Document the Android Chromium source decision

[phucnguyen1707]

Summary

• turn the recorded Cromite candidate into a fail-closed source-adoption gate with explicit record, adopt, and optional live-verification modes
• verify pinned release, commit, license, extension patch, and freshness evidence without treating external metadata as a successful build
• document the recommendation to track an Android Chromium downstream while the local overlay, branding, Tor artifacts, and current security pin remain open
• run candidate validation in CI and keep the heavy build behind the strict release preflight

Validation

• Node.js 24.9.0
• pnpm --filter @tronbrowser/android-engine lint
• pnpm --filter @tronbrowser/android-engine typecheck
• pnpm --filter @tronbrowser/android-engine test (44 tests)
• pnpm --filter @tronbrowser/android-engine build
• pnpm --filter @tronbrowser/android-engine audit:candidate
• verified the adoption and release gates report the documented blockers instead of claiming release readiness

[github-actions]

ThreatCrush Security Scan

55 finding(s)

HIGH/CRITICAL: 7 | MEDIUM: 24 | LOW: 24

Severity	Rule	Location
HIGH	sh-remote-script-execution	apps/desktop/launcher/tronbrowser:84
HIGH	sh-remote-script-execution	apps/desktop/launcher/tronbrowser:394
HIGH	sh-remote-script-execution	apps/web/public/install.sh:134
HIGH	sh-remote-script-execution	apps/web/public/install.sh:139
HIGH	sh-remote-script-execution	apps/web/public/install.sh:238
HIGH	sh-remote-script-execution	apps/web/public/install.sh:256
HIGH	sh-remote-script-execution	apps/web/public/install.sh:794
MEDIUM	js-open-redirect	apps/desktop/extensions/ai-sidebar/install-helper.js:96
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/sidepanel.js:77
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/sidepanel.js:165
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:77
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:227
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:569
MEDIUM	js-unescaped-html-sink	apps/web/public/app.js:29
MEDIUM	js-unescaped-html-sink	apps/web/public/dns.js:54
MEDIUM	js-unescaped-html-sink	apps/web/public/settings.js:96
MEDIUM	js-unescaped-html-sink	apps/web/public/settings.js:168
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:80
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:92
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:103
MEDIUM	js-dynamic-code-execution	packages/sdk/src/page.ts:65
MEDIUM	js-dynamic-code-execution	packages/sdk/src/page.ts:70
MEDIUM	sql-template-interpolation	services/api/src/store/db.ts:116
MEDIUM	js-dynamic-code-execution	services/api/src/store/scanner.ts:44
MEDIUM	sh-predictable-temp-path	start.sh:25
LOW	insecure-temp-file	apps/desktop/src/launcher.test.ts:21
LOW	insecure-temp-file	apps/desktop/src/tor.test.ts:40
LOW	insecure-temp-file	apps/desktop/src/tor.test.ts:44
LOW	insecure-temp-file	apps/desktop/test/launcher.test.ts:93
LOW	js-dynamic-code-execution	packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW	js-unescaped-html-sink	packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW	js-unescaped-html-sink	packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW	js-dynamic-code-execution	packages/browser-core/src/automation/extract-script.test.ts:6
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:35
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:47
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:70
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:89
LOW	js-dynamic-code-execution	packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/snapshot-script.test.ts:24
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/snapshot-script.test.ts:63
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:47
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:170
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:216
LOW	insecure-temp-file	packages/sdk/src/sdk-e2e.test.ts:85

…and 5 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.