Google has released version 152 of its Chrome web browser. A stable release of the open-source Chromium project, the foundation of Chrome, is also available. Chrome differs from Chromium in its use of Google logos, its crash notification system, modules for playing copy-protected video content (DRM), automatic update installation, always-on sandbox isolation, provisioning of Google API keys, and the use of RLZ parameters during search. For those who need more time to update, a separate Extended Stable branch is maintained for eight weeks. The next release, Chrome 153, is scheduled for September 8th as part of a new two-week development cycle.
Key changes in Chrome 152 (1, 2, 3, 4):
- A custom URI scheme, "googlechrome://", has been implemented but is not yet enabled by default, allowing external sites opened in other browsers to invoke Chrome to display the page when following a link.
- All add-ons using the second version of the Chrome Manifest, which defines the capabilities and resources available to add-ons written using the WebExtensions API, are scheduled to be removed from the Chrome Web Store on August 31st. Existing add-ons will remain on users' systems, but will not be able to receive updates and cannot be reinstalled if removed from the browser.
- The CUP (Client Update Protocol), used when accessing servers delivering updates to browser components and extensions, has been switched to using post-quantum encryption algorithms.
- In assemblies for Windows added the ability to use Windows ACL for blocking reading and modifying Chrome process memory. Because blocking may cause compatibility issues with some antivirus packages, data leak prevention systems, or accessibility tools, this protection mechanism is not enabled by default (to enable it, set the chrome://flags/#enable-process-isolation-ui flag to Enabled and select the process isolation mode on the chrome://settings/system page).
- Isolated Web Apps (IWAs) now support the creation of sub-applications, which allow multiple programs with their own names, icons, and system integration tools (e.g., associations for handling specific file types) to be delivered within a single IWA installation. These sub-applications appear as separate programs but are delivered within a single package. The ChromeOS version also features a borderless opening mode for IWAs, which expands the application's contents to fill the entire browser window, replacing, among other things, the borders and title bar.
- In version for Android When Enhanced Protection mode is enabled (Safe Browsing > Enhanced Protection), warnings are displayed about opening potentially malicious websites. The warning blocks the website from opening until the user confirms the action.
- In version for Android A new unified screen for managing autofill and passwords has been added, bringing together data used for autofilling forms, such as addresses and passwords, in one place.
- The CPU Performance API has been added for retrieving information about the processor's performance level and characteristics. In Settings > Performance > Speed > Override CPU performance tier, you can now manually set the performance level reported to websites. The following levels are available: 0 — performance unknown, 1 — low performance, 2 — medium, 3 — high, 4 — ultra.
- The CSSPseudoElement API, which allows working with CSS pseudo-elements from JavaScript, now supports the pseudo-elements "::backdrop" (for handling actions with the background of modal windows, for example, you can organize the closing of a dialog when clicking on the background area), "::scroll-marker" (for handling events of interaction with scroll indicators), and "::view-transition" (for intercepting the animation of a transition from one state to another).
- The Connection-Allowlists HTTP header has been implemented, allowing you to pass a list of URL patterns to which a page is allowed to send network requests. When this header is set, JavaScript code or web workers running in the page context will not be able to access URLs that do not match the specified list.
- The alpha() function has been added to CSS, allowing you to change the alpha channel (transparency) for a specified color.
- Added the window-drag CSS property to define an area of a desktop web application (PWA) window that is treated as a window title, allowing the window to be dragged with the mouse.
- For editable HTML elements such as And , the "autocorrect" attribute has been added, allowing you to control the application of autocorrection to data entered by the user.
In addition to new features and bug fixes, the new version addresses 327 vulnerabilities. Ten issues were rated critical, meaning they could bypass all browser protection layers and execute code outside the sandbox environment. Eight critical issues were caused by use-after-free access, one by insufficient validation of untrusted input, and one by the use of uninitialized variables.
Additionally, it is worth noting the implementation of experimental support for the delivery of Chrome for Linux in Flatpak format packages, interaction with the system when using which is carried out through the use of XDG portals.
Source: opennet.ru
