Preserve mobile browsing state and Android back navigation

[phucnguyen1707]

Summary

• Preserve Browser, Chat, Agents and Settings state when switching tabs, while keeping inactive screens non-interactive.
• Use a no-account-required search default, handle Android Back only for the active browser's history, and apply safe-area insets to browser controls and tabs.
• Include HTTP(S) popup handling in the current WebView and correct the platform-specific cookie-setting copy.
• Add component/regression tests and a reproducible device smoke checklist.

Validation

• Mobile: 34 tests passed, TypeScript and ESLint passed.
• Both platform JavaScript exports and Android autolinking passed locally.
• Independent code review completed before push.

Remaining Gates

This is a draft for code review, not release approval. No EAS build/update, store submission or production deployment was run.
No Android SDK/device is available in the local environment, so actual WebView history, popup and inset behavior still need the documented device smoke test. The repository's existing PR workflow can produce a Gradle APK without EAS credits; a successful APK compile is not runtime proof.
Existing Expo dependency patch drift remains a release gate. The separate native Chromium engine is not changed.

[github-actions]

ThreatCrush Security Scan

49 finding(s)

MEDIUM: 31 | LOW: 18

Severity	Rule	Location
MEDIUM	js-open-redirect	apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/sidepanel.js:77
MEDIUM	js-unescaped-html-sink	apps/desktop/extensions/ai-sidebar/sidepanel.js:165
MEDIUM	sh-remote-script-execution	apps/desktop/launcher/tronbrowser:84
MEDIUM	sh-remote-script-execution	apps/desktop/launcher/tronbrowser:394
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:77
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:227
MEDIUM	js-unescaped-html-sink	apps/extensions/public/store.js:569
MEDIUM	js-unescaped-html-sink	apps/web/public/app.js:29
MEDIUM	js-unescaped-html-sink	apps/web/public/dns.js:54
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:138
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:143
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:242
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:260
MEDIUM	sh-remote-script-execution	apps/web/public/install.sh:870
MEDIUM	js-unescaped-html-sink	apps/web/public/settings.js:96
MEDIUM	js-unescaped-html-sink	apps/web/public/settings.js:168
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:80
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:92
MEDIUM	js-dynamic-code-execution	packages/sdk/src/mcp/tools.ts:103
MEDIUM	js-dynamic-code-execution	packages/sdk/src/page.ts:65
MEDIUM	js-dynamic-code-execution	packages/sdk/src/page.ts:70
MEDIUM	sql-template-interpolation	services/api/src/store/db.ts:116
MEDIUM	js-dynamic-code-execution	services/api/src/store/scanner.ts:44
MEDIUM	sh-predictable-temp-path	start.sh:25
LOW	js-dynamic-code-execution	packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW	js-unescaped-html-sink	packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW	js-unescaped-html-sink	packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW	js-dynamic-code-execution	packages/browser-core/src/automation/extract-script.test.ts:6
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:35
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:47
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:70
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/extract-script.test.ts:89
LOW	js-dynamic-code-execution	packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/snapshot-script.test.ts:24
LOW	js-unescaped-html-sink	packages/browser-core/src/automation/snapshot-script.test.ts:63
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:47
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:170
LOW	js-unescaped-html-sink	packages/provenance/src/scan.test.ts:216
LOW	secret-generic-api-key	packages/storage/src/config.ts:51
LOW	secret-generic-credential	packages/storage/src/config.ts:51
LOW	js-dynamic-code-execution	services/api/src/store/scanner.test.ts:32
LOW	js-hardcoded-crypto-key	services/api/src/store/signing.test.ts:24

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​react-test-renderer@​19.1.0
	react-native-safe-area-context@​5.7.0
	react-test-renderer@​19.2.3

View full report