Google has released version 128 of the Chrome web browser. At the same time, a stable release of the open-source Chromium project, which serves as the foundation for Chrome, is available. The Chrome browser differs from Chromium in its use of Google logos, a crash notification system, modules for playing DRM-protected video content, an automatic update installation system, constant Sandbox isolation, the delivery of keys to Google APIs, and the transmission of RLZ parameters during searches. For those who need more time to update, a separate Extended Stable branch is supported for an additional 8 weeks. The next release, Chrome 129, is scheduled for September 17.
Key changes in Chrome 128:
- The ability to search in browsing history has been provided, taking into account the content of the opened pages, not just URLs and titles. At this stage, this feature is only available to English-speaking users in the United States. The content search functionality is implemented using a Google-side machine learning system, for which relevant data may be sent to servers Google (this sending can be disabled in settings).
- A new JSON parser has been implemented, rewritten from C++ in the Rust language, and providing higher security by reducing the likelihood of memory-related errors. It is noted that the switch to the new parser may lead to some incorrectly formatted JSON content no longer being parsed, but it also resolves issues with malformed JSON that previously caused crashes, now leading to an error code being returned.
- On the page displayed when opening a new tab, the ability to place a section with data from Google Calendar has been added, allowing users to keep an eye on upcoming meetings and events.
- In Chrome for Android, a new section has been added to the tab switching interface, into which inactive tabs open for more than 60 days are automatically moved. There is also an option to close all old tabs at once. By default, this new feature is enabled for 1% of users.
- Chrome for Android has added support for Safety Check, which periodically scans for issues in the browser and notifies users of any threats that require attention. Additionally, the layout of the Safety Check page in settings (chrome://settings/safetyCheck) has been modified.
- In the WebView component of Chrome for Android, support for CHIPS (Cookies Having Independent Partitioned State) technology has been temporarily disabled, which was being developed under the Privacy Sandbox initiative to isolate cookies tied to domain the first level, using the attribute "Partitioned." The disabling was due to issues with accessing partitioned cookies through the CookieManager API provided by the Android platform.
- In centrally managed systems, administrators are given the ability to create custom quick search shortcuts through the address bar (a shortcut like "@name" can be created for searching a specific website), as well as manage unencrypted passwords in the built-in password manager (for instance, it is possible to set up the deletion of such passwords that remain after migration to another device using third-party software).
- The version for Chrome OS has added support for the mechanism of launching self-contained web applications, IWA (Isolated Web Apps), which extends PWA (Progressive Web Apps) by applying stricter isolation to the application in the event of server compromise. The isolation is achieved by signing the application package with a digital signature, protecting against unauthorized changes, allowing for distribution through third-party channels without maintaining one's own server.
- The CSS property position-try-options has been renamed to position-try-fallbacks, in accordance with the recommendation of the CSS Working Group (CSSWG), as the term "options" is misleading and does not accurately reflect the true essence of the property.
- The HTML element , which allows attaching annotations to text displayed above, below, or next to the text—such as for clarifying the pronunciation or meaning of characters—now supports synchronous line-breaking when breaking long base text and annotations that do not fit in a single line and were previously broken separately. A new CSS property, ruby-align, has also been added to control the alignment of base text and annotations.
- The Promise.try() method has been added, allowing any callback call result to be converted into a Promise for simplifying error handling when executing functions, whether asynchronous or synchronous.
- A new attribute, PointerEvent.deviceProperties, has been added to the PointerEvent interface, which allows for the separate identification of different digital pens used with a graphics tablet (for example, each device can have its own color and shape assigned to the pen).
- The implementation of the CSS property zoom has been aligned with the specification, allowing for the reduction or increase of the scale of individual elements.
- Experimental support for the Digital Credentials API has been implemented in the 'Origin trials' mode, enabling websites to request necessary identification credentials from mobile wallet apps, utilizing the IdentityCredential CredMan system provided in Android.
- Experimental support for subgroups has been added to WebGPU, allowing the use of SIMD (Single instruction, multiple data) principles to parallelize computations.
- An experimental feature has been implemented to block access to IP 0.0.0.0 to prevent attacks on local services.
- Improvements have been made to web developer tools. The animation inspection panel now features the ability to capture animations and edit keyframes on the fly. The performance analysis panel has significantly expanded its capabilities. For most European countries, the ability to output explanations for errors generated using the large language AI model, Gemini, has been added to the web console.
In addition to new features and bug fixes, the latest version addresses 38 vulnerabilities. Many of these vulnerabilities were identified through automated testing tools such as AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. Seven issues have been assigned a high severity level. No critical issues that allow bypassing all security levels of the browser and executing code in the system outside the sandbox environment were found. As part of the bug bounty program for this release, Google awarded 20 prizes totaling $95,000 (one prize of $36,000, $10,000, $5,000, and $2,000; two prizes of $11,000, $7,000, and $500; four prizes of $1,000). The amount of five rewards has not yet been determined.
Source: opennet.ru
