Improve web privacy for users with Ephemeral Custom Tabs

Android developers sometimes need an ephemeral web experience to meet their app requirements. An Ephemeral Custom Tab is a specialized Custom Tab that launches a fully isolated web browser from within an app. This can be used for authentication strategies that shouldn't sync login state with the browser or web sessions where data shouldn't be retained, such as a private browsing mode.

By default, Custom Tabs share state and features from the user's browser. In an Ephemeral Custom Tab, cookies, cached files, history, credentials and other data exist only in the scope of the session's instance. When the Custom Tab Activity is closed, the data is deleted without a trace.

Like Custom Tabs, an Ephemeral Custom Tab can be customized with actions and UI theming. If you are already using Auth Tab for authentication strategies, ephemeral browsing can be added to the launch intent, adding another layer of privacy to the process.

Ephemeral Custom Tabs are available from Chrome 130 and can be instantiated with a single line of code. For users where the feature isn't available, you can validate whether ephemeral browsing is enabled and seamlessly integrate fallback alternatives.

Launch an ephemeral session

Ephemeral Custom Tabs require the AndroidX browser library. The AndroidX Browser Library can be added in the dependencies section of a project's build.gradle file. The APIs are available in an alpha build. Add the following to your build file:

dependencies {
    implementation 'androidx.browser:browser:1.9.0-alpha01'
}

To create an ephemeral browsing session, use the custom setter provided in CustomTabsIntent:

// In your activity

String url = "https://developers.android.com";
CustomTabsIntent customTabsIntent = new CustomTabsIntent.Builder()
    .setEphemeralBrowsingEnabled(true)
    .build();

customTabsIntent.launchUrl(MainActivity.this, Uri.parse(url));

Because ephemeral browsing is triggered by an intent extra in the standard Chrome Custom Tabs implementation, customizations can be added just as in typical custom tabs.

// Add customizations

String url = "https://developers.android.com";
CustomTabsIntent customTabsIntent = new CustomTabsIntent.Builder()
    .setEphemeralBrowsingEnabled(true)
    .setUrlBarHidingEnabled(false)
    .setShareState(CustomTabsIntent.SHARE_STATE_OFF)
    .setCloseButton(BitmapFactory.decodeResource(getResources(), R.drawable.ic_back_arrow))
    .build();

customTabsIntent.launchUrl(MainActivity.this, Uri.parse(url));

For developers using Auth Tab, add the ephemeral browsing setter to the AuthTabIntent:

// Add ephemeral browsing to Auth Tab

AuthTabIntent authTabIntent = new AuthTabIntent.Builder()
    .setEphemeralBrowsingEnabled(true)
    .build();
authTabIntent.launch(launcher, uri, redirectScheme);

Some customizations are modified or unavailable in an ephemeral tab:

  • History isn't logged in an ephemeral session.
  • Users are unable to download the current page.
  • Long-pressing a link to open in a new Chrome tab is disabled.
  • The option to open the current page in the default browser with the overflow menu launches a browser window in Incognito mode.

Fallback to prior implementations

Not all user devices have the ability to launch into Ephemeral Custom Tabs. To handle these cases, developers can use CustomTabsClient to query the underlying browser to determine if ephemeral browsing is supported. This requires a service connection to the CustomTabsClient. To accomplish this, launch a new CustomTabsServiceConnection to access the CustomTabsClient provided following a successful binding.

// in your activity

CustomTabsServiceConnection connection = new CustomTabsServiceConnection() {
    @Override
    public void onCustomTabsServiceConnected(@NonNull ComponentName name, @NonNull CustomTabsClient client) {

        CustomTabsSession session = client.newSession(null);
        try {
            if (session.isEphemeralBrowsingSupported(Bundle.EMPTY)) {
                // launch ephemeral tab
            } else {
                // fallback
            }
        } catch (RemoteException e) {
            // fallback
        }
    }

    @Override
    public void onServiceDisconnected(ComponentName componentName) { }
};

CustomTabsClient.bindCustomTabsService(this, "com.android.chrome", connection);

Apps serving users who don't yet have access to Ephemeral Custom Tabs can use other methods, such as a WebView with caching disabled. An example of an implementation that leverages Ephemeral Custom Tabs with fallback to WebView is found in the Android Browser Helper library.

Additional resources