Known Issues and Fixes

Fixed

When VanBrowser was already running and the default browser, clicking a link opened a new window on the default page while the clicked URL loaded in a tab behind it. Worked correctly when VanBrowser was not already running.

Fixed

Tabbed browsing with >8 or 9 tabs can be wonky, depending on how wide your screen is. This issue has been addressed in 5.1.54.

New Feature

You can now search the Saved Passwords to narrow down which ones appear. Search based on username or domain/site.

Improvement

Various cookie and persona fixes and UI/UX tweaks to make clearer what's happening with third-party cookies.

New Feature

Bookmark import/export now tells you what happened. Importing an unreadable or
non-bookmark file, or an export that failed to save, used to do nothing with no
message. Import now reports how many bookmarks were added (or that none were found), and a failed read or save is shown instead of silently swallowed.

New Feature

"Never save passwords for this site." The save-password prompt now has a third
option that sticks across launches, so a site you never want saved stops nagging you
every session (previously "Not Now" only lasted the current launch). Sites you've
silenced appear in Passwords under "Never Saved on These Sites" with an "Allow Again" button, so it's reversible.

Improvement

You can now reach a site with an untrusted certificate. A self-signed, expired, or mismatched HTTPS certificate (common on a local dev server like `https://127.0.0.1:8007`) used to dead-end on an error page whose only option was a useless "Try Again". VanBrowser, now shows an in-page warning with real choices: **Go Back**, **Continue Just This Once**, or **Always Trust This Certificate**. "Always" remembers your decision across launches, pinned to that exact certificate on that host, so the same trusted server never asks again, while a different certificate showing up later still warns you.

Fixed

-SOCKS5 proxy: an empty Host field could no longer masquerade as configured.
Turning the proxy on showed gray placeholder text ("127.0.0.1", "1080") that looked
identical to a real value, so a persona could have proxying switched on with no host
actually set. In that state the proxy silently did nothing and traffic went out
directly. Now turning the proxy on pre-fills the Host with `127.0.0.1`, Settings will
not let you Apply (or click OK) while the proxy is on but the Host or Port is invalid,
and an inline warning says what to fix.
- Proxy now truly fails closed. A persona set to proxy with "Allow direct connection
if the proxy is unavailable" turned off no longer falls back to a direct connection
when the proxy is missing or misconfigured. Loads fail closed instead, so your real IP
is never used when you asked to be proxied.
- Clearer message when a proxied page can't load. If a page fails to connect while a
persona is routed through a SOCKS5 proxy, the error page now explains that the proxy
(for example your SSH tunnel) may be down, rather than reading as a browser fault.

Fixed

Reddit's Log In and Sign Up buttons work again with Tracking Protection on.
Tracking Protection blocks Google's One Tap sign-in iframe, but Google's script then
left its (now empty) prompt container parked in the top-right corner, on top of
Reddit's header buttons, where it silently swallowed every click. The orphaned
container is now hidden so it can't intercept clicks. The intentional "Continue with
Google" button is unaffected.

Fixed

**Save-password prompt no longer cascades into a stack of identical dialogs.**
Submitting a login (for example the Walmart pharmacy 4-digit PIN) could pop a pile
of "Save password for …?" alerts on top of each other. The capture fires from
several places at once (form submit, Enter, login-button click) and across every
frame, and the modal's run loop kept delivering those messages and re-opening the
alert. A single prompt now shows per login, and dismissing it with "Not Now" stops
it re-asking for that same login during the session.

Fixed

Deleting a protected cookie no longer silently fails.** Some cookies (Secure /
HttpOnly, like YouTube's `__Secure-ROLLOUT_TOKEN`) can't be removed one at a time by
WebKit, so deleting one on a domain where you keep other cookies used to report success
while the cookie quietly survived and kept tracking you. VanBrowser now escalates the
delete (including overwriting the cookie with an expired copy) and, if a cookie still
can't be removed, says so inline instead of pretending it worked.

Won't Fix

https://www.acehardware.com/ is oddly broken. After manually giving the zip code, the site appears to reload and hang. Reloading manually works, but many things are blocked. This is an issue with the number of trackers and other nonsense on the acehardware.com site itself and not something that can (or should) be fixed by the browser.