Chromium fork named after radioactive element No. 90. Source code and Linux releases. Windows/MacOS/ARM builds served in different repos, links are towards the top of the README.md.
This report summarizes scanner evidence for Alex313031/thorium, a C++ project with 7,557 GitHub stars. SynthScan examined 37,340 lines of code across 226 source files, recording 125 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 5.0 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 103 finding(s).
Are imports declared and package/API names verified? 18 finding(s).
Are wrappers, guards, and repeated structures necessary? 10 finding(s).
Which changes need focused human review? 125 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 125 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.sh | 421 | #printf "\n" && | COMMENT |
| LOW | trunk.sh | 81 | COMMENT | |
| LOW | trunk.sh | 101 | #printf "${c4} .,lllllllllllllllllllll,. \n" && | COMMENT |
| LOW | infra/portable/THORIUM-PORTABLE.sh | 1 | #!/bin/bash | COMMENT |
| LOW | infra/portable/C/THORIUM-PORTABLE.sh.x.c | 561 | #include <sys/ptrace.h> | COMMENT |
| LOW | infra/portable/C/THORIUM-PORTABLE.sh.x.c | 841 | #endif /* HARDENING */ | COMMENT |
| LOW | infra/portable/C/THORIUM-SHELL.sh.x.c | 101 | "\366\246\077\004\112\360\214\313\124\246\230\306\051\122\023\056" | COMMENT |
| LOW | infra/portable/C/THORIUM-SHELL.sh.x.c | 281 | /* Seccomp Sandboxing Init */ | COMMENT |
| LOW | infra/portable/C/THORIUM-SHELL.sh.x.c | 561 | #include <sys/types.h> | COMMENT |
| LOW | other/build_ffmpeg.py | 261 | elif target_arch == 'mipsel': # Unsupported beginning in M90 | COMMENT |
| LOW | …_party/widevine/cdm/linux/arm64/widevine_cdm_version.h | 1 | // Copyright (c) 2012 The Chromium Authors. All rights reserved. | COMMENT |
| LOW | arm/third_party/libaom/cmake_update.sh | 1 | #!/bin/bash | COMMENT |
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 1 | # Copyright 2026 The Chromium Authors and Alex313031 | COMMENT |
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 21 | COMMENT | |
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 41 | import platform as pyplatform | COMMENT |
| LOW | pak_src/main.h | 1 | // Small alternative startfile for main() | COMMENT |
| LOW | pak_src/pak_pack.h | 1 | #pragma once | COMMENT |
| LOW | pak_src/pak_defs.h | 1 | #pragma once | COMMENT |
| LOW | src/tools/clang/scripts/build.py | 1121 | # C++-y "Hello World" program only resulted in 14% faster builds.) | COMMENT |
| LOW | src/net/base/load_flags_list.h | 1 | // Copyright 2026 The Chromium Authors and Alex313031 | COMMENT |
| LOW | src/net/base/load_flags_list.h | 21 | // All other caches are used as normal. | COMMENT |
| LOW | src/net/base/load_flags_list.h | 41 | COMMENT | |
| LOW | src/net/base/load_flags_list.h | 61 | // subresource and speculatively pre-connect or pre-resolve when a referring | COMMENT |
| LOW | src/net/base/load_flags_list.h | 81 | COMMENT | |
| LOW | src/net/base/load_flags_list.h | 101 | // This flag must be set on requests that are allowed to reuse cache entries | COMMENT |
| LOW | src/google_apis/default_api_keys.h | 1 | // Copyright 2024 The Chromium Authors | COMMENT |
| LOW | …le_system_access/file_system_access_safe_move_helper.h | 1 | // Copyright 2026 The Chromium Authors and Alex313031 | COMMENT |
| LOW | …ent/browser/renderer_host/pepper/pepper_file_io_host.h | 1 | // Copyright 2026 The Chromium Authors and Alex313031 | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 1 | // Copyright 2026 The Chromium Authors and Alex313031 | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 21 | #include "base/containers/lru_cache.h" | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 141 | virtual void NotifyProfileError(sql::InitStatus init_status, | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 201 | COMMENT | |
| LOW | src/components/history/core/browser/history_backend.h | 241 | // the refs owned by the delegate and any pending transaction, so it will | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 341 | COMMENT | |
| LOW | src/components/history/core/browser/history_backend.h | 361 | // {1-day, 7-day, 28-day} metrics whose spanning periods all end on that | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 581 | COMMENT | |
| LOW | src/components/history/core/browser/history_backend.h | 701 | bool UpdateVisitReferrerOpenerIDs(VisitID visit_id, | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 781 | COMMENT | |
| LOW | src/components/history/core/browser/history_backend.h | 861 | // If the caller wants to add this visit to the VisitedLinkDatabase, it needs | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 921 | COMMENT | |
| LOW | src/components/history/core/browser/history_backend.h | 941 | // disk and opens a new transaction. This will be called automatically by | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 981 | // type(s). If necessary, this method will create a new segment and return its | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 1061 | // of foreign visits, the deletion is implemented in multiple small batches to | COMMENT |
| LOW | src/components/history/core/browser/history_backend.h | 1081 | COMMENT | |
| LOW | src/third_party/widevine/cdm/widevine_cdm_version.h | 1 | // Copyright 2026 The Chromium Authors and Alex313031 | COMMENT |
| LOW | …s_data/resources/definitions/prepopulated_engines.json | 1 | // Copyright 2026 The Chromium Authors, Alex313031, and tomByrer | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 1 | // Copyright 2026 The Chromium Authors and Alex313031 | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 21 | #include "base/scoped_observation_traits.h" | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 41 | #include "components/prefs/pref_change_registrar.h" | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 261 | COMMENT | |
| LOW | src/chrome/browser/ui/browser.h | 301 | std::optional<int64_t> display_id; | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 321 | #endif | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 381 | // Crashes if the requested browser creation is not allowed. | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 461 | LocationBarModel* location_bar_model() { return location_bar_model_.get(); } | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 561 | COMMENT | |
| LOW | src/chrome/browser/ui/browser.h | 581 | // | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 601 | // | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 621 | // have a chance to save their work before the window is closed without | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 641 | // 2. The Browser window is hidden, and a task is posted that results in | COMMENT |
| LOW | src/chrome/browser/ui/browser.h | 681 | COMMENT | |
| 21 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | win_scripts/tot.py | 54 | "cd v8 && git restore . && git clean -ffd", | CODE |
| HIGH⚡ | win_scripts/tot.py | 55 | "cd third_party/devtools-frontend/src && git restore . && git clean -ffd", | CODE |
| HIGH⚡ | win_scripts/tot.py | 56 | "cd third_party/ffmpeg && git restore . && git clean -ffd", | CODE |
| HIGH⚡ | win_scripts/trunk.py | 65 | "cd v8 && git restore . && git clean -ffd", | CODE |
| HIGH⚡ | win_scripts/trunk.py | 66 | "cd third_party/devtools-frontend/src && git restore . && git clean -ffd", | CODE |
| HIGH⚡ | win_scripts/trunk.py | 67 | "cd third_party/ffmpeg && git restore . && git clean -ffd", | CODE |
| HIGH | other/build_ffmpeg.py | 969 | '--extra-ldflags=-Wl,-flat_namespace -Wl,-undefined,warning', | STRING |
| HIGH | arm/third_party/xnnpack/generate_build_gn.py | 81 | if (is_android && current_cpu == "arm64") { | CODE |
| HIGH | arm/third_party/xnnpack/generate_build_gn.py | 160 | if (!(is_android && use_order_profiling)) { | CODE |
| HIGH | arm/third_party/xnnpack/generate_build_gn.py | 215 | if (!(is_android && use_order_profiling)) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | win_scripts/build_win.py | 3 | # This file is the equivalent of build_win.sh in the parent directory. | COMMENT |
| MEDIUM | infra/portable/make_portable_win.py | 3 | # This file is the equivalent of make_portable_win.py. | COMMENT |
| MEDIUM | arm/third_party/xnnpack/generate_build_gn.py | 524 | # Create a dependency list containing the source_set's for use by the main | STRING |
| MEDIUM | src/chrome/installer/linux/debian/build.sh | 14 | # Create the Debian changelog file needed by dpkg-gencontrol. This just adds a | COMMENT |
| MEDIUM | src/chrome/installer/linux/debian/build.sh | 31 | # Create the Debian control file needed by dpkg-deb. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | infra/portable/make_portable_win.py | 80 | CODE | |
| LOW | other/build_ffmpeg.py | 126 | CODE | |
| LOW | other/build_ffmpeg.py | 242 | CODE | |
| LOW | other/build_ffmpeg.py | 664 | CODE | |
| LOW | depot_tools/win_toolchain/package_from_installed.py | 122 | CODE | |
| LOW | depot_tools/win_toolchain/package_from_installed.py | 502 | CODE | |
| LOW | src/tools/clang/scripts/build.py | 652 | CODE | |
| LOW | src/tools/pgo/generate_profile.py | 47 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | other/build_ffmpeg.py | 7 | CODE | |
| LOW | other/build_ffmpeg.py | 11 | CODE | |
| LOW | other/build_ffmpeg.py | 17 | CODE | |
| LOW | other/build_ffmpeg.py | 19 | CODE | |
| LOW | depot_tools/win_toolchain/package_from_installed.py | 38 | CODE | |
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 46 | CODE | |
| LOW | src/tools/clang/scripts/build.py | 27 | CODE | |
| LOW | src/tools/clang/scripts/build.py | 35 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | infra/portable/make_portable_win.py | 109 | except FileNotFoundError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 313 | def _objectbuild_from_bazel_log(action, platform: _Platform) -> ObjectBuild: | STRING |
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 432 | def _generate_supporting_source_set(ss: SourceSet) -> str: | STRING |
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 446 | def _generate_per_platform_dep_lists( | STRING |
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 483 | def _generate_main_source_set( | STRING |
| LOW | arm/third_party/xnnpack/generate_build_gn.py | 498 | def _generate_build_identifier() -> None: | STRING |
| LOW | src/components/neterror/resources/dino_game/offline.js | 1728 | function createAdjustedCollisionBox(box, adjustment) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | win_scripts/clean.py | 35 | except Exception as e: | CODE |
| LOW | win_scripts/clean.py | 46 | except Exception as e: | CODE |
| LOW | infra/Flatpak/com.alex313031.thorium/unlink_profiles.py | 41 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | other/build_ffmpeg.py | 1022 | # We want to make sure to play everything Android generates and plays. | STRING |
| LOW | src/chrome/common/chrome_constants.h | 29 | // NOTE: if you change the value of kFrameworkName, please don't forget to | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | arm/third_party/libaom/cmake_update.sh | 12 | # Usage: | COMMENT |