Vanadium "open external links in incognito" behavior

Hb1hf

First time testing this option in Vanadium.

Every time I share a link with Vanadium, it opens in a whole new Vanadium window with only this 1 incognito tab open inside it.

Meanwhile the main Vanadium instance with it's incognito and normal tabs remain open in another window.

Is that the expected behavior?
If so, is there a reason for this?

Carlos-Anso

Hb1hf
I dont see this behavior. Have you changed anything of the settings in chrome flags ?

Hb1hf

Carlos-Anso no, never opened them. Barely even messed around in the normal settings.

Btw, I didn't click a link in another app, I opened a url in Mull and shared it with Vanadium. Not sure it should make a difference.

PS: I'm not even sure this is a bad thing per se. Given Chromium's allegedly bad isolation of cookies/data between sites, I figure this would give a positive extra level of separation.

Carlos-Anso

Hb1hf shared it with Vanadium.

Ah. I do not tend to do that. Just tested and I see the same.

Hb1hf Given Chromium's allegedly bad isolation of cookies/data between sites,

Not at all sure Firefox has better isolation anywhere? Certainly Chromium on Android has better isolation

Firefox doesn't even use a content sandbox on Android let alone site sandboxing. It has multi-process on Android but doesn't provide a sandbox around those processes yet even though the Chromium layer-1 sandbox is provided as an option to all apps by Android as a standard API.
https://x.com/GrapheneOS/status/1805580001208668421

It has other missing hardening aside from that but the main issue is simply that they don't use their sandbox on Android, so the only sandbox is the overall app sandbox which doesn't protect sites from each other or your browser data from sites as site isolated sandboxes would
https://x.com/GrapheneOS/status/1805580231454908659

Hb1hf

Carlos-Anso Not at all sure Firefox has better isolation anywhere? Certainly Chromium on Android has better isolation

I didn't say that.
But some do: https://divestos.org/pages/browsers

I've seen fingerprint-testing pages detect logged accounts on desktop Brave, so I have no difficulty believing Chromium has zero data isolation. Unless it's something relatively new (less than a year or so).

Carlos-Anso Firefox doesn't even use a content sandbox on Android

That sounds wrong. Strict ETP was supposed to turn on dFPI, even if it's not the default setting. And FPI is enabled in Mull by default.