System proxy override

Entitlement: systemProxyOverride. EP: internal.system_proxy_override. Console may label this capability System Network Override. It configures the browser's system-proxy baseline, not the machine-wide OS setting.

Single server

{
  "internal": {
    "system_proxy_override": {
      "server": "socks5://test-user:test-password@127.0.0.1:1080",
      "bypass_list": "localhost;127.0.0.1"
    }
  }
}

Replace the example with a reachable proxy and valid test credentials. Use an explicit scheme for HTTP, HTTPS, or SOCKS proxy URLs. Percent-encode special characters in URI usernames/passwords. Merge/sign the EP before launch.

bypass_list is a string using Chromium proxy bypass rules, not an array or navigation wildcard map. It is optional. There is no pac_url option in this EP section.

Two-hop chain

{
  "internal": {
    "system_proxy_override": {
      "chain": [
        { "server": "http://127.0.0.1:8080" },
        { "server": "socks5://test-user:test-password@proxy.example:1080" }
      ],
      "bypass_list": "localhost;127.0.0.1"
    }
  }
}

The chain is ordered: connect through the first proxy to the second. It is not a list of fallback alternatives. One or two hops are supported; longer chains, non-object entries, and invalid servers are rejected. If the chain key exists, it takes precedence over server, even when malformed; do not supply both expecting fallback.

Only the first hop may use {"use_system_proxy": true} instead of server. It uses fixed system proxy settings and does not evaluate PAC/WPAD. For a single proxy list, it chooses the first proxy. For per-protocol settings, it prefers the first HTTPS proxy, then HTTP, then the fallback list. The OS bypass list is not inherited; configure destinations to bypass with this EP section's bypass_list.

If fixed rules coexist with PAC settings, the fixed rules may still be used. If no usable fixed proxy is available, that hop is skipped and remaining explicit hops may still be used. Do not treat it as a guaranteed fail-closed upstream dependency.

SOCKS5 challenge authentication

A server hop may set challenge_auth: true for Chrovia's additional SOCKS5 challenge-auth protocol. This requires a compatible proxy server and is not ordinary RFC 1929 username/password authentication. Leave it absent/false for a normal third-party proxy. The same option can be applied to the first use_system_proxy hop when appropriate.

SOCKS5 ordinarily resolves target hosts remotely; Chrovia also supports its socks5-local URI variant for local DNS. Choose intentionally, especially when host resolver rules or local-only names are involved.

Precedence and verification

The override replaces only the system baseline. Chromium's higher-priority proxy configuration sources can still win; it is not a universal lock overriding every command-line, policy, or extension proxy setting. Missing entitlement, missing config, or invalid config leaves normal proxy selection in place.

Restart and test through an endpoint you control that reports the observed egress address. Test bypass destinations separately. A changed egress IP is not a changed browser fingerprint: use fingerprint override for identity configuration. Restrict access to the EP file: proxy credentials remain readable, including in signed files.