which was true from the first working build rather than added afterwards as a toggle.

Privacy datasets stay separate

History, bookmarks, workspace data and settings are kept as distinct stores with their own boundaries, rather than one shared blob a single bug could expose all at once.

Problems and lessons

Real problems from the project's own records, with what was found, what changed and how it is checked now.

  1. 01

    Every tab in the browser rendered blank.

    What was found
    The Chromium Embedded Framework only permits one Chrome-style browser view per window, and the shell was creating more than one, which silently produced empty views rather than an obvious error.
    What changed
    The window and all its views were moved to the framework's alternative view-hosting style, which supports multiple views per window without touching the underlying sandbox or Chromium's site isolation.
    How it is checked now
    Manual navigation confirmed real content rendering in every tab, and the fix is now covered by the browser smoke test suite that exercises tab creation and switching.
  2. 02

    A post-completion adversarial review found that a hostile website could embed the browser's own privileged internal pages inside an iframe and reach the internal interface meant only for the browser's own trusted UI.

    What was found
    The privileged pages were reachable by ordinary web navigation and had no framing protection, so a malicious page could load them invisibly and attempt to talk to the internal bridge.
    What changed
    The fix was applied at four independent layers on the same day it was found: the privileged scheme was marked display-isolated, a strict framing policy was added, subframe navigation to the privileged host was blocked outright, and the internal bridge itself now checks that a request comes from the main frame of a genuinely privileged origin.
    How it is checked now
    A dedicated regression step for exactly this attack was added to the smoke test suite, and the full suite was re-run to a clean pass afterwards.
  3. 03

    The command system silently registered every command under an empty identifier.

    What was found
    A line of code read a command's identifier and moved the command object in the same expression; the compiler was free to evaluate those in either order, and it happened to move the object first, leaving the identifier read as empty.
    What changed
    The identifier is now copied out explicitly before the object is moved, removing the ambiguity.
    How it is checked now
    Caught by the unit test suite before the first launch of the browser, and confirmed fixed by the same tests afterwards.
  4. 04

    Typing an address like a local address with a port number sent it to search instead of navigating directly.

    What was found
    The bar that classifies what you type as either a search or a web address was extracting a scheme from the text before recognising a plain host-and-port shape, so it misread the port number as if it were part of a web address scheme.
    What changed
    Host-and-port shapes are now recognised before scheme extraction runs.
    How it is checked now
    Covered by the unit test suite for address-bar classification.

Limits and unknowns

What it does not do, and what it is not — stated here rather than discovered later.

Limitations

  • It is not released. There is nothing to download, and no timeline for a release is published.
  • Only Windows has actually been built and tested. Linux and macOS have build configuration in place but no verified build.
  • Only Phase 1 of a planned four is complete. Phases 2 through 4 — services, workspace data systems, and whatever follows — have not started.
  • The Windows sandbox uses the framework's default hardening; a deeper hardening audit is planned for a later phase and has not happened yet.
  • Some interface details, such as how a certificate warning is shown, use a simpler fallback path rather than a fully polished one, and are recorded as a later refinement.
  • Nothing here has been reviewed or reproduced by anyone outside the project; every test result comes from the project's own build and test records.

What it is not

  • Not released. There is no installer, no download link, and this page is not an announcement that one is coming.
  • Not verified on Linux or macOS. Only the Windows build has actually been built and tested; the other two platforms have build configuration but no verification.
  • Not a finished browser. Three further phases of the plan have not started, and their scope is not detailed publicly on this page.
  • Not a browser with AI features today. The AI runtime exists in code but makes no calls to any provider in this phase.
  • Not independently security-reviewed. The adversarial audit that found the internal-page embedding issue was run by the project itself.

Where it may go

Directions the project's own plans record. Intentions, not promises — and not dates.

  1. Next: begin Phase 2 — browser services, workspace persistence and data systems
  2. Next: verify the Linux and macOS builds, which are architecture-ready but untested today
  3. Then: deepen the Windows sandbox hardening beyond the current defaults
  4. Then: extend the AI runtime beyond its present off-by-default, zero-provider-call state, still gated behind explicit consent
  5. Later: Phases 3 and 4 of the plan, not yet started or detailed publicly

Technical detail

For developers. Nothing here is needed to understand the rest of the page, and nothing here is an address, a port or a path.

Built on the Chromium Embedded Framework, not a full Chromium checkout

The project uses a pinned, SHA-verified CEF binary distribution rather than building Chromium from source, a deliberate first-phase decision recorded against the disk and build-time cost of a full source checkout, with a documented path to a source-based build later if it is ever needed.

Electron was ruled out as a permanent runtime

Electron is explicitly documented upstream as not designed to be a security boundary for untrusted content, which the project treats as disqualifying for a browser whose entire job is rendering untrusted content safely.

A privileged internal scheme, isolated from web content

The browser's own interface pages are served from a dedicated internal scheme, kept isolated from ordinary web navigation and framing, with the bridge between that interface and native code checked at more than one layer before anything is allowed through.

Session, history and workspace data as separate atomically-written stores

Each kind of local data is persisted independently with an atomic-write-plus-backup pattern, so a corrupted write to one store does not take down or corrupt another, and recovery from a bad write is itself covered by tests.

A default-deny permission service sits centrally, not per-feature

Capability requests such as camera or location access are routed through one shared service rather than checked independently wherever a feature happens to need them, which is what makes a default-deny policy actually enforceable rather than aspirational.

What this is based on

Sources for this page

  • Returns HTTP 200 over a valid certificate. It describes ITISYOU Browser at 0.1.0-dev, "Phase 1 of 4: foundation complete", states "No releases yet", and its downloads page says there is nothing to download.

    Checked 11 September 2026

  • ITISYOU Browser repository and Phase 1 completion report — inspected directlyprivate source — described, not linked

    The story, Phase 1 completion report of 2 September 2026 and commit history were inspected. They record a Chromium-based browser shell running with the sandbox enabled on Windows, 30 of 30 unit tests, 24 of 24 browser smoke steps and session restore across a restart, with Linux and macOS not yet verified.

    Checked 11 September 2026

The public engineering record above can be checked by anyone. The rest rests on the project's private records — its repository, test results and engineering history, inspected directly. If anything here turns out to be wrong, the corrections page explains how it gets fixed.