Ruthenium: Custom Chromium Build for Android Adds Russian Trusted Root CA Support
Ruthenium is a custom build of Chromium for Android that adds support for the Russian Trusted Root CA certificate from the Ministry of Digital Development without modifying the system certificate store.
Many Russian banks and government services use TLS chains ending at this root. Standard Google Chrome on Android rejects these chains with NET::ERR_CERT_AUTHORITY_INVALID because the root is absent from Chromium’s built-in store. The author wanted to keep using Chrome’s interface and therefore created a separate APK that includes the root with strict DNS constraints limited to .ru and .рф zones.
Why Chrome rejects the chain
The browser receives the site certificate and intermediates, validates names, validity periods and signatures, then attempts to build a path to a trusted root. Because Russian Trusted Root CA is not present in Chromium, verification fails. Existing solutions either require switching to another browser or installing the root into Android’s system store, which affects all applications.
Technical implementation of the patch
The certificate is converted from PEM to DER and embedded as a byte array in chrome/browser/net/profile_network_context_service.cc. The patch creates a CertWithConstraints object that adds the root with permitted_dns_names set to {“.ru”, “.xn--p1ai”}. This constraint applies to all DNS names listed in the certificate’s Subject Alternative Name, preventing misuse outside the allowed TLDs. The build scripts verify the DER SHA-256 against a lock file before compilation.
Four C++ files are modified in total: the network context service for the constrained root, primary_account_manager.cc to disable browser-level sign-in by default, and two omnibox/searchbox files to replace unavailable XR icon methods on Android builds without VR support.
Build configuration and distribution
The release uses is_official_build=true with ThinLTO enabled but external PGO profiles disabled. VR and AR features are turned off via GN flags. Each APK is published with a release tag that incorporates the Chromium revision, certificate digest, and build arguments, enabling traceability. Checksums, ABI information, and apksigner verification results accompany every binary.
Ruthenium installs under the package name app.ruthenium.browser and keeps its data separate from Chrome. No auto-update mechanism is provided; users must install new versions manually. The browser behaves identically to upstream Chromium on non-Russian domains.
Related articles
US Federal Judge Orders Google to Simplify Installation of Third-Party App Stores on Android
A federal judge has directed Google to remove extra warnings and confirmation steps when users install competing app stores through Google Play on Android devices. The ruling stems from the ongoing antitrust litigation between Epic Games and Google, where a jury previously found that Google illegally maintained a monopoly over Android app distribution and in-app payments. Judge James Donato criticized the current multi-screen process as an intentional barrier designed to discourage ordinary users from choosing alternatives. Google must implement the changes within one week, making the installation of third-party stores as straightforward as any other Android application. The decision acknowledges that while Android has long permitted sideloading, the layered security prompts and hidden permission toggles effectively steered most users back to Google Play. Aptoide has already appeared in the US Google Play store as the first third-party marketplace to benefit from the eased process. Google argued the warnings protect users from malware, but the court rejected the notion that security should serve as a shield for market dominance.
Why Russia Needs Specialized Circumvention Tools Beyond Standard VPNs
The developers of Tunnel Kitten explain why another circumvention project is necessary despite the availability of numerous VPN services and solutions like AmneziaWG. A prolonged outage affected many long-term users, damaging trust and requiring ongoing fixes. Standard VPNs do not address the core issue: creating and maintaining tools to bypass internet blocks has been criminalized in Russia. This legal asymmetry makes public VPN services and self-hosted solutions risky or insufficient for users facing state-level censorship. Tunnel Kitten positions itself as a project focused on a different task that accounts for these legal realities. The team emphasizes that the problem is not merely technical but tied to the criminalization of circumvention efforts.
US Presidential Memo Authorizes Selected Private Companies to Join Federal Cyber Operations Against Foreign Criminal Groups
The United States government has established a formal program allowing vetted private-sector companies to participate in offensive cyber operations targeting foreign criminal organizations. Signed by President Donald Trump on August 12, 2026, the presidential memorandum places the initiative under the National Coordination Center with joint oversight from the Department of Justice and the Department of Homeland Security. Participating firms will operate exclusively under government contracts, direction, and supervision, with strict requirements including technical evaluations, financial guarantees of at least one million dollars, and pre-approval for every operation. The program focuses on disrupting ransomware, phishing, financial fraud, and other schemes affecting American citizens while imposing clear limits to prevent unintended harm to US persons or escalation to prohibited levels of force. In contrast to Brazil’s ongoing policy discussions, the US move formally recognizes that advanced offensive capabilities now reside primarily in the private sector and creates a regulated mechanism to access them. Operational rules must be published within 60 days, marking a significant shift in how governments integrate private expertise into state-directed cyber actions.
Russia to Require Independent Lab Testing of Sovereign AI Models for Legal and Traditional Values Compliance
The Russian Ministry of Digital Development is discussing a certification scheme under which developers can submit large generative AI models to accredited independent laboratories. These labs will verify compliance with Russian legislation and traditional spiritual-moral values defined in presidential decree No. 809. Only models seeking official national or sovereign status, which unlocks state support, data access and priority procurement, will undergo the process. Developers must first conduct self-testing according to a risk-oriented methodology and supply architecture details, filtering mechanisms and other documentation. Accredited laboratories will then run benchmarks, attempt prompt-injection attacks and produce evaluation reports, while the final decision remains with MinTsifry. Separate security assessments for government systems will be performed by the FSB and FSTEC Russia. Experts have called for transparent, reproducible tests and periodic re-certification after model updates.