Google has released version 95 of the Chrome web browser. At the same time, a stable release of the open-source project Chromium, which serves as the foundation for Chrome, is available. The Chrome browser is distinguished by its use of Google logos, a notification system in case of crashes, modules for playing protected video content (DRM), an automatic update installation system, and transmission of RLZ parameters during searches. According to the new 4-week development cycle, the next release, Chrome 96, is scheduled for November 16. For those who need more time to update, an Extended Stable branch is maintained, accompanied by an 8-week period during which an update for the previous release, Chrome 94, is provided.
Key changes in Chrome 95:
- A new sidebar has been introduced for users of Linux, Windows, macOS, and ChromeOS, displayed on the right side of the content and activated by clicking a special icon in the address bar. The panel shows a summary of bookmarks and a reading list. This change is not enabled for all users; to activate it, the setting "chrome://flags/#side-panel" can be used.
- An explicit request for permission to save addresses entered in web forms for later use in the autofill system has been implemented. When addresses are detected in forms, a dialog will now be shown to the user, allowing them to save the address, edit it, update a previously saved address, or decline to save it.
- The code for supporting the FTP protocol has been removed. Support for FTP was disabled by default in Chrome 88, but a flag was left to restore it.
- Support for URLs with hostnames ending in digits that do not correspond to IPv4 addresses has been discontinued. For example, the URLs "http://127.1/", "http://foo.127.1/" and "http://127.0.0.0.1" will now be considered invalid.
- For WebAssembly, the ability to create exception handlers has been implemented, which can catch execution if an exception occurs during the execution of certain code. Both the catching of known exceptions from WebAssembly modules and exceptions during calls to imported functions are supported. To catch exceptions, the WebAssembly module must be compiled by a compiler supporting exceptions, such as Emscripten.
It is noted that exception handling at the WebAssembly level can significantly reduce the size of the generated code compared to exception handling by JavaScript. For instance, the optimizer assembly Binaryen with JavaScript exception handling results in a code increase of 43%, while with WebAssembly it only increases by 9%. Additionally, when using the optimization mode ‘-O3’, the code with WebAssembly exception handling shows almost no performance difference from the code without exception handlers, whereas JavaScript exception handling leads to a 30% slowdown in execution.
- Cross-origin sharing of WebAssembly modules is prohibited when processing a single site.
- Several new APIs have been added in Origin Trials (experimental features that require separate activation). Origin Trials allow the specified API to be used from applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token, which is valid for a limited time for a specific site.
- Trimming information in the HTTP header User-Agent and JavaScript parameters navigator.userAgent, navigator.appVersion, and navigator.platform is included. The header retains only details about the browser name, major version, platform, and device type (mobile, PC, tablet). For additional data such as the exact version and extended platform details, the User Agent Client Hints API must be used. The start of User-Agent trimming for regular user systems is planned for the release of Chrome 102, which will be published in six months.
- The possibility of creating Access Handles for the File System Access API is proposed, allowing web applications to read and write data directly to files and directories on the user's device. To streamline access methods for web applications to the file system, Google plans to combine the File System Access API and Storage Foundation. As a preparatory step for such a merger, support for access handles is proposed, which complements file descriptor-based methods with enhanced capabilities, such as setting write locks by other processes and creating separate streams for writing and reading, including support for reading and writing from workers in synchronous mode.
- The Secure Payment Confirmation API has been stabilized and proposed by default, featuring a new 'payment' extension that provides additional confirmation for payment transactions. The validating party, such as a bank, can generate a PublicKeyCredential, which can be requested by the seller for further secure payment confirmation via the Payment Request API, using the 'secure-payment-confirmation' payment method.
- In callback invocations set up through the PerformanceObserver constructor, the droppedEntriesCount property has been implemented, allowing insight into how many site performance metrics were discarded due to not fitting into the provided buffer.
- The EyeDropper API has been added, enabling the browser-provided interface to determine the color of arbitrary pixels on the screen, which can be used in graphic editors implemented as web applications. const eyeDropper = new EyeDropper(); const result = await eyeDropper.open(); // result = {sRGBHex: '#160731'}
- The self.reportError() function has been added, allowing scripts to log errors to the console, emulating the occurrence of an unhandled exception.
- The URLPattern API has been added to check if a URL matches a specific pattern, which can be used, for instance, for parsing links and redirecting requests to handlers in a service worker. const p = new URLPattern({ protocol: 'https', hostname: 'example.com', pathname: '/:folder/*/:fileName.jpg', });
- The Intl.DisplayNames API has been extended, allowing for the retrieval of localized names for languages, countries, currencies, date elements, and more. The new version introduces new name types: 'calendar' and 'dateTimeField', which provide localized names for calendars and date/time fields (e.g., month names). Support for language dialects has been added to the 'language' type.
- The Intl.DateTimeFormat API has been updated to support new values for the timeZoneName parameter: 'shortGeneric' for displaying a short time zone identifier (e.g., 'PT', 'ET'), 'longGeneric' for a longer name ('Pacific Time', 'Mountain Time'), 'shortOffset' for a short offset relative to GMT ('GMT+5'), and 'longOffset' for a long offset relative to GMT ('GMT+0500').
- The U2F API (Cryptotoken) has been deprecated, and it should be replaced with the Web Authentication API. The U2F API will be disabled by default in Chrome 98 and completely removed in Chrome 104.
- Improvements have been made to the web developer tools. The Styles panel has simplified the adjustment of CSS properties related to dimensions (height, padding, etc.). The Issues tab now allows individual issues to be hidden. The web console and the Sources and Properties panels have enhanced the display of properties (custom properties are now bolded and shown at the top of the list).
In addition to new features and bug fixes, the new version addresses 19 vulnerabilities. Many of these vulnerabilities were identified through automated testing using AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues that bypass all levels of browser protection and execute code in the system outside of the sandbox environment have been found. As part of the vulnerability reward payout program for this release, Google has awarded 16 bounties totaling $74,000 (one bounty of $20,000, two bounties of $10,000, one bounty of $7,500, one bounty of $6,000, three bounties of $5,000, and one each of $3,000, $2,000, and $1,000). The size of 5 bounties is yet to be determined.
Source: opennet.ru
