Security
What protects you, and what doesn’t yet
Privacy is half of it. Here is how Cra keeps up with Chromium’s security fixes, what it does to keep sites apart, and where it still falls short of Chrome.
Checked on Cra 0.1.14 (Chromium 156.0.8078.48), 27 October 2026
At a glance
| Chromium security updatesWatched daily, shipped as a new engine build | On |
| Automatic updatesSigned by Cra, checked every 8 hours | On |
| Signed and notarizedDeveloper ID, notarized by Apple | On |
| Site isolationEach site in its own process, as in Chrome | On |
| Sandbox for web pagesChromium’s macOS sandbox, since 0.1.14 | On |
| Downloads marked for GatekeepermacOS checks downloaded apps before they open | On |
| Phishing and malware warningsNo Google Safe Browsing | Not yet |
| Passwords and cookies encryptedKey in your macOS Keychain | On |
| Separate profiles and incognitoPer space, and in incognito windows | On |
How Chromium security fixes reach you
Cra renders pages with Chromium Embedded Framework (CEF), a packaged version of Chromium, the engine inside Chrome. Cra builds its own copy of it to include H.264 and AAC video, so a Chromium fix reaches you when Cra ships a new engine, not when Chrome updates.
Every morning an automated check compares the engine in Cra with the newest stable CEF. When Cra is behind, it opens a public issue on GitHub saying so. A fix on the same Chromium version takes one to two hours to build; a new Chromium version takes three to four. The build is then signed, notarized and released.
CEF publishes its builds after Chrome’s, so Cra can never be ahead of Chrome and is usually some days behind it. Cra is made by one person, so there is no guaranteed turnaround. When the check first flagged Chromium 156, Cra shipped it the same day, in 0.1.10.
Cra checks for a new version every 8 hours and downloads it in the background. It installs when you quit Cra, or restarts into it while you’re away from your Mac. Choose Cra ▸ Check for Updates… to check now. Every update is signed with Cra’s own key, and Cra refuses one whose signature does not match.
Which Chromium you are running
Three places show it: Settings ▸ Advanced, next to About; the first line of the Help menu; and Cra ▸ About Cra. Each release note says when the engine moved.
What checking for updates sends
Cra downloads a short list of releases (appcast.xml) from Cra’s GitHub releases, and the update itself from there too. GitHub sees your IP address and the Cra version in the request. Sparkle, the updater Cra uses, can also send a profile of your Mac; Cra turns that off. There is no install id and no account.
Separately, Chromium keeps a few parts of itself up to date from Google’s servers, as Chrome does: the list of revoked certificates, the Widevine module for protected video, and similar data files. Those requests name the engine version and your macOS version, not the pages you visit.
Signed and notarized
Cra is signed with an Apple Developer ID and notarized by Apple, so macOS checks it for known malware before it first opens, and the hardened runtime is on. It keeps the same few exceptions as CEF’s reference app, because Chromium’s JavaScript engine compiles code as it runs.
Cra is open source under the MIT licence. Anyone can read the code and build the same app.
Site isolation
Cra runs Chromium’s site isolation unchanged: pages from different sites load in different processes, so a page cannot read another site’s data out of shared memory. Cra adds no switch that weakens it. Type chrome://process-internals in the command bar to see it say “Site Per Process”.
Sandbox for web pages
Since 0.1.14, Cra runs web pages inside Chromium’s macOS sandbox, as Chrome does, so a page that exploits a bug in the engine still cannot read your files or start programs. The processes for pages, the GPU, the network, storage and audio are all sandboxed; video capture is not, which is Chrome’s choice too. Cra 0.1.13 and earlier ran them with the sandbox off, so update if you haven’t.
Downloads
Files you download are marked as downloaded from the internet, with the site they came from. When you open a downloaded app, macOS Gatekeeper checks its signature first and asks before running it, as it does for Safari and Chrome downloads.
Cra does not have Google Safe Browsing, the list Chrome uses to warn about phishing pages, malware sites and dangerous downloads. It needs access to Google’s Safe Browsing service, which builds of CEF like Cra’s do not have, so Cra shows no warning on a known phishing page. Cra’s ad and tracker blocking stops many malicious ad networks, but it is not a replacement.
Passwords and cookies
Saved passwords, cookies and card numbers are encrypted, as in Chrome, with a key stored in your login Keychain under “Cra Safe Storage”, a key of Cra’s own rather than one shared with other Chromium apps.
Links from other apps
Cra’s cra:// links let you script Cra from Terminal. Web pages cannot use them at all, and other apps can only open a web address or the command bar. To script Cra from another app, allow it once with defaults write dk.kildahl.cra scriptingURLs -bool YES.
Separate profiles and incognito windows
A profile keeps its own cookies, sign-ins, site storage and cache. Create one in Settings ▸ Profiles, then choose it for a space in Edit Space. The space’s tabs are then signed in separately from your other spaces, so work and personal accounts stay apart, like Firefox containers. Each profile adds some memory while its tabs are open.
An incognito window (⇧⌘N) keeps cookies, site storage and cache in memory and throws them away when the last incognito window closes. Its pages are not added to history, its tabs are never saved, and the command bar in it does not show your other tabs or history. Files you download stay in your Downloads folder.
Reporting a security problem
Report it privately through GitHub’s private vulnerability reporting, not in a public issue, so the details stay between you and Cra until a fix ships. Include the Cra version and the steps or a page that shows the problem. Reports are read within a few days, and reporters are credited in the release notes, as in Cra 0.1.11.
Bugs in Chromium itself belong with the Chromium project. If Cra is still on a Chromium version with a known, fixed vulnerability after a few days, an ordinary issue is the right place.