Google has released version 140 of the Chrome web browser. At the same time, a stable release of the free project Chromium, which serves as the basis for Chrome, is available. Chrome differs from Chromium in that it uses Google logos, includes a crash reporting system, modules for playing DRM-protected video content, an automatic update installation system, continuous Sandbox isolation, provides keys to Google APIs, and transmits RLZ parameters during searches. For those who need more time to update, the Extended Stable branch, with support for 8 weeks, is maintained separately. The next release, Chrome 141, is scheduled for September 30.
Key changes in Chrome 140:
- To enhance protection against tracking across websites in incognito mode, a feature has been implemented to hide the user's IP address information in third-party contexts (for example, on pages loaded via iframe). The hiding is applied only to domains present in the MDL (Masked Domain List) and is achieved by sending requests not directly but through Google’s proxy server. Consequently, the site will see the incoming an IP address proxy address instead of the user’s.
- To obtain selective information about users' IP addresses when the IP protection mode is enabled in the browser, which sends requests through a transit proxy, a mechanism called PRT (Probabilistic Reveal Token) has been implemented. PRT involves sending a header with an encrypted token that allows obtaining a random truncated sample of real client IP addresses that have accessed a given domain, but are not tied to specific requests. Some PRT tokens contain real IP information, while others do not, and the token's content can only be determined after a certain period of time by decrypting it with a key issued by Google after a separate request. Such information about IP addresses can be used in fraud protection systems and for analyzing the quality of web traffic.
- The incognito mode features a "Script Blocking" mechanism that selectively blocks access to certain JavaScript APIs, which can be used for covert user identification. For example, differences in image rendering by various browsers through the Canvas API can be considered an additional identifier. Blocking occurs only for third-party content (such as content embedded on the page via iframe or script tags) when activity specific to covert identification is detected and for domains on the MDL (Masked Domain List) blacklist, which are implicated in hidden identification.
- The OverrideDefaultOzonePlatformHintToAuto mode has been enabled for automatic backend selection in the Ozone layer, which abstracts interaction with the graphical subsystem. This change allows for adaptive activation of the Wayland backend on systems that support Wayland, without being tied to the X11 backend by default.
- An AI-based automatic password change feature has been implemented. If a password appears in known databases of compromised accounts, upon attempting to log in with that password, Chrome will display a warning with a suggestion to change the password. If the user agrees, the browser will generate a strong password, change the password on the site (automatically filling out and submitting the required web forms), and save the new password in the password manager.
- DSE Prewarming (Default Search Engine Prewarming) has been optimized to accelerate the opening of the search results page after executing a query through the address bar. When DSE Prewarming is enabled, right after the input focus shifts to the address bar, the layout of the search results page is prerendered, and the necessary resources for that page are loaded. The loaded resources are also used to speed up subsequent requests. This feature is currently enabled by default only for a portion of users.
- The autofill mechanisms have been expanded, utilizing an AI model to understand web forms and automatically fill out fields based on how the user previously filled out similar forms. The setting "Autofill with AI" has been renamed to "Enhanced autofill." In the new version, the number of countries and languages available for this feature has been increased, and additional types of information have been added.
- For users in the U.S., the built-in Gemini chatbot is activated in the browser, which can explain the content of the viewed page and answer related questions without switching tabs. Text and voice interaction with Gemini is supported. In the future, the chatbot is planned to be available for users from other countries as well.
- All users now have the ability to join already created groups of shared tabs, which can be worked on simultaneously by multiple users. The ability to create groups is currently only available for users of test builds (Beta/Dev/Canary), implying that they can create a set of tabs and share it with other users, who will see the same tabs on their devices. If any participant changes a tab in the group, the change will be immediately reflected on the devices of the other users.
- The design of warnings shown when trying to access a site without HTTPS has been changed if the settings (chrome://settings/security) are configured to allow only secure connections. Instead of displaying a warning page, a dialog appears below the address bar, blocking data loading without encryption until the user chooses an action.
- In requests related to preloading resources or rendering ( or ), the HTTP header 'Sec-Purpose' is now being sent. The previously used HTTP header 'Purpose: prefetch' has been deprecated but has not yet been disabled by default to maintain compatibility.
- In the API ToggleEvent, a source property has been added, containing the Element object representing the control that initiated the state change, in response to which the Toggle event was generated. For example, when a user clicks on the '
- The ability to use functions counter() and counters() within alternative text in the 'content' property has been added (for example, 'content: "Chapter" counter(chapter);').
- The CSS property "caret-animation" has been added, allowing control over cursor change animations in input fields (for example, the blinking cursor can be replaced with a custom animation). Properties such as animation-timing-function, animation-iteration-count, animation-direction, and animation-play-state have also been added to manage transition animation effects.
- The CSS rule "@font-face" has been updated to support the font-variation-settings property, enabling the customization of glyphs in variable fonts (line thickness, character width, slant, etc.).
- CSS now supports typed arithmetic, allowing for expressions such as "calc(10em / 1px)" and "calc(20% / 0.5em * 1px)" to be used.
- Methods Uint8Array.prototype.toBase64, Uint8Array.prototype.toHex, Uint8Array.fromBase64, and Uint8Array.fromHex have been added for converting between Uint8Array and data in base64 or hexadecimal formats.
- Web developer tools have enhanced capabilities related to AI for debugging performance issues. Support for emulating behavior when using the HTTP header "Save-Data" has been added.
In addition to new features and bug fixes, the latest version has addressed six vulnerabilities. Many of these vulnerabilities were identified through automated testing tools such as AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues that could bypass all layers of browser protection and execute code outside the sandbox environment were detected. As part of the vulnerability reward program for this release, Google has paid out four bounties totaling $10,000 (one bounty of $5000, one of $4000, and one of $1000). The amount of one bounty has yet to be determined.
Source: opennet.ru
