Chrome 86

The latest release of Chrome 86 and the stable version of Chromium has been launched.

Key changes in Chrome 86:

• protection against insecure form submissions on pages loaded over HTTPS but sending data via HTTP.
• Blocking of insecure downloads (http) of executable files is supplemented by blocking the unsafe download of archives (zip, iso, etc.) and displaying warnings for insecure downloads of documents (docx, pdf, etc.). The next release is expected to block documents and display warnings for images, text, and multimedia files. This blocking has been implemented as downloading files without encryption can be used for malicious actions by manipulating content during MITM attacks.
• The context menu now defaults to showing the option 'Always show full URL', which previously required changes to the settings on the about:flags page. The full URL can also be viewed by double-clicking on the address bar. Note that starting from Chrome 76, addresses are displayed by default without the protocol and the subdomain www. In Chrome 79, the setting to revert to the old behavior was removed, but after user dissatisfaction, a new experimental flag was added in Chrome 83 that adds an item to the context menu to disable hiding and show the full URL under all circumstances.
  For a small percentage of users, an experiment has been launched to display only the domain by default in the address bar, without path elements and query parameters. For example, instead of "https://example.com/secure-google-sign-in/" " it will show 'example.com'. The rollout of the proposed mode to all users is expected in one of the upcoming releases. To disable this behavior, the option 'Always show full URL' can be used, and to view the entire URL, one can click on the address bar. The motivation for this change is to protect users from phishing attempts that manipulate parameters in URLs—attackers exploit users' inattention to create the illusion of visiting another site and committing fraudulent actions (while technically savvy users may notice such manipulations, unsuspecting individuals are easily deceived by these simple tricks).
• The initiative to remove FTP support has been resumed. In Chrome 86, FTP is disabled by default for approximately 1% of users, and in Chrome 87, the disabled coverage will increase to 50%, but support can be restored using the flag "—enable-ftp" or "—enable-features=FtpProtocol". In Chrome 88, FTP support will be completely disabled.
• In the Android version, similar to the desktop version, the password manager implements a check of saved logins and passwords against a database of compromised accounts, issuing a warning if issues are detected or if trivial passwords are attempted. The check is performed against a database covering over 4 billion compromised accounts that appeared in user data leaks. To maintain privacy, a hash-prefix verification is performed on the user's side, and the actual passwords and their full hashes are not sent outside.
• The Android version also includes the 'Safety check' button and an enhanced protection mode against dangerous sites (Enhanced Safe Browsing). The 'Safety check' button displays a summary of potential security issues, such as the use of compromised passwords, the status of malware site checks (Safe Browsing), the presence of uninstalled updates, and detection of malicious extensions. The enhanced protection mode activates additional checks for protection against phishing, malicious activity, and other threats on the web, as well as providing extra protection for Google accounts and Google services (Gmail, Drive, etc.). While in regular Safe Browsing mode checks are performed locally using a periodically updated database on the client's system, in Enhanced Safe Browsing, information about pages and downloads is sent in real time for verification on Google's side, which allows for prompt responses to threats as soon as they are identified, without waiting for the local blacklist to update.
• Support for the ".well-known/change-password" indicator file has been added, which allows website owners to specify the address of the web form for changing passwords. In case user credentials are compromised, Chrome will now immediately prompt the user with a form to change the password, determined based on information from this file.
• A new 'Safety Tip' warning has been implemented, displayed when opening websites with domains that are very similar to another site and heuristics indicate a high likelihood of spoofing (for example, opening goog0le.com instead of google.com).

  * Support for back-forward cache has been implemented, ensuring instant transitions when using the 'Back' and 'Forward' buttons or navigating previously viewed pages on the current site. The cache is enabled via the setting chrome://flags/#back-forward-cache.
• Optimization of CPU resource consumption for windows outside the viewport. Chrome checks if the browser window is overlapped by other windows and excludes pixel rendering in overlapping areas. This optimization was initially enabled for a small percentage of users in Chrome 84 and 85, and is now activated for everyone. Compared to previous releases, the incompatibility with virtualization systems that caused blank white pages has also been eliminated.
• Resource trimming for background tabs has been strengthened. Such tabs can now consume no more than 1% of CPU resources and can be activated no more than once a minute. After five minutes in the background, tabs are frozen, except for those playing multimedia content or recording.
• Work has resumed on unifying the User-Agent HTTP header. In the new version, support for the User-Agent Client Hints mechanism, developed as a replacement for User-Agent, has been activated for all users. This new mechanism implies selective delivery of specific browser and system parameters data (version, platform, etc.) only after a request from the server, giving users the ability to selectively provide such information to website owners. When using User-Agent Client Hints, the identifier is not sent by default without an explicit request, making passive identification impossible (by default, only the browser name is indicated).
  The indication of the availability of an update and the need to restart the browser for its installation has been changed. Instead of a colored arrow in the account avatar field, the text 'Update' now appears.
• Work has been done to translate the browser to use inclusive terminology. In policy names, the terms “whitelist” and “blacklist” have been replaced with “allowlist” and “blocklist” (existing policies will continue to function, but a warning will be displayed indicating their deprecation). Mentions of “blacklist” in the code and file names have been changed to “blocklist”. User-visible mentions of “blacklist” and “whitelist” were replaced back in early 2019.
  An experimental feature for editing saved passwords has been added, activated using the flag “chrome://flags/#edit-passwords-in-settings.”
• The Native File System API has been promoted to stable and publicly available, allowing the creation of web applications that interact with files in the local file system. For example, the new API may be in demand in browser-based integrated development environments, text, image, and video editors. To enable direct reading and writing of files or to use dialogs for opening and saving files, as well as for navigating directory contents, the application requests special confirmation from the user.
• A new CSS selector ":focus-visible" has been added, which uses the same heuristics as the browser does when deciding to show the focus indicator (the indicator appears when focus moves to a button using keyboard shortcuts, but not on mouse clicks). The previously available CSS selector ":focus" always highlights the focus. Additionally, a setting called “Quick Focus Highlight” has been added, which shows an extra focus indicator next to active elements, which remains visible even if visual focus highlighting through CSS is disabled on the page.
• Several new APIs have been added in Origin Trials (experimental features that require separate activation). Origin Trials allow the specified API to be used from applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token, which is valid for a limited time for a specific site.
• The WebHID API provides low-level access to HID devices (Human Interface Devices, such as keyboards, mice, gamepads, and touch panels), allowing for the implementation of logic in JavaScript to interact with rare HID devices without the need for specific drivers in the system. Primarily, the new API aims to support gamepads.
• The Screen Information API extends the capabilities of the Window Placement API by supporting multi-screen configurations. Unlike window.screen, the new API allows manipulation of window placement within the overall screen space of multi-monitor systems, without being limited to the current screen.
• The battery-savings meta tag allows a website to inform the browser of the need to activate power-saving modes and optimize CPU load.
• The COOP Reporting API informs about potential violations of Cross-Origin-Embedder-Policy (COEP) and Cross-Origin-Opener-Policy (COOP) isolation modes without imposing actual restrictions.
• The Credential Management API introduces a new type of credential called PaymentCredential, providing additional verification for payment transactions. For instance, the verifying party, such as a bank, can generate a PublicKeyCredential which can be requested by the merchant for extra secure payment confirmation.
• The PointerEvents API has added support for tilt angles of the stylus, including height (the angle between the stylus and the screen) and azimuth (the angle between the X-axis and the projection of the stylus on the screen), replacing the TiltX and TiltY angles (the angles between the stylus plane and one of the axes compared to the Y and Z axes). Functions for converting between height/azimuth and TiltX/TiltY have also been introduced.
• The encoding of spaces in URLs has changed; when calculated in protocol handlers, the navigator.registerProtocolHandler() method now replaces spaces with "" instead of "+", which standardizes the behavior with other browsers like Firefox.
• The CSS pseudo-element "::marker" has been added, allowing customization of the color, size, shape, and type of bullets and numbers for lists in
  and
  blocks.
  1. Support has been added for the HTTP Document-Policy header, which allows the establishment of access rules for documents, similar to the sandbox isolation mechanism for iframes, but more versatile. For example, through Document-Policy, the use of low-quality images can be restricted, slow JavaScript APIs can be disabled, rules for loading iframes, images, and scripts can be configured, the overall document size and traffic can be limited, methods that lead to page reflows can be banned, and the Scroll-To-Text function can be disabled.
  2. The
     element now supports the 'inline-grid', 'grid', 'inline-flex', and 'flex' options, set via the CSS 'display' property.
  3. The ParentNode.replaceChildren() method has been added to replace all child elements of a parent node with a different DOM node. Previously, node replacement could be done using a combination of the node.removeChild() and node.append() methods or via node.innerHTML and node.append().
  4. The range of URL schemes allowed for overriding with registerProtocolHandler() has been expanded. The list of schemes now includes decentralized protocols such as cabal, dat, did, dweb, ethereum, hyper, ipfs, ipns, and ssb, enabling links to elements to be defined independently of the site or gateway providing access to the resource.
  5. The Asynchronous Clipboard API now supports the text/html format for copying and pasting HTML via the clipboard (dangerous HTML constructs are cleaned during writing and reading to the clipboard). This change allows for the insertion and copying of formatted text with images and links in web editors.
  6. WebRTC has added the ability to connect custom data handlers invoked during the encoding or decoding stages of WebRTC MediaStreamTrack. This functionality can be used, for example, to add support for end-to-end encryption of data transmitted through intermediate servers.
     The JavaScript V8 engine has accelerated the implementation of Number.prototype.toString by 75%. Asynchronous classes now have a .name property with an empty value. The Atomics.wake method, which was once renamed to Atomics.notify to conform to the ECMA-262 specification, has been removed. The code for the JS-Fuzzer fuzz testing toolkit has been opened.
  7. The initial (baseline) compiler Liftoff for WebAssembly now includes the ability to use SIMD vector instructions to accelerate computations. According to tests, this optimization has allowed some tests to run 2.8 times faster. Another optimization significantly sped up calls to JavaScript functions imported from WebAssembly.
  8. Tools for web developers have been expanded: The Media panel now includes information about the players used to play videos on the page, including event data, logs, property values, and frame decoding parameters (for instance, you can determine the causes of frame drops and issues during JavaScript interaction).
  9. The Elements panel's context menu has added the ability to create screenshots of selected elements (for example, you can create a screenshot of a table of contents or a table).
  10. In the web console, the warning panel for issues has been replaced with a standard message, and problems with third-party cookies are hidden by default under the Issues tab and can be enabled with a specific checkbox.
  11. The Rendering tab has added the 'Disable local fonts' button, allowing you to simulate the absence of local fonts, and the Sensors tab now includes the ability to simulate user inactivity (for applications using the Idle Detection API).
  12. The Application panel provides detailed information about each iframe, open window, and pop-ups, including Cross-Origin isolation data using COEP and COOP.

  The implementation of the QUIC protocol is being replaced with the version developed in the IETF specification, instead of the Google variant of QUIC.
  In addition to new features and bug fixes, the latest version addresses 35 vulnerabilities. Many of the vulnerabilities were discovered through automated testing using tools such as AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. One vulnerability (CVE-2020-15967, accessing a freed memory area in the code for interacting with Google Payments) is marked as critical, meaning it allows bypassing all levels of browser protection and executing code in the system outside of the sandbox environment. As part of the bug bounty program for this release, Google has awarded 27 bounties totaling $71,500 (one bounty of $15,000, three bounties of $7,500, five bounties of $5,000, two of $3,000, one of $200, and two bounties of $500). The amount of 13 bounties is yet to be determined.

  Taken from Opennet.ru

  Source: linux.org.ru