Google has released version 133 of the Chrome web browser. Alongside this, a stable release of the open-source project Chromium, which serves as the foundation for Chrome, is available. Chrome differs from Chromium by featuring Google logos, a crash reporting system, modules for playing protected video content (DRM), an automatic update mechanism, continuous Sandbox isolation, the supply of keys to Google APIs, and the transmission of RLZ parameters during searches. For those who need more time to update, a separate Extended Stable branch is available, supported for 8 weeks. The next release, Chrome 134, is scheduled for March 4.
Key changes in Chrome 133:
- For 1% of users, support for tab freezing in energy saver mode has been enabled. Tabs that consume a lot of CPU resources and have been inactive for more than 5 minutes are automatically frozen. Tabs playing sound and those related to managing external devices or conducting video and audio conferences are exempt from freezing (such tabs are identified based on access to the USB, Bluetooth, camera, input device, and microphone APIs, as well as establishing communication channels using RTCDataChannel or MediaStreamTrack). The auto-freezing feature can be managed using the setting 'chrome://flags/#freezing-on-energy-saver'.
- Support for versions of Chrome older than 4 years has been discontinued in Chrome Sync. To store information linked to your Google account and synchronize browser data across systems, at least version 89 of Chrome should be used.
- In the Android version, a setting to disable JIT compilers in the V8 JavaScript engine has been added. Disabling JIT can be beneficial for enhancing security when dealing with potentially hazardous web applications by reducing possible attack vectors. In desktop versions of Chrome, a similar setting is available on the chrome://settings/security page starting from version 122.
- Updated to comply with the standard for parsing non-special URL schemes (not included in the list of common schemes). For example, the URL 'git://example.com/path'.
- The capabilities of the CSS function attr() have been expanded, allowing the use of specific HTML attribute values in CSS. Previously, the attr() function could only work with the 'content' property of pseudo-elements and convert values to CSS type<string>, but now it can be applied to any CSS properties and convert values to any CSS types. In the example below, the color in the CSS property 'color' is set based on the value parsed from the 'data-foo' custom attribute specified in the 'div' element, and if the attribute is not specified, the value 'red' is used. <div data-foo="»blue»">test</div> … div { color: attr(data-foo type(<color>), red); }
- The CSS query "@container scroll-state()" has been implemented, allowing the determination of the scroll state of an area. Supported states include: "stuck" — a container attached to one side of a scrolling area; "snapped" — a container attached with alignment either horizontally or vertically; "scrollable" — a container that can be scrolled in the specified direction.
- New CSS properties "text-box", "text-box-trim", and "text-box-edge" have been added to precisely control the margins before and after text. The property "text-box-trim" defines the trimming area (top, bottom, or both sides), while "text-box-edge" specifies the method for trimming edges. The "text-box" property combines the functionalities of "text-box-trim" and "text-box-edge."
- The pseudo-class ":open" has been added to CSS, which allows determining when dialog windows for <dialog> and <details> elements are open, as well as when selection windows for <select> and <input> elements are displayed.
- The DOM primitive moveBefore has been introduced to move an element in the DOM tree without resetting its state.
- The FileSystemObserver interface has been added, allowing sites to track changes in the file system.
- The method getClientCapabilities() has been added to the PublicKeyCredential API for determining the WebAuthn capabilities supported by the browser.
- The Atomics object has been augmented with the pause() property to indicate that the code is waiting for a lock to be released.
- Support for the X25519 key agreement scheme has been added to the WebCrypto API, which can be utilized through the SubtleCrypto interface (methods generateKey, importKey, exportKey, deriveKey, and deriveBits).
- WebAssembly has implemented support for 64-bit pointers (Memory64), allowing for the handling of linear memory areas exceeding 4 GB. This change does not add new WebAssembly instructions but enables the use of 64-bit indices for tables and memory areas in existing instructions. Operating in Memory64 mode incurs significant overhead — depending on the type of load, a slowdown ranging from 10% to double can be observed.
- The tools for web developers have been enhanced. Chat history with the AI assistant is now preserved between sessions. A 'What’s new' panel has been added, providing an overview of changes in the new version. Scripts can now be added to an ignore list to exclude them from being displayed in the performance profiling diagram. In the Performance panel, the Insights tab highlights images that can be optimized, while the Summary tab shows the JavaScript call stack trace (including asynchronous calls).
In addition to new features and bug fixes, the latest version addresses 12 vulnerabilities. Many of these vulnerabilities were discovered through automated testing using tools like AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. Two issues related to accessing already freed memory in the V8 engine and Skia library have been assigned a high severity level. No critical issues allowing an escape from all browser security levels to execute code outside the sandbox environment have been identified. As part of the bug bounty program for this release, Google has awarded 2 prizes totaling $9,000 (one prize of $7,000 and another of $2,000). The amount of a single reward has not yet been determined.
Source: opennet.ru
