Ruthenium: Custom Chromium Build for Android Adds Russian Trusted Root CA Support
Ruthenium is a custom build of Chromium for Android that adds support for the Russian Trusted Root CA certificate from the Ministry of Digital Development without modifying the system certificate store.
Many Russian banks and government services use TLS chains ending at this root. Standard Google Chrome on Android rejects these chains with NET::ERR_CERT_AUTHORITY_INVALID because the root is absent from Chromium’s built-in store. The author wanted to keep using Chrome’s interface and therefore created a separate APK that includes the root with strict DNS constraints limited to .ru and .рф zones.
Why Chrome rejects the chain
The browser receives the site certificate and intermediates, validates names, validity periods and signatures, then attempts to build a path to a trusted root. Because Russian Trusted Root CA is not present in Chromium, verification fails. Existing solutions either require switching to another browser or installing the root into Android’s system store, which affects all applications.
Technical implementation of the patch
The certificate is converted from PEM to DER and embedded as a byte array in chrome/browser/net/profile_network_context_service.cc. The patch creates a CertWithConstraints object that adds the root with permitted_dns_names set to {“.ru”, “.xn--p1ai”}. This constraint applies to all DNS names listed in the certificate’s Subject Alternative Name, preventing misuse outside the allowed TLDs. The build scripts verify the DER SHA-256 against a lock file before compilation.
Four C++ files are modified in total: the network context service for the constrained root, primary_account_manager.cc to disable browser-level sign-in by default, and two omnibox/searchbox files to replace unavailable XR icon methods on Android builds without VR support.
Build configuration and distribution
The release uses is_official_build=true with ThinLTO enabled but external PGO profiles disabled. VR and AR features are turned off via GN flags. Each APK is published with a release tag that incorporates the Chromium revision, certificate digest, and build arguments, enabling traceability. Checksums, ABI information, and apksigner verification results accompany every binary.
Ruthenium installs under the package name app.ruthenium.browser and keeps its data separate from Chrome. No auto-update mechanism is provided; users must install new versions manually. The browser behaves identically to upstream Chromium on non-Russian domains.
Related articles
Rosfinmonitoring Denies Mass Bank Account Blocks Over Partial Data Matches with Sanctions Lists
Rosfinmonitoring has issued clarifications rejecting reports of potential widespread freezes of bank accounts due to partial matches between client data and records of individuals subject to asset freezes. The agency stressed that the draft law is not intended to penalize people who merely share surnames or have similar name transliterations with sanctioned persons. Criteria for determining partial matches have not yet been defined and will be established by a separate order only after the federal law is adopted and real cases are analyzed. The measure provides only for temporary suspension of a transaction rather than automatic refusal or indefinite account blocking. Earlier reports from Izvestia had warned that loosely defined partial-match rules could generate numerous false positives affecting ordinary clients.
Understanding GOST Cryptography Standards: A Practical Guide for Russian Developers
The article provides a beginner-friendly breakdown of Russian GOST cryptographic standards, separating the core functions of hashing, digital signatures, and encryption. It covers the evolution of GOST algorithms across three generations from the 1990s to the current 2012+ standards including Stribog, Kuznechik, and Magma. Detailed explanations address how PKCS#11 interfaces with hardware tokens, how X.509 certificates function as digital passports, and how formats like CAdES, XAdES, and PAdES package signatures for verification. Comparisons with Western equivalents such as SHA-256, RSA, and AES help developers map familiar concepts to GOST implementations. The guide emphasizes practical integration with tools like CryptoPro for tasks involving detached signatures and certificate requests in PKCS#10 and PKCS#12 containers.
Why Vulnerability Management Specialists Must Master Compliance: Closing All CVEs but Leaving admin:admin
The article explains how compliance has evolved from a paperwork exercise into a mandatory, heavily penalized process in Russian cybersecurity. New regulations such as FSTEC Order 117, turnover fines for personal data leaks, and Presidential Decree 250 impose strict timelines and personal liability for vulnerability management failures. It outlines three approaches to compliance, from doing nothing to building custom standards based on CIS Benchmarks and local requirements. The text stresses moving from reactive scanning to golden images that embed compliance controls before deployment. It highlights tools like MaxPatrol HCC, RedCheck, and ScanOVAL for automated checks and warns that technical patches alone are useless without proper configuration controls such as strong passwords.
China Public Security Ministry Warns IoT Operators: Default Passwords on Devices Like Bus Stop Displays Violate Cybersecurity Law Even Without Major Incidents
A bus electronic display router in Wuhu, Anhui, was compromised in April 2026 because the device retained factory-default credentials and exposed multiple management ports. The Ministry of Public Security highlighted the case in its Hu Wang 2026 report, stressing that failing to change default passwords and leaving ports open constitutes a violation of the Cybersecurity Law regardless of whether serious harm occurred. The RCtea botnet actively targeted similar routers and cameras across China, infecting 9,827 devices in just six days in January 2026 through Telnet brute-force attacks. Experts from the Chinese Academy of Social Sciences clarified that penalties do not require actual damage and that operators must implement technical measures, retain logs for at least six months, and maintain internal security procedures. Additional cases in Qinghai and Nanchong demonstrated repeated enforcement actions against entities that ignored weak-password remediation orders. The report calls on operators, regulators, and manufacturers to enforce password changes at installation, close unnecessary ports, and apply network segmentation to prevent low-hanging IoT devices from becoming botnet recruits.