Google Inc. release of the web browser . At the same time, the stable release of the open-source project , which serves as the foundation for Chrome. The Chrome browser features the use of Google logos, a crash notification system, the ability to load Flash plugins on demand, modules for playing protected video content (DRM), an automatic update installation system, and the transmission of RLZ parameters during searches. . The next release of Chrome 85 is scheduled for August 25.
:
- support for TLS 1.0 and TLS 1.1. To access sites over a secure connection, the server must support at least TLS 1.2; otherwise, the browser will now display an error. According to Google, currently about 0.5% of web page requests are still made using outdated versions of TLS. The shutdown is in accordance with IETF (Internet Engineering Task Force). The reason for discontinuing TLS 1.0/1.1 is the lack of support for modern ciphers (such as ECDHE and AEAD) and the requirement to support older ciphers, the reliability of which is now questioned in the current stage of computing (e.g., they require support for TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, and MD5 and SHA-1 are used for integrity and authentication). The setting that allows reverting to TLS 1.0/1.1 will be retained until January 2021.
- Blocking is ensured (unencrypted) of executable files and added warnings for unsafe archive downloads. In the future, support for downloading files without encryption is planned to be gradually discontinued. The blocking was implemented because downloading files without encryption can be used for malicious actions by substituting content during MITM attacks.
- initial support , being developed as an alternative to the User-Agent header. The Client Hints mechanism offers a series of headers 'Sec-CH-UA-*' as a replacement for User-Agent, allowing selective delivery of data about specific browser and system parameters (version, platform, etc.) only after a request from the server. Users can specify which parameters are permissible to provide and selectively give such information to website owners. When using Client Hints, the identifier is not sent by default without an explicit request, making passive identification impossible (by default, only the browser name is indicated). by until next year.
- activation
stricter on Cookie transmission between sites, which had been Due to COVID-19, the processing of third-party cookies set when accessing sites different from the current page's domain is prohibited for non-HTTPS requests. Such cookies are used to track user movements across sites in advertising networks, social media widgets, and web analytics systems.It is worth noting that the SameSite attribute, specified in the Set-Cookie header for controlling cookie transmission, will by default be set to 'SameSite=Lax', which restricts the sending of cookies for cross-site subrequests, such as image requests or content loading via iframes from another site. Websites can override the default SameSite mode by explicitly setting the SameSite attribute to None when establishing cookies. Moreover, the value SameSite=None for cookies can only be set in Secure mode (applicable for connections via HTTPS). This change will be implemented gradually, starting with a small percentage of users and then gradually expanding the reach.
- An experimental implementation has been added , which can be activated using the setting 'chrome://flags/#enable-heavy-ad-intervention'. The blocker automatically disables ad iframe blocks after exceeding threshold values of traffic and CPU load. Blocking will occur if more than 60 seconds of CPU time is spent on the main thread in total, or 15 seconds in a 30-second interval (using 50% of resources for more than 30 seconds), as well as when more than 4 MB of data is loaded over the network.
Blocking will only occur if the user has not interacted with the ad block (for example, has not clicked on it) before exceeding the limits, which, considering traffic restrictions, will allow blocking the autoplay of large video ads without explicit user activation. The proposed measures will free users from ads with inefficient code implementation or intentional parasitic activity (such as those performing mining). According to Google statistics, the ads falling under the blocking criteria make up only 0.30% of all ad blocks, but these ads consume 28% of CPU resources and 27% of traffic from the total ad volume.
- Work has been done to reduce CPU resource consumption when the browser window is not visible to the user. Chrome now checks if the browser window is being overlapped by other windows and excludes pixel rendering in overlapping areas. The rollout of this new feature will be gradual: optimization will be enabled for some users in Chrome 84, and for the rest in Chrome 85.
- Enabled by default is protection against , such as spam requests for push notifications. Since such requests interrupt user tasks and distract attention to confirmation dialog actions, instead of a separate dialog, an informational tooltip will be displayed in the address bar that does not require user action, warning about blocking the authority request, which automatically collapses into an indicator with a strikethrough bell icon. By clicking on the indicator, the requested permission can be activated or declined at any convenient moment.
- User selection is remembered when opening external protocol handlers—users can choose 'always allow for this site' for a specific handler, and the browser will remember this decision linked to the current site.
- Protection against changing user settings without explicit consent has been added. If an extension changes the default search engine or the page displayed for a new tab, the browser will now show a dialog asking to confirm the specified action or cancel the change.
- implementation of protection against loading mixed multimedia content (when resources are loaded over http:// on an HTTPS page). On pages opened via HTTPS, links 'http://' will now automatically be replaced with 'https://' in blocks related to image loading (previously scripts and iframes were replaced, and automatic replacement of audio and video resources is expected in the next release). If an image is unavailable via https, its loading is blocked (it can be manually marked as blocked via the menu accessible through the padlock symbol in the address bar).
- Support for the API has been added (developed as SMS Receiver API), allowing for the integration of one-time password input on a web page after receiving an SMS message with a confirmation code sent to the user's Android smartphone running a browser. SMS confirmation, for example, can be used to verify the phone number provided by the user during registration. Previously, the user had to open the SMS application, copy the code to the clipboard, return to the browser, and paste the code; however, the new API enables this process to be automated and reduced to a single touch.
- Expanded API
for controlling the playback of web animations. The new release adds support for compositing operations, allowing for control over how effects are combined and providing new handlers that are invoked upon content replacement events. The Web Animations API also now supports Promises to define the sequence in which animations are displayed and to better manage how animations interact with other application features. - Several new APIs have been added in Origin Trials (experimental features that require separate activation). Origin Trials allow the specified API to be used from applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token, which is valid for a limited time for a specific site.
- API to allow Service Workers to access HTTP Cookies, serving as an asynchronous alternative to using document.cookie.
- API for detecting user inactivity, allowing the determination of when a user is not interacting with the keyboard/mouse, when the screensaver is active, the screen is locked, or when work is being done on another monitor. The application is informed of inactivity by sending a notification after reaching a specified inactivity threshold.
- Mode , allows developers to use more complete isolation of content processing in a separate process tied to the origin (origin - domain+port+protocol), rather than the site, at the cost of discontinuing support for some deprecated features, such as synchronous execution of scripts using document.domain and calling postMessage() for sending messages to instances of WebAssembly.Module. In other words, Origin Isolation allows for process separation based on the resource domain instead of the site, along with all extraneous inclusions on the pages.
- API for using vector SIMD instructions in WebAssembly applications. To ensure platform independence, a new 128-bit type is proposed that can represent different types of packed data, along with several basic vector operations for processing packed data. SIMD allows for improved performance by parallelizing data processing and will be beneficial when compiling native code to WebAssembly. To enable SIMD support, you can use the setting "chrome://flags/#enable-webassembly-simd".
- Stabilized and now distributed outside of Origin Trials
API , providing metadata about content that was previously cached by web applications operating in Progressive Web Apps (PWA) mode. The application can store various data on the browser side, including images, videos, and articles, and can utilize them when the network connection is lost, through the Cache Storage and IndexedDB APIs. The Content Indexing API allows adding, finding, and deleting such resources. This API is already used in browsers to list the pages and multimedia data available for offline viewing. - The API variant has been stabilized based on the Promise mechanism, providing a safer way to manage screen auto-lock disabling and transitioning devices into power-saving modes.
- In the version for the Android platform supporting application shortcuts that allow for quick access to commonly used actions in the application. To create shortcuts, simply add items to the web application manifest in PWA format.
- API usage is permitted for Web Workers , which allows defining a handler for generating a report triggered by the use of deprecated features. The generated report can be saved by the user, sent to a server, or processed by a JavaScript script.
- Updated API , which allows attaching a handler that will receive notifications about the size changes of specified elements on the page. Three new properties have been added to ResizeObserverEntry: contentBoxSize, borderBoxSize, and devicePixelContentBoxSize to provide more detailed information, output as an array of ResizeObserverSize objects.
- The keyword "" has been added to reset the style of an element to its default value.
- The CSS property prefixes "-webkit-appearance" and "-webkit-ruby-position" have been removed and are now available as "" and "«.
- In JavaScript support for marking class methods and properties as private, after which access to them will be limited to within the class (previously, only fields could be private). To mark methods and properties as private, you should use the '#' sign before the field name.
- In JavaScript disabling the tracker blocking (weak reference) to JavaScript objects, allowing a reference to be maintained without preventing the related object from being garbage collected. Support for finalizers has also been added, allowing a handler to be defined that is invoked after a specified object's garbage collection is completed.
- Application launch on WebAssembly has been accelerated due to the implementation in the initial (baseline) compiler Liftoff. and . Improved tools for debugging WebAssembly, significantly enhancing debugging performance when using breakpoints (previously, an interpreter was used for debugging, but now the Liftoff compiler is utilized).
- In the web development tools at https://developers.google.com/web/updates/2020/05/devtools, the panel for analyzing performance has been updated. General information about the (Total Blocking Time) metric has been added, showing how long a page appears accessible, but is actually not (i.e., the page is rendered, but the main thread execution is blocked, preventing data input). A new Experience section for analyzing the (Cumulative Layout Shift) metric, reflecting the visual stability of the content, has been implemented. In the CSS styles inspection panel, a preview of images specified via the "background-image" property has been realized.
56 vulnerabilities. AddressSanitizer , , , and . One issue (CVE-2020-6510, buffer overflow in the fetch background operations handler) has been marked as critical, allowing it to bypass all browser security levels and execute code in the system outside the sandbox environment. As part of the vulnerability reward program for this release, Google has paid 26 rewards totaling $21,500 (two rewards of $5,000, two rewards of $3,000, one reward of $2,000, two rewards of $1,000, and three rewards of $500). The size of 16 rewards has not yet been determined.
Source: opennet.ru
