Google has released version 125 of the Chrome web browser. At the same time, a stable release of the open-source project Chromium, which serves as the foundation for Chrome, is available. Chrome differs from Chromium by using Google logos, having a crash notification system, modules for playing protected content (DRM), an automatic update system, constant Sandbox isolation, supplying keys to Google APIs, and sending RLZ parameters during searches. For those who need more time to update, the Extended Stable branch is maintained separately for 8 weeks. The next release, Chrome 126, is scheduled for June 11.
Key changes in Chrome 125:
- Google has delayed the anticipated discontinuation of support for third-party cookies, which are set when visiting sites other than domain the current page (these cookies are used to track user movement across sites in advertising network code, social media widgets, and web analytics systems). In the new version, an indicator with an eye icon has been added to the address bar to identify sites that utilize third-party cookies; this icon is crossed out when third-party cookies are blocked. Since testing for disabling third-party cookies is ongoing for 1% of users, and there is an option for manual disabling via the setting 'chrome://flags/#test-third-party-cookie-phaseout', the context menu now provides an option to temporarily return support for third-party cookies for selected sites. The unblocking will last for 90 days after activation.
- With the enhanced protection of the browser enabled (Safe Browsing > Enhanced protection), automatic deep scanning of downloaded files has been implemented, performed by uploading information to servers Google (previously, a confirmation request was displayed before the external verification, but now the check will be performed automatically).
- Builds for the Windows platform are now also provided for the ARM64 platform.
- A new mechanism has been added for updating components that require downloading large amounts of data. This concerns the updating of models for recently added features using machine learning — the smart tab grouping mode, the theme generator, and the interactive assistant.
- Two new types of potentially problematic extensions have been added, for which users will receive warnings recommending that they consider the appropriateness of continuing to use them: extensions installed outside the Chrome Web Store and extensions that use deceptive tactics to force the installation of unnecessary software.
- The behavior when canceling the 'mousemove' event has been aligned with other browsers — canceling the event no longer blocks text selection and drag & drop operations (to block selection and drag & drop, selectstart and dragstart events should be canceled).
- A set of CSS properties has been added for controlling the display of elements bound to the position of other elements (CSS Anchor Positioning), without using JavaScript, for example, to attach to popover elements, which appear similarly to tooltips. To set the binding of one element to another and define the output area, the properties anchor-name, position-anchor, and inset-area have been proposed, and a function anchor() has been added to retrieve information about the binding location.
- Mathematical functions round(), mod(), and rem() have been added to CSS.
- A new syntax for reflecting the state of custom HTML elements in CSS has been added, allowing the use of the pseudo-class ':state()'.
- The Compute Pressure API has been added, allowing access to high-level information about the current state of hardware, for example, it provides an overview of the CPU load being created (indicating levels: minimal load with energy-saving features activated; permissible load allowing additional tasks to run without issue; high load, but within acceptable limits and not interfering with system operation; critical load, close to resource exhaustion).
- API Storage Access, used to request user permissions for accessing Cookie storage when third-party Cookies are blocked, has been enhanced with the ability to request access from third-party handlers (e.g., content inside ) to storage areas not related to Cookies, such as indexedDB.
- Experimental (origin trial) support for the API Viewport Segments Enumeration has been added, aimed at optimizing output on devices with foldable screens.
- The use of HTTP and HTTPS URL schemes is now allowed in the WebSocket constructor instead of the 'ws:' and 'wss:' schemes.
- JavaScript now permits the use of modifiers '?i', '?-i', '?m', '?-m', '?s', '?-s' within regular expressions to control enabling or disabling the 'i', 's', and 'm' flags. For example, '?-i' in 're1 = /^[a-z](?-i:[a-z])$/i;' will disable the '/i' (case-insensitive) flag for the second character (re1.test('aB') will return false).
- Improvements have been made to developer tools. A button has been added to the web console to provide context about errors or warnings generated through calls to the AI chatbot Gemini. The CSS panel now supports '@position-try' rules. The editor and viewer for the page's source text include settings for formatting minified pages for better readability and automatically closing brackets during editing. The network activity tracking panel has added support for HTTP headers used in responses with a 103 'Early Hints' status code. Performance analysis panel statistics now include information on CSS selectors.
In addition to new features and bug fixes, the new version addresses 9 vulnerabilities. Many of these vulnerabilities were identified through automated testing using tools like AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. The vulnerability CVE-2024-4947, caused by improper type handling (Type Confusion) in the V8 engine and classified as critical, was exploited by attackers prior to the fix (0-day). No critical issues that allow breaching all levels of browser protection and executing code outside the sandbox environment have been found. As part of the vulnerability reward program for the current release, Google has awarded 4 rewards totaling $8,000 (one reward of $7,000 and one of $1,000). The amounts for the two rewards have not yet been determined.
Source: opennet.ru
