Release of Chrome 112

Google has released version 112 of its Chrome web browser. At the same time, a stable release of the open-source Chromium project, which serves as the foundation for Chrome, is also available. Chrome differs from Chromium by including Google logos, a crash notification system, modules for playing DRM-protected video content, an automatic update installation system, continuous Sandbox isolation, provision of keys for Google API, and transmission of RLZ parameters during searches. For those needing more time to update, a separate Extended Stable branch is maintained for 8 weeks. The next release, Chrome 113, is scheduled for May 2.

Key changes in Chrome 112:

• The functionality of the Safety Check interface has been expanded, providing a summary of potential security issues such as the use of compromised passwords, the status of malicious site checks (Safe Browsing), the presence of uninstalled updates, and the identification of malicious extensions. The new version includes an automatic revocation of previously granted permissions for websites that haven't been used for a long time, as well as options to disable automatic revocation and restore revoked permissions.
• Websites are prohibited from setting the document.domain property to apply same-origin conditions to resources loaded from different subdomains. If a communication channel between subdomains needs to be established, the postMessage() function or the Channel Messaging API should be used.
• Support for running specialized Chrome Apps on Linux, macOS, and Windows platforms has been discontinued. Instead of Chrome Apps, standalone web applications based on Progressive Web Apps (PWA) technology and standard Web APIs should be used.
• The built-in storage for root certificates of certification authorities (Chrome Root Store) now includes handling of name constraints for root certificates (for example, a certain root certificate may only be allowed to generate certificates for specific first-level domains). domains In Chrome 113, there are plans to transition to the use of the Chrome Root Store and the built-in certificate verification mechanism on Android, Linux, and ChromeOS platforms (the transition to the Chrome Root Store for Windows and macOS was completed earlier).
• A simplified account connection interface in Chrome has been offered to some users.
• The ability to export and create backups in Google Takeout for data used when synchronizing different instances of Chrome has been provided, covering types AUTOFILL, PRIORITY_PREFERENCE, WEB_APP, DEVICE_INFO, TYPED_URL, ARC_PACKAGE, OS_PREFERENCE, OS_PRIORITY_PREFERENCE, and PRINTER.
• The add-ons authorization page based on the Web Auth Flow now appears in a tab instead of a separate window, allowing the URL to be visible for phishing protection. The new implementation jointly shares connection state across all tabs and retains state after restart.
• Browser extension Service Workers are now allowed access to the WebHID API, which is designed for low-level access to HID devices (Human Interface Devices, such as keyboards, mice, gamepads, and touchpads) and enables operation without specific drivers in the system. This change has been made to ensure compliance with the third version of the Chrome extension manifest, which previously accessed WebHID from background pages.
• Support for nested rules defined with the nesting selector has been added to CSS. Nested rules allow for reduced CSS file size and elimination of repetitive selectors. .nesting { color: hotpink; > .is { color: rebeccapurple; > .awesome { color: deeppink; } } }
• The CSS property animation-composition has been added, enabling the use of composite operations to apply multiple animations affecting the same property simultaneously.
• The submit button can now be passed to the FormData constructor, allowing the creation of FormData objects with the same data set as when submitting the original form after pressing the button.
• Regular expressions with the 'v' flag now support set operations, string literals, nested classes, and Unicode string properties, simplifying the creation of regular expressions that encompass specific Unicode characters. For example, the construct \/[\p{Script_Extensions=Greek}&&\p{Letter}]/v allows for encompassing all Greek characters.
• The algorithm for selecting the initial focus for dialogs created using the
  element has been updated. Input focus is now set on keyboard-related input elements rather than directly on the

  element.
• Testing has begun in WebView for deprecating the X-Requested-With header.
• Experimental (origin trial) support for enabling garbage collectors for WebAssembly has been added.
• Support for object code for direct and indirect tail-call recursion has been added to WebAssembly.
• Improvements have been made to the web developer tools. Nested CSS support has been added. A low contrast emulation mode has been introduced in the Rendering tab, allowing assessment of how people with reduced contrast sensitivity view the site. The web console now highlights messages related to conditional breakpoints and logpoints. Tooltips with brief descriptions of CSS properties have been added to the styles panel.

In addition to new features and bug fixes, the new version addresses 16 vulnerabilities. Many of these vulnerabilities were identified through automated testing using tools like AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues allowing bypassing of all browser security levels to execute code outside the sandbox environment have been found. As part of the vulnerability reward program for this release, Google has paid 14 bounties totaling $26,500 (three bounties of $5,000 and $1,000 each, two bounties of $2,000, and one each of $1,000 and $500). The amount of four bounties is yet to be determined.

Source: opennet.ru