Repository navigation
Verify the launching browser's signature with LAUNCHING_BROWSER_TOKEN - #639
Merged
Merged
Conversation
LAUNCHING_BROWSER pins a TWA to a browser by package name only, so any app installed under that name is trusted. The new LAUNCHING_BROWSER_TOKEN metadata also pins the browser's signing certificate: it holds a base64-encoded androidx.browser.trusted.Token, and the TWA is only launched if the installed LAUNCHING_BROWSER package matches it (signing key rotation is supported on API 28+). If verification fails (browser missing or mismatched, invalid token, or token set without LAUNCHING_BROWSER), the launch fails closed: - the browser is not bound to or launched, and the fallback strategy is given a null provider package; - LauncherActivity shows the "browser unavailable" dialog, even if a WebView fallback is configured, and ShortcutTrampolineActivity drops the launch; - the browser is not remembered as the last launched provider, and the stored delegation Token is cleared (except on ChromeOS). TwaLauncher gets a constructor that takes the expected Token, for apps that use it directly. On a mismatch, CCT_FALLBACK_STRATEGY is replaced by the blocked dialog, as it could otherwise open the URL in the unverified browser. Behaviour is unchanged when LAUNCHING_BROWSER_TOKEN is not set.
chatbaby68-bot
approved these changes
Oct 12, 2026
gstepniewski-google
requested changes
Oct 12, 2026
gstepniewski-google
left a comment
gstepniewski-google
left a comment
Collaborator
There was a problem hiding this comment.
Please also update CHANGELOG.md
- Log distinct messages in ShortcutTrampolineActivity's fallback for a missing browser, a browser that failed token verification, and a token set without LAUNCHING_BROWSER. - Test ShortcutTrampolineActivity's handling of LAUNCHING_BROWSER_TOKEN. - README: generate the token with adb and apksigner instead of from an app; update the TwaLauncher constructor arity. - Add a CHANGELOG entry.
gstepniewski-google
approved these changes
Oct 12, 2026
Collaborator
|
make sure to squash before merging |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LAUNCHING_BROWSER pins a TWA to a browser by package name only, so any app installed under that name is trusted. The new LAUNCHING_BROWSER_TOKEN metadata also pins the browser's signing certificate: it holds a base64-encoded androidx.browser.trusted.Token, and the TWA is only launched if the installed LAUNCHING_BROWSER package matches it (signing key rotation is supported on API 28+).
If verification fails (browser missing or mismatched, invalid token, or token set without LAUNCHING_BROWSER), the launch fails closed:
TwaLauncher gets a constructor that takes the expected Token, for apps that use it directly. On a mismatch, CCT_FALLBACK_STRATEGY is replaced by the blocked dialog, as it could otherwise open the URL in the unverified browser.
Behaviour is unchanged when LAUNCHING_BROWSER_TOKEN is not set.