If you open Chrome, Microsoft Edge, Brave, Opera, Vivaldi, Samsung Internet, or Arc, you’re running the same engine under the hood: Chromium. That single fact is why a deceptively simple question matters so much — who controls Chromium? The code itself is free for anyone to read, copy, and modify; nobody has to ask Google’s permission to look inside. But “anyone is allowed to touch it” is not the same thing as “everyone gets a vote in where it goes.” Those are two different questions, and confusing them is where most of the myths start.
This guide keeps them separate. It walks through what Chromium’s open-source license actually grants, how much of the project Google itself builds and reviews (using Google’s own published numbers, clearly labeled as such), what a rival browser maker can and can’t change, and why this is best understood as ordinary open-source power concentration — not a hidden conspiracy. (Chromium is the open project; Chrome is Google’s product built on top of it — keep that distinction in mind throughout.)
The Short Version: Free to Copy, Run by One Company
Chromium’s own project site describes itself, in its own words, as “The Chromium Projects, controlled by Google.” That’s not an outside critic’s spin — it’s the project’s self-description. At the same time, the underlying source code is released mostly under a permissive 3-clause BSD license, with some components inherited from Chromium’s WebKit ancestry carrying LGPL, MIT, or MPL terms. A permissive open-source license means the code is genuinely free to read, copy, and modify — that part is not in dispute.
What’s missing is open governance: an independent body, separate from any single company, that sets the roadmap and has the final word. Linux has the nonprofit Linux Foundation; Firefox has the nonprofit Mozilla Foundation. Chromium has no equivalent. It’s open source without being open-governed, and that gap is the whole story.
Two Different Questions: Who’s Allowed vs. Who Decides
Because the BSD license is real and permissive, anyone can legally take the Chromium code and build something new from it. That’s exactly what happened when Microsoft rebuilt Edge on Chromium in 2020 instead of maintaining its own engine, and it’s how the ungoogled-chromium project can strip out Google-connected services (sync, telemetry, safe-browsing pings) and republish a de-Googled version — entirely within the letter of the license. Forking is not a workaround or a loophole; it’s the license working as designed.
But forking a project and steering the original project are different things. Anyone can drive off with a copy of the source. Far fewer people get to decide what goes into the next version everyone else builds on. That’s the “who decides” question, and it’s answered by who reviews and merges code — not by who’s legally permitted to copy it.
By the Numbers: Google’s Self-Reported ~94%
In January 2025, Google published a blog post announcing a new funding initiative for Chromium and, in the process, disclosed numbers about its own role in the project. According to Google’s own figures, the company made over 100,000 commits to Chromium in 2024 — roughly 94% of all contributions — and spends “hundreds of millions” of dollars a year maintaining it. Those are Google’s self-reported statistics, not an independent audit, so treat the precise percentage as an order-of-magnitude signal rather than a certified one. Directionally, it lines up with everything else known about the project.
That doesn’t make outside contributions fictional. Microsoft, Samsung, Intel, Opera, and the contracting firm Igalia (which does paid engineering work for several browser vendors) all submit real, substantial code upstream — accessibility features, ARM optimizations, CSS engine work. It’s a genuine, if lopsided, collaboration: by volume, the project is still overwhelmingly Google-authored and Google-reviewed.
Who Actually Approves a Change? The OWNERS System
Volume of code isn’t the only lever — review authority is the other one. Chromium’s code review runs through a hierarchical OWNERS file system: every directory in the codebase lists the people allowed to approve changes to it, and those approval chains nest upward through the project. It’s a mechanism for keeping a sprawling codebase coherent, not a democratic vote — and Google engineers sit at the top of that structure for the vast majority of it.
That said, the door isn’t fully closed. In 2020, Google opened a nomination process that let non-Google engineers — including reviewers from Igalia — earn OWNERS status and formal review authority in parts of the project. It’s a real channel for outside influence, just a narrow one relative to the project’s overall size. Worth remembering here: none of this is about security. Chromium’s sandboxing and site-isolation architecture (what keeps a malicious webpage from touching the rest of your computer) is a separate, largely well-regarded engineering achievement — governance and security are different conversations that happen to share the same codebase.
The Leverage in Practice: Manifest V3
Here’s where “controlled by Google” stops being an abstract governance detail and starts changing what’s on your screen. When Google redesigned Chrome’s extension system — called Manifest V3 (MV3) — every other Chromium-based browser inherited the underlying platform change too, whether or not its makers agreed with it.
To be precise: MV3 did not ban ad blockers. It replaced the older, more powerful webRequest blocking API with a more restricted one called declarativeNetRequest. Extensions like uBlock Origin Lite still block the great majority of conventional ads under MV3; what’s genuinely lost is dynamic, procedural filtering — on-the-fly rule logic sophisticated blockers used for edge cases. Google’s stated rationale is security, performance, and privacy (unrestricted webRequest access is also a real vector for extension-based snooping), but critics note the obvious conflict of interest: the company redesigning the ad-blocking API is also the world’s largest ad seller. Both can be true at once, which is why it’s a fairer discussion for Manifest V3’s effect on ad blockers than for a conspiracy headline. As of 2026, MV2 is fully disabled in Chrome (since Chrome 138), with its last Web Store listings scheduled for removal August 31, 2026.
Rival vendors didn’t just accept the default. Brave force-enabled continued support for specific MV2-style blocking in its Shields feature, and Vivaldi leaned harder on its own built-in ad blocker — concrete examples of paying the cost to diverge from Google’s call. Google made a similar unilateral, ecosystem-wide move (then partly reversed it) with third-party cookies: after years planning to phase them out via its Privacy Sandbox initiative, Google reversed course in October 2025 and kept them as a user choice. Either direction, one company’s decision moved the whole Chromium-based web.
The Counterweight: Outside Funding and the Right to Fork
Google isn’t pretending Chromium is a lone-wolf project, either. In January 2025 — the same announcement that disclosed the ~94% commit figure — Google and the Linux Foundation launched “Supporters of Chromium-based Browsers,” a funding consortium with Meta, Microsoft, and Opera as initial backers. That’s a genuine step toward shared financial investment in the project’s upkeep. But be precise about what it does and doesn’t change: it’s a funding vehicle, not a governance transplant. It doesn’t create an independent board with veto power over Google’s roadmap, or hand outside companies a formal vote — the OWNERS structure and Google’s dominant review authority are untouched.
The other real counterweight is the license itself. Because Chromium is genuinely forkable, anyone unhappy with a Google decision has an actual exit, not just a complaint: rebuild the disputed parts and maintain that fork against every future upstream update. That’s precisely what building or forking a Chromium browser really costs — a real, ongoing engineering bill, which is exactly why most vendors reserve it for fights they consider worth having rather than forking wholesale. Brave (built on Chromium, with its BAT token layered on top as a separate, unrelated project this article doesn’t cover as an investment) is one of the better-known examples of a vendor picking specific battles rather than a full break.
Power Concentration, Not Conspiracy
It’s worth placing this inside the bigger picture. Google is also defending Chrome in a U.S. antitrust case: a federal judge issued a liability ruling against Google in August 2024, and in September 2025 a remedies ruling explicitly rejected the government’s request to force a sale of Chrome — both sides are appealing, and as of 2026 Chrome has not been divested or sold. That case is about market power in search and advertising, not Chromium’s internal governance directly, but the two threads rhyme: both are about how much leverage one company holds over infrastructure nearly everyone relies on. It’s part of why the underlying browser-engine monoculture gets discussed as a policy question in its own right; see what a change to Chrome’s ownership could mean for where that’s headed.
None of this is unique to Google — plenty of major open-source projects (Android’s AOSP, for instance) are open source with one dominant corporate sponsor calling most of the shots. That pattern deserves scrutiny because it’s common and consequential, not because it’s secret. Chromium is real open source: readable, forkable, touched by real outside contributors. It is also, by any honest reading of the review structure and the commit numbers, a Google-run project. Holding both facts at once is the accurate picture.
❓ Frequently Asked Questions
Who controls Chromium? Google does, in practice, even though Chromium is open source. Google supplies the overwhelming majority of code contributions (its own self-reported figure is ~94% of 2024 commits), employs most of the project’s maintainers, and sits atop the OWNERS review structure that approves changes. There is no independent foundation governing Chromium the way the Mozilla Foundation governs Firefox.
Is Chromium actually open source, or is that just marketing? It’s genuinely open source. Chromium’s core code is released under a permissive 3-clause BSD license (with some LGPL/MIT/MPL components), meaning anyone can legally read, copy, and modify it — exactly how Microsoft Edge and the de-Googled “ungoogled-chromium” fork exist. Open source describes the license, not who runs the project day to day.
What’s the difference between Chromium and Google Chrome? Chromium is the open-source browser project. Chrome is Google’s commercial product built on top of it, adding proprietary pieces Chromium lacks — automatic updates, Google sign-in and sync, usage telemetry, licensed media codecs, Widevine DRM, and Google’s AI features. Most “Chrome vs. Chromium” confusion comes from treating them as identical.
Does the Linux Foundation now govern Chromium? No. The January 2025 “Supporters of Chromium-based Browsers” fund, backed by Google, Meta, Microsoft, and Opera, pools money toward Chromium’s upkeep — it does not create an independent governing board or shift review authority away from Google. Funding and governance are separate things, and only the funding side changed.
Can another company just take Chromium and do its own thing? Yes — Microsoft Edge, Brave, Opera, Vivaldi, and Samsung Internet are all Chromium-based, and ungoogled-chromium strips out Google services entirely. The catch is cost: diverging from Google’s decisions (like Manifest V3) means permanently maintaining that divergence against every future upstream update, which is why most vendors pick their battles rather than forking wholesale.
📚 Further Reading
- What Is Chromium? The Open-Source Engine Behind Most Browsers — the cornerstone explainer on Chromium vs. Chrome.
- Manifest V3 and Ad Blockers, Explained — a deeper look at the extension change this article uses as its leverage example.
- What Building or Forking a Chromium Browser Really Takes — the real engineering cost behind “just fork it.”
- The Technology Behind Brave Browser and the BAT Token — a real-world example of a Chromium fork diverging from Google’s defaults.
📚 Recommended Resources
Disclosure: some links below are Amazon affiliate links. If you buy through them, I earn a small commission — at no extra cost to you — which helps keep this site running.
The Age of Surveillance Capitalism
Shoshana Zuboff · Book · ~$22 on Amazon
The sharpest available context for why a single company controlling the engine behind most browsers matters — Zuboff’s account of how Google and its peers turned data and infrastructure control into a new kind of economic power is the natural next read after this article.
Data and Goliath
Bruce Schneier · Book · ~$18 on Amazon
A clear-eyed, non-alarmist look at how much leverage the companies that build our everyday software — browsers included — hold over both our data and our choices, and what (realistically) can be done about it.
The Code Book
Simon Singh · Book · ~$14 on Amazon
For readers who want to go one layer deeper into the security side of the browser you use daily — Singh’s history of cryptography explains the ideas underneath the sandboxing and encryption that make a browser engine like Chromium trustworthy in the first place.