Google has published the release of the Chrome 147 web browser. At the same time, a stable release of the free Chromium project, which is the basis of Chrome, is available. The Chrome browser differs from Chromium in the use of Google logos, the presence of a system for sending notifications in the event of a crash, modules for playing copy-protected video content (DRM), an automatic update installation system, constant inclusion of Sandbox isolation, supply of keys to the Google API and transmission of RLZ parameters during search. For those who need more time to update, the Extended Stable branch is separately supported, supported for 8 weeks. The next release of Chrome 148 is scheduled for May 5.
Key changes in Chrome 147 (1, 2, 3, 4):
- A vertical tab display mode has been added, replacing the top horizontal bar with tab buttons with a sidebar with vertical tabs. Vertical tabs can be displayed in expanded (icon + partial description) or collapsed (icon only) modes. Hovering over a side tab displays a thumbnail of its contents. Managing tab groups has been simplified. A "Show Tabs Vertically" option has been added to the context menu that appears when right-clicking on the tab row. If this option is not displayed by default, it can be enabled via the "chrome://flags/#vertical-tabs" setting.
- Reading mode has been redesigned to display only the relevant text on a page, hiding all related controls, banners, menus, navigation bars, and other non-content-related parts of the page. In the new version, similar to Firefox, relevant content is displayed in the entire visible area, rather than in a narrow sidebar next to the original page. If the new mode isn't enabled by default, it can be enabled via the "chrome://flags/#read-anything-immersive-reading-mode" setting.
- A button has been added to the "Help" menu for submitting a complaint to block web pages created for fraud or phishing purposes. This button is displayed when "Safe Browsing" mode is enabled.
- Expanded protection against local system access when interacting with public websites. Access from websites to IP addresses The local network (intranet or internal addresses) or loopback interface (127.0.0.0/8) will require user confirmation. Protection now covers not only attempts to load resources via HTTP/HTTPS, fetch() requests, and iframe insertions, but also connections via WebSockets and WebTransport, as well as fetch requests initiated via the WindowClient.navigate() method. Attackers exploit internal resource access for indirect identification and to carry out CSRF attacks on routers, access points, printers, corporate web interfaces, and other devices and services that only accept requests from the local network.
- XML parsing functionality has been migrated from libxml2 to a new library written in Rust with security in mind. This change only applies to XML; as previously announced, XSLT support will soon be deprecated.
- It is now possible to use the startViewTransition() method not only for the entire page, but also for individual HTML elements.
- The contrast-color() CSS function has been added. It returns the opposite of the specified color (for white, it returns black, and for black, it returns white). This function can be used to match the background color of a specific text color, and vice versa.
- The "border-shape" CSS property has been added, allowing you to create non-rectangular borders around elements, such as using circular or polygonal borders. The "border-shape" CSS property accepts the same shape types as the "clip-path" property, but unlike the latter, it detects a contour, decodes it, and clips any content that extends beyond the contour.
- Added the CSSPseudoElement interface, which allows working with CSS pseudo-elements from JavaScript.
- The link element now supports the use of the “rel=modulepreload” attribute to pre-load not only scripts, but also modules with CSS styles ( ) and JSON data ( ).
- The behavior of calculating the width of borders and outlines in the CSS properties border-width, outline-width, and column-rule-width has been changed, unifying it with Firefox and WebKit-based browsers. Previously, the width in these properties was reset to zero, regardless of their values, if the border-style, outline-style, or column-rule-style properties were set to "none" or "hidden." Now, the order-width, outline-width, and column-rule-width values always correspond to the developer-defined values, regardless of the contents of the "*-style" properties.
- Added the Math.sumPrecise() method for calculating the sum of array elements and other enumerable objects with precision greater than that of normal summation in a loop (eliminating precision losses when storing results in between).
- Added the Request.isReloadNavigation attribute to detect when a page has been reloaded, for example, after clicking the "Refresh" button or calling the location.reload() and history.go(0) methods.
- To reduce the accuracy of indirect identification, the logic for rounding the memory size returned via the Device Memory API, which provides information about the RAM size, has been changed. This information can be useful for creating lightweight versions of web applications that load on devices with limited RAM or for activating advanced features when large amounts of memory are available. In builds for the platform Android Memory size is now rounded to 1, 2, 4 and 8, and for other platforms to 2, 4, 8, 16 and 32.
- For isolated web applications (IWA), the Web Printing API is implemented, providing methods for determining the availability of printers, sending documents to print, and managing the print queue. The attribute names and semantics used in the API correspond to the Internet Printing Protocol (IPP).
- The "Origin trials" mode implements the WebNN API, which allows the use of machine learning services provided by the operating system and related hardware capabilities.
- Improvements have been made to web developer tools. The built-in AI assistant now automatically selects contexts. The "Device Mode" panel, used for testing website performance on different mobile devices, has been modernized. The Network panel now automatically decodes compressed content for requests sent with the Content-Encoding: gzip or deflate header. Regular expressions can now be used to filter CSS styles.
In addition to new features and bug fixes, the new version addresses 60 vulnerabilities. Many of the vulnerabilities were identified through automated testing using AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. Two issues (a buffer overflow and an integer overflow in WebML) were assigned a critical severity level, meaning they could bypass all layers of browser protection and execute code outside of the sandbox environment. As part of its vulnerability bounty program for the current release, Google has established 60 rewards and awarded $118 (two rewards of $43000, two rewards of $11000, and one reward each of $4000, $3000, $2000, and $1000). The amounts of 52 rewards have not yet been determined.
Source: opennet.ru
