Chrome 97 Release

Google has released version 97 of the Chrome web browser. At the same time, a stable release of the open-source project Chromium, which serves as the foundation for Chrome, is available. The Chrome browser is distinguished by its use of Google logos, a crash notification system, modules for playing protected video content (DRM), an automatic update system, and the transmission of RLZ parameters during searches. For users who need more time to update, there is a separately supported Extended Stable branch maintained for 8 weeks, which has an update for the previous version, Chrome 96. The next release, Chrome 98, is scheduled for February 1.

Key changes in Chrome 97:

• A new data management interface is available for some users in the configurator, located at "chrome://settings/content/all". A key difference of the new interface is the focus on setting permissions and clearing all site cookies at once, without the ability to view detailed information about individual cookies or selectively delete them. According to Google, allowing access to manage individual cookies for an average user who is not familiar with web development intricacies may lead to unpredictable site malfunctions due to careless changes to individual settings, as well as the inadvertent disabling of privacy protection mechanisms activated through cookies. For users needing manipulation of individual cookies, it is recommended to use the storage management section in the web development tools (Application/Storage/Cookie).
• In the site information block, a brief site description (e.g., descriptions from Wikipedia) is displayed if the search and browsing optimization mode is enabled in the settings (option "Make searches and browsing better").
• Support for auto-filling fields in web forms has been improved. Autocomplete suggestions are now displayed with a slight shift and are accompanied by informational icons for easier previewing and clearer understanding of their relation to the field being filled. For example, the profile icon indicates that the suggested autocomplete relates to fields associated with address and contact information.
• Memory cleanup for user profile handlers has been ensured after closing related browser windows. Previously, profiles remained in memory and continued to perform tasks associated with synchronization and running background scripts of extensions, leading to unnecessary resource consumption on systems using multiple profiles simultaneously (e.g., guest profile and binding to a Google account). Furthermore, data left over during profile interactions is now cleaned more thoroughly.
• The search engine settings page has been improved ("Settings>Manage search engines"). Automatic activation of engines, whose information is provided when a site is opened via the OpenSearch script, has been disabled — new engines for processing search queries from the address bar now need to be activated manually in the settings (previously automatically activated engines will continue to work unchanged).
• Starting January 17, the Chrome Web Store will no longer accept extensions using the second version of the Chrome manifest, but developers of previously added extensions will still be able to publish updates as before.
• Experimental support for the WebTransport specification has been added, defining the protocol and accompanying JavaScript API for sending and receiving data between the browser and proxy server. The communication channel is established over HTTP/3 using QUIC as the transport protocol. WebTransport can be used instead of the WebSockets mechanism, offering additional features such as multistream delivery, unidirectional streams, out-of-order packet delivery, and reliable and unreliable delivery modes. Moreover, WebTransport can replace the Server Push mechanism, which Google has discontinued in Chrome.
• The JavaScript Array and TypedArrays objects have been enhanced with the findLast and findLastIndex methods, allowing element searches with results relative to the end of the array. [1,2,3,4].findLast((el) => el % 2 === 0) // → 4 (the last even element)
• Closed (without the "open" attribute) HTML
  elements are now searchable and linkable, and they automatically expand when using page search and fragment navigation (ScrollToTextFragment).
• Content Security Policy (CSP) restrictions in response headers server now apply to dedicated workers, which were previously treated as separate documents.
• An explicit request for permission to load any subresources from the internal network is now required — before accessing the internal network or localhost on the main site server, a CORS (Cross-Origin Resource Sharing) request with the header 'Access-Control-Request-Private-Network: true' is sent, requiring operation confirmation through the returning header 'Access-Control-Allow-Private-Network: true'.
• The CSS property font-synthesis has been added, allowing control over the browser's ability to synthesize missing font styles (oblique, bold, and small-cap) that are absent in the selected font family.
• For CSS transformations, a 'none' parameter has been implemented in the perspective() function, which is treated as an infinite value during animation.
• The HTTP header Permissions-Policy (Feature Policy), used for delegating permissions and enabling enhanced capabilities, has added support for the value keyboard-map, allowing the use of the Keyboard API. The Keyboard.getLayoutMap() method has been implemented, allowing the detection of which key is pressed considering different keyboard layouts (e.g., whether a key is pressed in the Russian or English layout).
• The HTMLScriptElement.supports() method has been added, unifying the identification of new capabilities available in the 'script' element, such as being able to determine the list of supported values for the 'type' attribute.
• The process of normalizing newlines when submitting web forms has been aligned with the Gecko and WebKit browser engines. Normalization of line feed and carriage return characters (replacing /r and /n with \r\n) in Chrome is now performed at the final stage rather than at the beginning of form submission processing (i.e., intermediate handlers using the FormData object will see the data as added by the user, not in normalized form).
• The naming of property names for the Client Hints API, developed as a replacement for the User-Agent header and allowing selective delivery of data regarding specific browser and system parameters (version, platform, etc.) only after a server request, has been standardized. Properties are now prefixed with 'sec-ch-', for example, sec-ch-dpr, sec-ch-width, sec-ch-viewport-width, sec-ch-device-memory, sec-ch-rtt, sec-ch-downlink, and sec-ch-ect.
• The second phase of deprecation for the WebSQL API has been applied, with access from third-party scripts now being blocked. In the future, support for WebSQL will be gradually phased out entirely, regardless of the context of use. The WebSQL handler is based on SQLite code and could be exploited by attackers to take advantage of vulnerabilities in SQLite.
• For the Windows platform, a build with Control Flow Guard (CFG) has been enabled, blocking attempts to inject code into the Chrome process. Additionally, network services running in separate processes are now subject to sandbox isolation, limiting the capabilities of code in those processes.
• In Chrome for Android, a mechanism for dynamically updating the log of issued and revoked certificates (Certificate Transparency) has been implemented, which was previously activated in desktop builds.
• Improvements have been made to the tools for web developers. Experimental support for syncing DevTools settings across different devices has been implemented. A new Recorder panel has been added, allowing users to record, play back, and analyze their actions on the page.

  Error output in the web console now displays the associated column numbers related to the issue, which is convenient for debugging problems in minified JavaScript code. The list of devices that can be simulated for evaluating page display on mobile devices has been updated. The HTML block editing interface (Edit as HTML) now includes syntax highlighting and the ability for input autocompletion.

  

In addition to new features and bug fixes, the new version addresses 37 vulnerabilities. Many of the vulnerabilities were identified through automated testing using tools such as AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. One of the vulnerabilities has been classified as critical, allowing bypass of all browser protection levels and execution of code on the system, outside the sandbox environment. Details regarding the critical vulnerability (CVE-2022-0096) have not yet been disclosed; it is only known that it relates to accessing already released memory areas in the code dealing with internal storage (API Storage).

As part of the vulnerability reward program for the current release, Google has paid out 24 rewards totaling $54,000 (three rewards of $10,000, two rewards of $5,000, one reward of $4,000, three rewards of $3,000, and one reward of $1,000). The size of 14 rewards is yet to be determined.

Source: opennet.ru