This release comes from a full audit of what earlier passes missed. Every change was argued for and against before it went in. Three settings that do nothing in Brave are gone and 16 new ones are in. About 30 descriptions now say what the setting really does, and the scripts handle files more safely when run as root or administrator. The tool now has 89 rows over 84 keys (90 over 85 on Windows), checked against Brave 1.98.64 on Chromium 156.
Removed
-
Disable Shopping List, Disable Alternate Error Pages, Disable DNS Interception Probes. None of them does anything in Brave on any channel:
- the shopping list is compiled out and needs a Google sign-in Brave never makes;
- Brave never runs the error-page helper;
- the DNS probes run only when another policy turns them on.
All three are also removed from the presets that set them.
Windows and macOS: Apply and Reset delete these three wherever an older SlimBrave left them. They also delete four more that older versions wrote: EnableDoNotTrack, IPFSEnabled, FeedbackSurveysEnabled and PromotionsEnabled. Each goes only while it still holds the value SlimBrave wrote.
Preset changes
- Limit Variations leaves Balanced Privacy and Developer. It refuses the server-side studies Brave uses to turn on WebGL/WebGPU fingerprint masking for every Release user. It also blocks clean-link copying and a Google sign-in fix. Maximum Privacy keeps it, because there it keeps strict HTTPS enforced, and its description says what you lose and that
brave://flagsrestores the masking. - Always Open PDF Externally leaves Maximum Privacy. Turning off the PDF viewer makes you easier to fingerprint, and Shields can't hide it. The setting itself stays.
- Force Hardware Acceleration leaves Performance Focused. Brave already has it on, so the lock added no speed and took away a troubleshooting switch.
- Web Notifications no longer offers Ask. When a policy sets Ask, no notification ever gets through. Not managed keeps Brave's normal prompt.
New settings
- Maximum Privacy: Disable XSLT, Disable JavaScript Optimization (hardening), Force Site Isolation for Every Site, Isolate Subdomains in Separate Processes.
- Maximum and Balanced Privacy: Block Command-Line Extensions (--load-extension). Malware uses that switch to slip an extension into Brave's shortcuts.
- Maximum Privacy, Balanced Privacy and Developer: Disable Google Image Descriptions. A profile that accepted this in an older Brave still sends images to Google whenever a screen reader runs.
- Strict Parental Controls:
- Force YouTube Restricted Mode (Strict)
- Lock Safe Browsing On (Standard)
- Block Bypassing Safe Browsing Warnings
- Block Bypassing Certificate Warnings
- Prevent Deleting History
- Opt-in, in no preset:
- Clipboard Read Access (Ask or Block)
- Block Local Network Access
- Block Microphone Access
- Block Camera Access
- Remove 'Always Allow' from App-Launch Prompts
- Block Dynamic Code in the Browser Process (Windows only)
Descriptions corrected
- Settings that only lock Brave's default now say what Brave already does and what the lock stops. This covers:
- third-party cookies and referrers
- Global Privacy Control and tracking parameters
- De-AMP and debouncing
- language fingerprinting and motion sensors
- URL-keyed data collection and browser sign-in
- Disable Metrics Reporting now says it stops crash-report uploads. Brave sends no Chromium usage statistics.
- Side effects are named:
- Disable Printing also removes Save as PDF and stops Leo reading Google Docs.
- Disable Developer Tools breaks the Screenshot tool's Full page.
- Disable Default Browser Prompt removes the Make default button.
- Force Incognito also removes Tor windows, Leo and Rewards.
- Force Shields On still lets the Shields toggle unblock third-party cookies for a site.
- Location's Ask prompts every time and remembers nothing.
- Disable Brave AI Chat: Brave still downloads Leo's tool-scripts component. Nothing uses it while Leo is off.
- Wayback Machine: Brave now shows the archive offer on its own for some users, and the setting stops that too.
- README:
- A new section lists what no policy can reach, such as the new tab page widgets and the sidebar.
- A new note says that any DoH policy stops Brave VPN forcing secure DNS on Windows.
Safer file handling and import
- Linux and macOS under sudo:
- Export now writes the file as you, not root. A folder you can't write to now fails instead of being created as root.
- Import is capped at 1 MiB.
--policy-fileonly accepts SlimBrave's own file names in Brave's policy folders.- Helper programs run by absolute path.
- Policy files are synced to disk and are always readable by Brave. A strict umask used to make Brave ignore every policy.
- macOS:
- Apply and Reset keep policies that other tools wrote to the shared plist.
- Selecting only some channels no longer strips another channel's policy.
- A failed profile hand-off is reported.
- Windows:
- The profile cleanup only touches your own account and skips folder links. It now covers Brave Origin profiles too.
- Failed writes are reported instead of counted as applied.
- Other tools' policy lists are left alone.
- DoH templates with a missing brace are refused.
- Import, in all three scripts:
- A file with no settings block is refused before anything changes.
- Each value must have its policy's type.
- If an imported file turns on two settings that conflict, the one listed later wins, as Brave does, and the status says which was dropped.
- On Windows, a failed import puts your previous selections back.
Known gaps, not changed in this release
Listed in AUDIT.md under What's next:
- Sandbox the Network Service was withdrawn before release. On Windows,
brave://sandboxshowed Brave's network process running unsandboxed. The setting comes back once a check shows it working. - The Windows script has not had a full manual pass. Its new import and apply code passed CI's PowerShell parse and analyzer checks, and the script launches cleanly.
- Clear-on-exit and Don't Save History wait on runtime checks. Don't Save History would crash Brave Sync today.