From 939a5963cd74447c2f4383d4ccba275b053bf46c Mon Sep 17 00:00:00 2001
From: az-xx <0916617@gmail.com>
Date: Fri, 18 Sep 2026 07:03:15 +0200
Subject: [PATCH] Handle Cronet by re-enabling pinning bypass for local trust
 anchors

Cronet (Chromium's network stack, used by many Google apps, gRPC and
other SDKs) runs TLS in native code and ignores the JVM proxy, OkHttp
and TrustManager layers, so none of the existing unpinning hooks affect
it. It trusts locally-installed CAs by default, but only while
public-key-pinning bypass for local trust anchors is left enabled, which
an app can turn off with a single CronetEngine.Builder call.

Hook enablePublicKeyPinningBypassForLocalTrustAnchors to always pass
true, so our injected CA is accepted while pinning stays intact for
connections chaining to a real (non-local) trust anchor - matching the
"disable only the extra restrictions" approach the other hooks take.
---
 android/android-certificate-unpinning.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/android/android-certificate-unpinning.js b/android/android-certificate-unpinning.js
index 13c67b8..f4b903a 100644
--- a/android/android-certificate-unpinning.js
+++ b/android/android-certificate-unpinning.js
@@ -433,6 +433,19 @@ const PINNING_FIXES = {
                 };
             }
         }
+    ],
+
+    // --- Cronet (Chromium's network stack - does its own native TLS, bypassing the hooks above)
+
+    'org.chromium.net.CronetEngine$Builder': [
+        {
+            methodName: 'enablePublicKeyPinningBypassForLocalTrustAnchors',
+            replacement: (targetMethod) => function (_enabled) {
+                // Ignore the app's choice and always allow local trust anchors to bypass
+                // pinning - the method returns the builder, so preserve that for chaining:
+                return targetMethod.call(this, true);
+            }
+        }
     ]
 
 };