Chrome 120 has been released.

Google has released version 120 of the Chrome web browser. At the same time, a stable release of the open-source project Chromium, which serves as the basis for Chrome, is available. The Chrome browser differs from Chromium in that it uses Google logos, has a crash reporting notification system, includes modules for playing copy-protected video content (DRM), has an automatic update system, always includes Sandbox isolation, provides keys to Google API, and sends RLZ parameters during searches. For those who need more time to update, there is an Extended Stable branch supported for 8 weeks. The next Chrome release 121 is scheduled for January 23.

Key changes in Chrome 120:

• An experiment has begun to disable support for third-party cookies set when accessing websites different from domain the current page. Such cookies are used to track user movements between sites in ad network code, social media widgets, and web analytics systems. In January 2024, third-party cookies will be disabled for 1% of browser users. These changes are part of the Privacy Sandbox initiative, aimed at striking a balance between users' need to maintain privacy and the desire of ad networks and sites to track visitors' preferences.

  Instead of tracking cookies, the following APIs are proposed:

  • FedCM (Federated Credential Management) allows for the creation of unified identification services that ensure privacy and work without third-party cookies.
  • Private State Tokens allow for differentiating between users without using cross-site identifiers and sharing user authentication information across different contexts.
  • Topics (critique) enables determining user interest categories that can be used to highlight groups of users with similar interests without identifying individual users using tracking cookies. Interests are computed based on the user's activity in the browser and stored on the user's device. Using the Topics API, an ad network can obtain general information about individual interests without having information about specific user activity.
  • Protected Audience, a solution for retargeting tasks and assessing one's own audience (working with users who have previously visited the site).
  • Attribution Reporting, allows for evaluating advertising effectiveness metrics such as clicks and conversion (a purchase on the site after clicking).
  • Storage Access API, can be used to request user permissions to access the Cookie storage if third-party Cookies are blocked by default.
• In accordance with the requirements of the recently adopted DMA (Digital Markets Act) in the European Union, some users will be shown a dialog to select the default search engine, the capabilities of which correspond to the settings at chrome://settings/search. In Chrome 120, the dialog will be shown to 1% of users, and by the time Chrome 122 is released, it will be shown to 100%.
• The process of discontinuing support for the Theora video codec has begun. Initially, Theora is disabled for 1% of users, but it is planned to be disabled for all users by January 16. During the transition phase, a setting for reverting the codec is available at chrome://flags/#theora-video-codec. The reason for the discontinuation of Theora support includes concerns that the implementation of Theora, which has sufficiently complex logic for parsing binary data and decoding streams, may contain vulnerabilities similar to recent critical issues with the VP8 encoder.
• The design of the Chrome Web Store catalog has been revamped to simplify the search and management of extensions. New categories of extensions have been added (for example, a category for machine learning-based extensions and an 'editor's choice' section). The option to revert to the previous design has been added in the menu » ⋮.
• The functionality of the Safety check interface has been expanded, providing a summary of potential security issues such as the use of compromised passwords, the status of malicious site checks (Safe Browsing), the presence of uninstalled updates, and the identification of malicious extensions. The new version offers a proactive mode that periodically performs browser-related security checks and informs the user if any issues are detected. Settings have been added for managing actions in proactive mode.
• An adaptive toolbar has been implemented that changes based on the window size.
• In the password manager, sharing individual passwords is now allowed for members of the Google Family Group set up through Google Account. Only one password can be shared at a time, after which the shared password cannot be updated or revoked by the sender.
• Printer interactions have been moved to a separate service process, which has improved the browser's stability and enhanced the responsiveness of the print preview interface.
• TLS now includes the implementation of a Key Encapsulation Mechanism (KEM), using the hybrid algorithm X25519Kyber768, which is resistant to brute force attacks on quantum computers. For creating session keys used for encrypting data within TLS connections, a combination of the X25519 key exchange mechanism based on elliptic curves currently used in TLS, and the Kyber-768 algorithm, which employs lattice-based cryptography methods that have similar solution times on both classical and quantum computers, can now be utilized.
• The Permission Suggestions Service now takes into account the URL of the page requesting permissions. servers Hashes of the requesting permission URLs will be sent to Google.
• Support for the Android 7.0 'Nougat' platform has been discontinued in the Android version.
• A framework has been added to implement Close requests, allowing users to request the closing of modal and pop-up dialogs by pressing the Esc key or using a screen gesture or the 'Back' button on smartphones. Support for Close requests has been added for dialogs created using the
  element or the 'popover' property. An API CloseWatcher has also been added, enabling app developers to track Close requests and respond to them (for example, a handler can be created for the 'back' button press on Android smartphones).
• Support for the 'name' attribute has been added to the
  element, allowing groups to be created by defining a series of

  elements with the same name.
• The Media Session API has added the 'enterpictureinpicture' event, allowing the website to register a handler that is triggered when content is opened in picture-in-picture mode.
• The syntax for nested CSS blocks has been simplified — nested CSS rules can now start with any element, without the need to specify the ampersand character before the nested rule or use the is() function. dl { dt { /* style for dl dt */ } dd { /* style for dl dd */ } }
• The CSS property 'background-clip' now supports the 'text' parameter to display the specified background only within the area restricted by the text characters. For example, specifying 'background: linear-gradient(60deg, red, yellow, red, yellow, red); background-clip: text; color: rgba(0, 0, 0, 0.2)' will result in the following display:
• The 'scripting' media query has been added to CSS, which can be used to determine the ability to execute scripts, such as JavaScript, on the current page.
• The ':dir()' pseudo-class has been added to CSS, allowing the selection of elements based on the directionality of the text (for example, ':dir(ltr)' will cover elements where text is output from left to right).
• Exponential functions pow(), sqrt(), hypot(), log(), and exp() have been added to CSS.
• Support has been added in CSS for the properties mask, mask-image, mask-repeat, mask-position, mask-clip, mask-origin, mask-size, mask-composite, and mask-mode to hide an element by overlaying an image at specified points.
• The FontFaceSet API has added the check() method, which allows checking whether text can be displayed with the selected fonts without using fonts in FontFaceSet that have not yet finished loading.
• The WebGPU API has added support for using a 16-bit floating-point type f16 in shaders.
• In the Media Capabilities API, the decodingInfo() method has been enhanced with hdrMetadataType, colorGamut, and transferFunction fields to determine HDR support.
• The MediaStreamTrack API has added the ability to obtain information about counters for received and dropped video frames.
• It is now possible to pass an ArrayBuffer object to the constructors VideoFrame, AudioData, EncodedVideoChunk, EncodedAudioChunk, and ImageDecoder for direct use of the byte array without creating a copy.
• In accordance with the updated specification to enhance protection against XSS attacks and improve portability between browsers, support for 'data:' URLs in SVGUseElement has been discontinued, which was previously unsupported in the WebKit engine.
• Experimental (origin trial) support has been added for the HTTP header "Priority", which can convey priority processing information for requests (RFC 9218) at the initial resource request stage.
• Improvements have been made to the tools for web developers. The debugger now ignores scripts located in the "/node_modules/" and "/bower_components/" directories with Node.js modules by default. A toggle has been implemented in remote debugging mode to switch between mouse and touchscreen input. Animation debugging has been enhanced. A "media" toggle has been added to the Elements panel for debugging

In addition to new features and bug fixes, the new version resolves 10 vulnerabilities. Many of these vulnerabilities were identified through automated testing using AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues were found that would allow bypassing all browser security levels and executing code on the system outside the sandbox environment. Under the vulnerability bounty program for this release, Google has awarded 13 bounties totaling $15,000 (one reward of $10,000, one of $2,000, and three of $1,000).

Source: opennet.ru