Releases

Each Cefrium version, the CEF and Chromium upstream it tracks, and what changed. Tap a release to expand its notes.

Cefrium tracks upstream CEF release branches. Each release is built from a specific CEF branch and the Chromium revision it pins, so the Chromium security fixes in that revision are present in the corresponding Cefrium release. Upstream security updates are incorporated into the next release rather than backported. Maintained best-effort, in the tradition of upstream CEF; no SLA beyond what is stated here.

0.7.1 CEF 7922 Chromium 151.0.7922.137 2026-08-17 Maven
Fixed
  • WebSockets to a local/private address no longer stall (issue #1). Chromium 151 enabled Local Network Access checks for WebSockets by default; a page connecting to localhost / a LAN address gated the handshake on a permission decision Cefrium has no UI to resolve, so it stalled (reported as extreme WebSocket latency after the 0.6.x -> 0.7.0 bump). Cefrium now disables the LNA feature, matching Android WebView. Validated on device: before, the handshake never completed; after, it connects immediately (50 messages round-trip in ~100 ms). A WebSocket regression guard was added to the on-device release gate.
Changed
  • Engine: Chromium 151.0.7922.71 -> 151.0.7922.137 (same CEF branch 7922). A same-branch security roll-up for CVE parity with the Debian Chromium release. No API changes.
Source tag v0.7.1 com.cefrium:cefrium-sdk:0.7.1
0.7.0 CEF 7922 Chromium 151.0.7922.71 2026-08-03 Maven
Changed
  • Engine: Chromium 150.0.7871.114 -> 151.0.7922.71 (CEF 7871 -> 7922). Tracks the Debian Chromium security release for CVE parity. The API surface is unchanged for SDK consumers; Cefrium.CHROMIUM_VERSION now reports 151.0.7922.71. Validated on device (full instrumented + sample smoke + close-leak gates green on the W90).
Source tag v0.7.0 com.cefrium:cefrium-sdk:0.7.0
0.6.5 CEF 7871 Chromium 150.0.7871.114 2026-08-03 Maven
Added
  • CefriumBrowser.setMediaSessionActivity(PendingIntent) (and Compose CefriumNavigator.setMediaSessionActivity) lets a multi-tab host make the media notification / lock-screen control open the SPECIFIC tab that is playing, not just the app. Each browser's MediaSessionCompat carries a settable session activity (overriding the default launcher intent added in 0.6.4); passing null restores the default. Validated on device.
Source tag v0.6.5 com.cefrium:cefrium-sdk:0.6.5
0.6.4 CEF 7871 Chromium 150.0.7871.114 2026-07-31 Maven
Fixed
  • Tapping the media notification / lock-screen control now opens the app (the tab playing the media) instead of another app. CefriumMediaSession now sets a contentIntent on the notification and setSessionActivity on the MediaSessionCompat (the host app's launcher intent). Without a tap target, Android routed the control's tap to another active media session's owner (e.g. Spotify) even though the notification showed the Cefrium tab.
Source tag v0.6.4 com.cefrium:cefrium-sdk:0.6.4
0.6.3 CEF 7871 Chromium 150.0.7871.114 2026-07-21 superseded
Fixed
  • Media notification / lock-screen progress bar now advances. CefriumMediaSession now observes Chromium's mediaSessionPositionChanged and pushes the media duration (METADATA_KEY_DURATION) plus the playback position + speed into the MediaSessionCompat PlaybackState, so Android renders and ticks the seekbar. Previously only the play/pause button worked -- the position was PLAYBACK_POSITION_UNKNOWN and no duration was set, so the bar had no range and never moved. Validated on device.
Source tag v0.6.3 com.cefrium:cefrium-sdk:0.6.3
0.6.2 CEF 7871 Chromium 150.0.7871.114 2026-07-13 Fixes CVE-2026-15107 +26 superseded
Changed
  • Engine updated to Chromium 150.0.7871.114 (from 150.0.7871.46), a same-branch security patch bump tracking Debian's 150.0.7871.114-1~deb13u1 upload for CVE parity. The 150.0.7871.114 stable roll-up fixes 27 vulnerabilities, including two CRITICAL use-after-free flaws -- CVE-2026-15112 (Ozone) and CVE-2026-15129 (Views) -- plus high-severity memory-safety fixes across V8, ANGLE, WebRTC, Codecs, Autofill, Payments, Input, DOM and Forms. All 142 CEF + Android-port patches re-apply cleanly on the new tree (same CEF branch 7871 -- no rebase or patch regeneration needed). CVEs: CVE-2026-15107, CVE-2026-15108, CVE-2026-15109, CVE-2026-15110, CVE-2026-15111, CVE-2026-15112, CVE-2026-15113, CVE-2026-15114, CVE-2026-15115, CVE-2026-15116, CVE-2026-15117, CVE-2026-15118, CVE-2026-15119, CVE-2026-15120, CVE-2026-15121, CVE-2026-15122, CVE-2026-15123, CVE-2026-15124, CVE-2026-15125, CVE-2026-15126, CVE-2026-15127, CVE-2026-15128, CVE-2026-15129, CVE-2026-15130, CVE-2026-15131, CVE-2026-15132, CVE-2026-15133.
Fixed
  • isPlayingAudio() now uses only the actual-playback signal, not the is_suspended flag (which flickers mid-playback for media documents and made the getter spuriously read false for an audible tab). Now !mPlayingIds.isEmpty().
Source tag v0.6.2 com.cefrium:cefrium-sdk:0.6.2
0.6.0 CEF 7871 Chromium 150.0.7871.46 2026-07-05 Fixes CVE-2026-13789 superseded
Changed
  • Engine updated to Chromium 150.0.7871.46 (from 149.0.7827.102), tracking Debian's security upload for CVE parity (includes the CVE-2026-13789 V8 fix and the rest of the 150 security roll-up). The Android port was rebased onto CEF branch 7871 and adapted to the Chromium 150 API: permission-prompt embedder seam regenerated, Android autofill client HideAutofillSuggestions -> HideSuggestions, RenderWidgetHostView::Show() -> ShowWithVisibility(), non-final R via app_as_shared_lib, and the payments Java service_impl_java dep. No SDK API changes for consumers -- a drop-in engine/security refresh.
Source tag v0.6.0 com.cefrium:cefrium-sdk:0.6.0
0.5.9 CEF 7827 Chromium 149.0.7827.102 2026-07-03 superseded
Fixed
  • FedCM crash on federated sign-in pages. The Gradle plugin now generates the R class for org.chromium.chrome.browser.ui.android.webid; without it, a page that invoked the FedCM account chooser (AccountSelectionBridge.getBrandIconIdealSize) threw NoClassDefFoundError webid/R$dimen and crashed the browser process. Only reproduced on CERTIFIED devices (where FedCM runs). Validated on Redmi/HyperOS.
Added
  • Incognito (private) browsing. CefriumBrowser.createWithSurface(activity, incognito) + isIncognito(); Compose CefriumViewState(incognito = true) / rememberCefriumViewState(url, incognito). Incognito browsers share one off-the-record request context (isolated from normal tabs, in-memory) that is cleared when the last incognito browser closes. Validated on device: cookie isolation normal<->incognito and clear-on-close.
Source tag v0.5.9 com.cefrium:cefrium-sdk:0.5.9
0.5.8 CEF 7827 Chromium 149.0.7827.102 2026-07-03 superseded
Fixed
  • Tab/session restore now loads the page instead of showing a blank tab (or crashing on some devices). CefriumViewState(navigationState = ...) restore deferred its load to the wrong moment: Restore() ran while the initial about:blank navigation was still pending (so nothing loaded -> blank), and forcing the load in OnAfterCreated navigated before the on-screen surface + overscroll handler existed, crashing the overscroll controller on the RenderFrameHost swap. Now restoreNavigationState rebuilds the stack without loading and schedules the surface connect (which restored tabs previously never did -- only loadUrl did); the load is triggered once, from connectWebContentsInternal, after the surface and handler are set up. Validated on a Redmi/W90 (Android 16, arm64) and rooted API-33/36 emulators, single- and multi-tab.
Source tag v0.5.8 com.cefrium:cefrium-sdk:0.5.8
0.5.7 CEF 7827 Chromium 149.0.7827.102 2026-07-03 superseded
Notes
  • Native pull-to-refresh: an overscroll-down gesture at the top of a page reloads it. Opt-in via CefriumBrowser.setPullToRefreshEnabled(true) (CefriumNavigator.setPullToRefreshEnabled in Compose); the handler binds once when the WebContents connects.
Source tag v0.5.7 com.cefrium:cefrium-sdk:0.5.7
0.5.6 CEF 7827 Chromium 149.0.7827.102 2026-07-02 superseded
Added
  • Tab back/forward history restore. CefriumBrowser.serializeNavigationState() / restoreNavigationState(byte[]) capture and rebuild a tab's full navigation stack (each entry's URL and page state), and CefriumViewState(navigationState = ...) restores it. A tab restored after the app is killed can navigate back through its history, not just show its current page.
Source tag v0.5.6 com.cefrium:cefrium-sdk:0.5.6
0.5.5 CEF 7827 Chromium 149.0.7827.102 2026-07-02 superseded
Fixed
  • Background audio now keeps playing reliably when the app is minimized or the screen is off. The media foreground service is driven by actual WebContents playback instead of the media session's controllability signal (which could flicker), so the process stays alive while audio plays rather than being reclaimed after about a minute.
Source tag v0.5.5 com.cefrium:cefrium-sdk:0.5.5
0.5.4 CEF 7827 Chromium 149.0.7827.102 2026-07-02 superseded
Highlights
  • New host API stopMediaSession() (on CefriumBrowser and the Compose CefriumNavigator): stops the page's media session and dismisses its media notification. It operates at the WebContents level, so it also reaches media inside cross-origin iframes (e.g. a YouTube embed) that page JavaScript cannot pause.
  • Hardware and Bluetooth media keys (play/pause) now control in-page media playback.
Fixed
  • The system media notification now appears reliably for media documents (navigating directly to an audio/video URL) and for pages that wire navigator.mediaSession after load. Previously it could fail to appear depending on when the media session was created.
Source tag v0.5.4 com.cefrium:cefrium-sdk:0.5.4
0.5.3 CEF 7827 Chromium 149.0.7827.102 2026-06-24 superseded
Highlights
  • Web NFC (NDEFReader read/write) works end-to-end -- validated with a physical NDEF tag (read + write round-trip).
  • Renderer-termination callback: get told when a renderer process for your browser dies (e.g. the OEM low-memory killer reclaims it) so you can show a reload affordance instead of a silent blank page.
Added
  • CefriumBrowser.setOnRenderProcessTerminatedListener((status, errorCode) -> ...) with TERMINATION_* status constants. Compose: observe the hoisted CefriumViewState.rendererTermination or pass onRenderProcessTerminated to CefriumWebView.
  • CefriumBrowser.PERMISSION_NFC -- grant Web NFC via your setPermissionHandler or pre-authorize an origin with setContentSetting(url, PERMISSION_NFC, SETTING_ALLOW).
Fixed
  • Web NFC was previously wired but every scan/write was denied or hung. Three engine fixes: CEF mapped the NFC permission to an ungrantable type (added CEF_PERMISSION_TYPE_NFC); NfcBlocklist read a variations field-trial param whose JNI is absent in CEF and threw (guarded); and the consumer also needs android.permission.VIBRATE.
  • Renderer terminations Android reports as OOM_PROTECTED / EVICTED_FOR_MEMORY (the common OEM low-memory-kill path) now reach OnRenderProcessTerminated as TS_PROCESS_OOM -- the callback previously never fired for the most common Android renderer death.
  • Surface-mode crash on close: a deferred WebContents-connect callback could fire after the browser was torn down and dereference a stale pointer (SIGSEGV). It now short-circuits once the browser is closed.
Notes
  • Web NFC consumers must declare android.permission.NFC and android.permission.VIBRATE in their manifest.
  • Do NOT declare your own SandboxedProcessService entries -- the AAR provides them (40 isolated slots); a consumer-side count both fails the manifest merge and caps the pool. See the Memory & process model guide.
Validated
  • Redmi Note 13 Pro 5G / HyperOS: Web NFC read + write round-trip on a physical tag; renderer-termination on a real OEM low-memory kill.
  • W90: instrumented suite 41/41 on device before publish.
Source tag v0.5.3 com.cefrium:cefrium-sdk:0.5.3
0.5.2 CEF 7827 Chromium 149.0.7827.102 2026-06-16 superseded
Highlights
  • Renderer lifetime & memory: showing many pages over time -- e.g. a CefriumBrowserPool of pages, each with a cross-origin iframe -- no longer leaks renderers or crashes on process-per-browser devices (HyperOS / Android 16).
Fixed
  • Closing/evicting a browser now completes Chromium's window-destruction handshake on Android (CloseHostWindow -> WindowDestroyed), so the WebContents and every subframe renderer (host page + cross-origin iframe) are actually destroyed.
  • 40 sandboxed render-process slots (was 5); the visible browser is marked IMPORTANT and detached pooled ones MODERATE, so the OS reclaims idle renderers first and never the active one.
  • Accessibility: apps with an accessibility service active (TalkBack, Switch Access) no longer crash with NoClassDefFoundError SelectionCompat when the a11y tree queries a CEF WebContents.
Added
  • CefriumBrowser.setCookie(url, name, value, secure, httpOnly, sameSite) and the Compose CefriumNavigator parity overload -- explicit Secure / HttpOnly / SameSite (NONE / LAX / STRICT / UNSPECIFIED). The 3-arg setCookie is unchanged.
  • Diagnostics: closedBrowserCount(), activeRenderProcessCount(), totalRenderFrameHostCount(), zeroFrameRenderProcessCount(), liveBrowserCount().
Notes
  • Do NOT declare your own SandboxedProcessService entries -- the AAR provides them; a lower count caps the pool. See the Memory & process model guide.
  • Inline YouTube via loadHtmlWithBaseUrl loads the real player, but YouTube's server-side integrity check rejects locally-injected documents (Error 152, same as WebView's loadDataWithBaseURL). To embed YouTube inline, serve the embed HTML from a real HTTP(S)/localhost origin and use loadUrl().
Validated
  • Redmi Note 13 Pro 5G / HyperOS: 40 pages, maxAlive=3, inline cross-origin YouTube video -- bounded and crash-free.
Source tag v0.5.2 com.cefrium:cefrium-sdk:0.5.2
0.5.1 CEF 7827 Chromium 149.0.7827.102 2026-06-14 superseded
Added
  • loadHtmlWithBaseUrl / loadDataWithBaseUrl on CefriumBrowser and the Compose CefriumNavigator -- load an HTML string with a real base-URL origin and referrer (like Android WebView's loadDataWithBaseURL), so string-loaded content can host embeds that validate their parent origin (no Error 153).
Fixed
  • Startup crash on Xiaomi MIUI / HyperOS (DeviceFormFactor resource-resolver guard).
  • Native-FCM FirebaseMessaging.getToken() -- declares androidx.datastore-preferences for the vendored Firebase token path.
  • The chrome PasswordManager no longer terminates the renderer on a loadDataWithBaseURL data: form (which had left the surface blank).
Packaging
  • Orphaned okio classes stripped from the AAR (consumer's Gradle provides the single copy) -- no checkDuplicateClasses collisions.
Validated
  • On device, both codecs and libre variants.
Source tag v0.5.1
0.5.0 CEF 7827 Chromium 149.0.7827.102 2026-06-10 superseded
Highlights
  • Major web-platform expansion: WebAuthn / passkeys, Web Bluetooth / USB / Serial device choosers, Payment Request (Google Pay), Contact Picker, File System Access, file upload, WebOTP, Web Speech recognition, Web NFC, screen capture, generic sensors, WebRTC, OPFS, and more -- inherits essentially the full Chromium web platform.
Fixed
  • File-picker result routing.
  • Modal-dialog host.
  • Video Picture-in-Picture made crash-safe.
Validated
  • Exhaustively on device.
Source tag v0.5.0
0.4.1 CEF 7827 Chromium 149.0.7827.102 2026-06-09 superseded
Security
  • Chromium security respin: fixes CVE-2026-11645 (out-of-bounds memory access in V8, exploited in the wild) plus the other CVEs in 149.0.7827.102.
  • User-Agent now reports the real engine version.
Source tag v0.4.1
0.4.0 CEF 7827 Chromium 149.0.7827.53 2026-06-08 superseded
Engine
  • Chromium engine bump 148 -> 149 (149.0.7827.53, CEF branch 7827) for CVE parity with Debian Chromium. 20 Android patches; multi-ABI AAR (arm64 + x86_64).
Validated
  • On device: CefInitialize, multi-process renderer, OnPaint off-screen render.
Source tag v0.4.0
0.3.2 CEF 7778 Chromium 148.0.7778.167 2026-06-08 superseded
Added
  • Web Notifications (service-worker showNotification) to the Android shade.
  • Native FCM push (bring-your-own Firebase).
  • Per-origin permission via setContentSetting (View + Compose).
Source tag v0.3.2 Push guide
0.3.1 CEF 7778 Chromium 148.0.7778.167 2026-06-06 superseded
Added
  • Maven-consumable fat AAR (self-contained resources + manifest).
  • Zero-config init (no Application boilerplate).
  • SSL cert-error and HTTP-auth handlers (WebView parity).
Source tag v0.3.1
0.3.0 CEF 7778 Chromium 148.0.7778.167 2026-06-05 superseded
Added
  • Web permissions, getUserMedia, system media controls, print-to-PDF, cookie and dynamic-settings APIs.
Source tag v0.3.0
0.2.1 CEF 7778 Chromium 148.0.7778.167 2026-06-04 superseded
Packaging
  • First multi-ABI artifact (arm64-v8a + x86_64 in one AAR).
Source tag v0.2.1
0.2.0 CEF 7778 Chromium 148.0.7778.167 2026-06-04 superseded
Packaging
  • Per-architecture artifacts; superseded the same day by 0.2.1 (multi-ABI).
Source tag v0.2.0
0.1.0 CEF 7778 Chromium 148.0.7778.167 2026-05-26 superseded
Milestone
  • Early validation release.
Source tag v0.1.0

Each release above is a source tag with notes -- the permanent parity and security record. The consumable .aar artifacts that Gradle resolves are published separately to the Codeberg Maven registry. See the Quickstart for the repository and coordinates, e.g. com.cefrium:cefrium-sdk:0.5.2. This list is the history and never loses an entry, even after an artifact is pruned.

Artifact retention

During early validation the Maven registry serves only the latest version, to respect Codeberg's donation-funded storage. Superseded versions are not retained as binaries; each is reproducible from its source tag (see the build process in BUILD-GUIDE), and every release carries a SHA256SUMS of the artifacts as published for verification. This policy will be revisited before 1.0 / first production adopters.

The SHA256SUMS file is GPG-signed (SHA256SUMS.asc, detached) with the maintainer's key, fingerprint 2A84 0ED0 0DE6 69F4 219B 8B33 02A7 9E3B 8215 1695. To verify a download:

gpg --recv-keys 02A79E3B82151695        # once, to fetch the public key
gpg --verify SHA256SUMS.asc SHA256SUMS  # checks the signature
sha256sum -c SHA256SUMS                 # checks the artifacts against it

Versioning: a release that adds public API is a minor bump; a fixes-only release is a patch; CEF/Chromium engine bumps are recorded regardless. See VERSIONING-CEFRIUM.md.