v0.1.28111 Sep 2026·Rendering, Memory & reading

See a site's own rules protect you, and what it was never told

Three privacy defenses you can now see working, all decided and kept on your device. When a site publishes its own security rules - a list of which scripts it is willing to run - Floati honours them and refuses the rest, including scripts injected into the page that the site never intended, the main way cross-site scripting attacks are stopped. Each script refused this way now appears to you as a checkable record rather than happening invisibly. The panel also counts, for the first time, the background connections a page made that were told nothing at all about where you came from, where a normal browser would have handed over your address. And the everyday details every site can read about you - your clock, your language, your device's basic specs - are held to the same standard values for everyone, so they cannot be combined to single you out, now guaranteed against slipping. The security architecture aspect moves 59 to 61; the overall platform score stays at 70.

Parity with the reference browser

74overall, as of v0.1.343

Web APIs / DOM surface42

Security architecture66

GPU / graphics acceleration68

DevTools / extensions72

Networking85

Media85

Accessibility85

Real-world site compatibility99

HTML parsing100

CSS parsing + selectors100

Layout: block / flex / grid / tables / writing-modes100

Paint + visual100

JavaScript language100

JavaScript performance (JIT)100

HTML parsing100

What changed 3 changes

Rendering	A site's own security rules now protect you visibly. Many sites publish a policy saying exactly which scripts they are willing to run. Floati enforces it and refuses everything else - including a script secretly injected into the page that the site never meant to run, which is the main way cross-site scripting attacks work. Every script stopped this way, whether loaded from elsewhere or slipped inline into the page, now appears in the panel as a record you can open and check, instead of being turned away silently.
Rendering	See what other sites were never told. When a page opens background connections to other places, a normal browser hands each one your address. The panel now counts how many of those connections Floati sent nothing at all about where you came from, so you can see the protection as a real number rather than take it on trust.
Memory & reading	The everyday details sites read about you are held steady for everyone. Your clock and time zone, your language, and your device's basic specifications are the kind of small facts that, combined, can quietly single you out. In Floati they come back as the same standard values for every user, carrying nothing that tells you apart, and that sameness is now locked so a future change cannot let the real values start leaking.