Google Inc. release of the web browser . At the same time, the stable release of the open-source project , which serves as the foundation for Chrome. The Chrome browser using Google logos, the ability to load the Flash module on demand, a notification system in case of crashes, modules for playing protected video content, an automatic update installation system, and transmission during searches . The next release of Chrome 75 is scheduled for June 4.
:
- When the onUnload event occurs, triggered when closing the page, we now display pop-ups (the call to window.open() is blocked), which will protect users from forced opening of advertising pages after leaving suspicious sites;
- In the JavaScript engine a new mode has appeared (the ‘—jitless’ flag), allowing JavaScript to run without using JIT (only the interpreter is used) and without allocating executable memory during code execution. Disabling JIT can be beneficial for improving security when working with potentially dangerous web applications, as well as for ensuring builds on platforms that prohibit JIT usage (e.g., iOS, some Smart TVs, and gaming consoles). When JIT is disabled, JavaScript execution performance decreases by 40% in the Speedometer 2.0 test and by 80% in the Web Tooling Benchmark test, but a performance drop of only 6% was noted when simulating work with YouTube. Memory consumption, on the other hand, decreases slightly, by only 1.7%;
- V8 has also introduced a large number of new optimizations. For example, function call execution has been accelerated by 60% when the number of actually passed parameters does not match the number of arguments specified in the function definition. Access to DOM properties has been sped up using the get function, positively impacting the performance of the Angular framework. JavaScript parsing has been accelerated: optimizing the UTF-8 decoder has resulted in an 8% performance increase in streaming mode (parsing as loading occurs), and eliminating unnecessary deduplication operations has provided an additional 10.5% boost;
- Efforts have been made to reduce the memory consumption of the JavaScript engine.
A code for clearing the bytecode cache has been added, which takes up about 15% of the total heap size. A stage has been added to the garbage collector for evicting rarely compiled bytecode for used functions or functions that are only called during initialization. The decision to clean is based on new statistics that take into account the last access time to the bytecode. This change has reduced memory consumption by 5–15% without negatively impacting performance. Additionally, the bytecode compiler has been modified to prevent the generation of unused code, such as that which follows return or break statements (if there is no jump transition);
- For WebAssembly support for threads and atomic operations (WebAssembly Threads API and WebAssembly Atomics);
- For standalone script delivery, support for the "#!" header has been added, which defines the interpreter for execution. For example, similar to other scripting languages, a JavaScript file may look like this:
#!/usr/bin/env node
console.log(42); - A new media query "" has been added to CSS, allowing the site to determine the state of system settings related to disabling animated effects. With the proposed query, the site owner can learn that the user has disabled animated effects and also disable various animation features on the site, for instance, removing the shake effect from buttons designed to attract attention;
- In addition to the feature introduced in Chrome 72 for defining public fields, marking fields as private has been implemented, after which access to their values will be restricted to the class itself. To mark a field as private, the "#" sign should be placed before the field name. As with public fields, private properties do not require explicit use of the constructor.
- The HTTP header Feature-Policy, which allows controlling the behavior of APIs and enabling certain features (for example, enabling synchronous mode in XMLHttpRequest or disabling the Geolocation API), has been supplemented by to control the activity of certain capabilities. Two new methods, document.featurePolicy and frame.featurePolicy, have been proposed for developers, offering three functions:
allowedFeatures() to get a list of functions permitted for the current domain, allowsFeature() for selectively checking the inclusion of specific features, and getAllowlistForFeature() for outputting a list of domains for which the specified feature is allowed on the current page; - Experimental support has been added for the mode ("chrome://flags#enable-text-fragment-anchor") , allowing links to be created for specific words or phrases without explicitly indicating labels in the document using the 'a name' tag or the 'id' property. A special parameter '#targetText=' is provided for the link, where you can specify the text to jump to. It is permissible to include a mask that encompasses phrases indicating the start and end of the fragment, using a comma as their separator (for example, 'example.com#targetText=startwords, endwords');
- An option has been added to the AudioContext constructor , allowing the sample rate for audio operations through the Web Audio API to be set;
- Support for the class has been added , providing methods for parsing and processing locale parameters such as language, region, and script, as well as for reading and writing Unicode extension tags and saving user locale settings in a serialized format;
- The mechanism (SXG) has been expanded with means for content distributors regarding errors in loading signed content, such as problems with certificate verification. Error handling is done through the Network Error Logging API . It should be noted that SXG allows the owner of one site to authorize the hosting of certain pages on another site with a digital signature, after which, when these pages are accessed on the second site, the browser will show the user the original site's URL, despite the page being loaded from a different host;
- A method has been added to the TextEncoder class , which allows writing the encoded string directly into a pre-allocated buffer. The encodeInto() method is a high-performance alternative to the encode() method, which requires the buffer allocation to be performed with each call.
- In the Service Worker buffering of the client.postMessage() call until the document is ready. Messages sent through client.postMessage() will be retained until the DOMContentLoaded event is generated, onmessage is set, or startMessages() is called;
- In accordance with the requirements of the CSS Transitions specification the transitionrun, transitioncancel, transitionstart, and transitionend events, generated when a CSS transition is queued, canceled, starts, or ends execution.
- When specifying an incorrect character encoding MIME type for an XMLHttpRequest via overrideMimeType(), it now falls back to UTF-8 instead of Latin-1;
- The property 'allow-downloads-without-user-activation' has been deprecated and will be removed in one of the upcoming releases. This property allowed for automatic file downloads during iframe processing. In the future, downloading files without explicit user action will be prohibited, as it has been actively used for abuse, forcing downloads, and inserting parts of malware onto the user’s computer. A user click on the same page will be required to initiate a download. Initially, this property was planned to be removed in Chrome 74, but the removal was delayed until Chrome 76.
- An optional dark theme is offered for the Windows platform (in the previous release, dark theming was prepared for macOS). Since the dark theme is almost identical to the incognito mode layout, a special indicator has been added to highlight the private browsing mode instead of the user profile icon;
- For enterprise users, the ability has been added to manage user browser settings through the Google Admin console;
56 vulnerabilities. AddressSanitizer , , , and . No critical issues were found that would allow bypassing all levels of browser security and executing code on the system outside the sandbox environment. As part of the vulnerability reward program for the current release, Google has awarded 19 rewards totaling $26,837 (four rewards of $3,000, four rewards of $2,000, one reward of $1,337, four rewards of $1,000, three rewards of $500). The amount of 4 rewards has not yet been determined.
Source: opennet.ru
