Release of Chrome 99

Google has introduced the release of the web browser Chrome 99. At the same time, a stable release of the open-source project Chromium, which serves as the foundation for Chrome, is available. The Chrome browser is characterized by the use of Google logos, a system for sending crash notifications, modules for playing protected video content (DRM), an automatic update installation system, and the transmission of RLZ parameters during searches. The next release of Chrome 100 is scheduled for March 29.

Key changes in Chrome 99:

• Chrome for Android has included the Certificate Transparency mechanism, which maintains an independent public log of all issued and revoked certificates. The public log allows for an independent audit of all changes and actions taken by certificate authorities and will enable immediate tracking of any attempts to secretly create fake records. Certificates not reflected in Certificate Transparency will be automatically rejected by the browser, displaying the appropriate error. This mechanism was previously enabled only for the desktop version and for a small percentage of Android users.
• Due to numerous complaints, the previously proposed Private Network Access mechanism, aimed at enhancing protection against attacks related to accessing resources on the local network or on the user's computer (localhost) from scripts loaded when opening a website, has been disabled in testing. To protect against such attacks, in the case of requesting any sub-resources on the internal network, it has been proposed that an explicit permission request for loading such sub-resources be sent. Google will review the implementation based on the feedback received and will propose an improved version in one of the future releases.
• The option to remove default suggested search engines has been restored. Recall that starting from Chrome 97, the ability to remove items from the list of default search engines (Google, Bing, Yahoo) and edit search engine settings was discontinued in the configurator section 'Manage Search Engines' (chrome://settings/searchEngines), which caused dissatisfaction among many users.
• On the Windows platform, the ability to remove standalone web applications (PWA, Progressive Web App) through system settings has been provided. control panel similar to the removal of Windows applications.
• Final testing is being conducted on potential disruptions to websites after browsers reach a version composed of three digits instead of two (following the release of Chrome 10, many issues surfaced in User-Agent parsing libraries). When the option "chrome://flags#force-major-version-to-100" is activated, the User-Agent header begins to return version 100.
• CSS has introduced support for cascading layers defined using the @layer rule and imported through the @import CSS rule, using the layer() function. CSS rules within the same cascading layer cascade together, simplifying the management of the entire cascade, providing flexible options for changing the order of layers, and allowing for more explicit management of CSS files to prevent conflicts. Cascading layers are conveniently used for themes, defining default element styles, and extracting component styling into external libraries.
• The HTMLInputElement class has added the showPicker() method, which allows displaying built-in dialogs for filling in typical values in fields of types "date", "month", "week", "time", "datetime-local", "color", and "file", as well as for fields supporting autofill and datalist selection. For example, it can show a calendar interface for date selection or a palette for color input.
• In the Origin Trials mode (experimental features requiring separate activation), the option to enable dark theme styling for web applications has been implemented. Colors and backgrounds for the dark theme are chosen using the new color_scheme_dark field in the web application manifest file. The Origin Trial means that the specified API can be accessed from applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token that is valid for a limited time for a specific site.
• The Handwriting Recognition API has been stabilized and is available to all interested parties, allowing the use of handwriting recognition services provided by the operating system.
• For installed separate web applications (PWA, Progressive Web App), the Window Controls Overlay component has been stabilized, extending the application's screen area to the entire window, including the title area, on which the standard window control buttons (close, minimize, maximize) are overlaid. The web application can manage rendering and input handling throughout the entire window, except for the overlaid block with window control buttons.
• In the CSS function calc(), it is permitted to specify values 'infinity', '-infinity', and 'NaN' or expressions that lead to such values, for example, 'calc(1/0)'.
• In the CSS property color-scheme, which allows defining in which color schemes an element can be displayed correctly ('light', 'dark', 'day mode', and 'night mode'), the parameter 'only' has been added, allowing the exclusion of forced color scheme changes for individual HTML elements. For instance, if specified as 'div { color-scheme: only light }', the div element will use only the light theme, even if the dark theme is forcibly enabled in the browser.
• To change the values of the document.adoptedStyleSheets property, the push() and pop() operations can now be used instead of completely reassigning the property. For example, 'document.adoptedStyleSheets.push(newSheet);'.
• The implementation of the CanvasRenderingContext2D interface has added support for ContextLost and ContextRestored events, the reset() method, willReadFrequently options, CSS text modifiers, the roundRect rendering primitive, and conical gradients. Improved support for SVG filters.
• The prefix '-webkit-' has been removed from the properties 'text-emphasis', 'text-emphasis-color', 'text-emphasis-position', and 'text-emphasis-style'.
• For pages opened without HTTPS, access to the Battery Status API, which provides information about battery charge, is prohibited.
• In the navigator.getGamepads() method, an array of Gamepad objects is now returned instead of GamepadList. GamepadList is no longer supported in Chrome, which aligns with the standard requirement and the behavior of the Gecko and Webkit engines.
• The WebCodecs API has been aligned with the specification. In particular, the EncodedVideoChunkOutputCallback() method and the VideoFrame() constructor have been changed.
• In the JavaScript V8 engine, new properties have been added to the Intl.Locale API: calendars, collations, hourCycles, numberingSystems, timeZones, textInfo, and weekInfo. These properties provide information about supported calendars, time zones, and time and text parameters. const arabicEgyptLocale = new Intl.Locale('ar-EG') // ar-EG arabicEgyptLocale.calendars // ['gregory', 'coptic', 'islamic', 'islamic-civil', 'islamic-tbla'] arabicEgyptLocale.collations // ['compat', 'emoji', 'eor'] arabicEgyptLocale.hourCycles // ['h12'] arabicEgyptLocale.numberingSystems // ['arab'] arabicEgyptLocale.timeZones // ['Africa/Cairo'] arabicEgyptLocale.textInfo // { direction: 'rtl' } japaneseLocale.textInfo // { direction: 'ltr' } chineseTaiwanLocale.textInfo // { direction: 'ltr' }
• The Intl.supportedValuesOf(code) function has been added, which returns an array of supported identifiers for the Intl API properties: calendar, collation, currency, numberingSystem, timeZone, and unit. Intl.supportedValuesOf('unit') // ['acre', 'bit', 'byte', 'celsius', 'centimeter', ...]
• Improvements have been made to the web developer tools. The network panel now allows for the throttling of WebSocket requests to debug functionality under slow network conditions. A panel for tracking reports generated via the Reporting API has been added to the 'Application' tab. In the Recorder panel, support for waiting until an element is visible or clickable has been implemented before replaying recorded commands. Dark theme emulation has been simplified. Touchscreen panel management has been improved. The web console now supports escape sequences for highlighting text in color, as well as support for placeholders %s, %d, %i, and %f, enhancing message filter functionality.

In addition to new features and bug fixes, the new version has addressed 28 vulnerabilities. Many of these vulnerabilities were identified through automated testing using AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues that allow bypassing all levels of browser protection to execute code outside of the sandbox environment have been found. Under the vulnerability reward program, Google awarded 21 prizes totaling $96,000 for this release (one prize of $15,000, two prizes of $10,000, six prizes of $7,000, two prizes of $5,000, two prizes of $3,000, and one prize each of $2,000 and $1,000).

Source: opennet.ru