Google has released version 152 of the Chrome web browser. At the same time, a stable release of the open-source project Chromium, which serves as the foundation for Chrome, is also available. Chrome differs from Chromium in that it includes Google's logos, a crash reporting system, modules for playing protected video content (DRM), an automatic update system, persistent Sandbox isolation, the provision of keys for Google API, and the transmission of RLZ parameters during searches. For those who need more time to update, an Extended Stable branch is separately supported, lasting 8 weeks. The next release, Chrome 153, is planned for September 8 as part of the new two-week development cycle.
Key Changes in Chrome 152 (1, 2, 3, 4):
- A custom URI scheme 'googlechrome://' has been implemented, but is not yet enabled by default. This allows external sites opened in other browsers to invoke Chrome to display a page when the link is accessed.
- On August 31, all extensions using the second version of the Chrome manifest, which defines the capabilities and resources available for extensions built with the WebExtensions API, will be removed from the Chrome Web Store. Already installed extensions will remain on users' systems but will not receive updates and cannot be reinstalled if removed from the browser.
- The Client Update Protocol (CUP), used for accessing the update delivery servers for browser components and extensions, has been transitioned to use post-quantum encryption algorithms.
- Windows builds now support using Windows ACL to block reading and modifying Chrome process memory. Since this blocking may cause compatibility issues with some antivirus packages, data leak prevention systems, or accessibility tools, this protection mechanism is not enabled by default (to activate it, set the chrome://flags/#enable-process-isolation-ui flag to Enabled and choose a process isolation mode on the chrome://settings/system page).
- For Isolated Web Applications (IWA), the ability to create sub-applications has been provided, allowing multiple programs with their own names, icons, and integration tools within a single IWA installation (for example, file type associations). These sub-applications are displayed as separate programs but are delivered in one common package. In the ChromeOS version, a frameless opening mode has additionally been implemented for IWA applications, where the content of the application expands to fill the entire browser window, replacing the borders and title among other things.
- In the Android version, when enhanced protection mode (Safe Browsing > Enhanced protection) is enabled, warnings about opening potentially harmful sites are output. The warning blocks the opening of the site until the user confirms the action.
- A new unified screen for managing autofill and passwords has been added in the Android version, consolidating data used for autofilling forms, such as addresses and passwords, in one place.
- An API for CPU Performance has been added to obtain information about the performance level and characteristics of the processor. In the settings (Settings > Performance > Speed > Override CPU performance tier), there is an option to manually set the performance level reported to websites. The following levels are available: 0 — performance unknown, 1 — low performance, 2 — medium, 3 — high, 4 — ultra.
- Support for pseudo-elements "::backdrop" (to handle interactions with modal background actions, such as closing a dialog when clicking on the background area), "::scroll-marker" (to handle interaction events with scrolling indicators), and "::view-transition" (to intercept animations transitioning from one state to another) has been added to the CSSPseudoElement interface, allowing manipulation of CSS pseudo-elements from JavaScript.
- The HTTP header Connection-Allowlists has been implemented, which allows you to pass a list of URL patterns that the page is allowed to send network requests to. When the header is set, the JavaScript code executed in the page context or Web Workers will not be able to access URLs that do not fall under the specified list.
- CSS has introduced the alpha() function, allowing for the modification of the alpha channel (transparency level) for a specified color.
- The CSS property window-drag has been added, enabling the definition of an area in desktop web applications (PWA) that can be treated as the window header, allowing the window to be moved with the mouse.
- For editable HTML elements such as and
In addition to new features and bug fixes, the new version resolved 327 vulnerabilities. Ten issues have been assigned a critical severity level, indicating that the vulnerabilities allow bypassing all layers of browser protection and executing code in the system outside the sandbox environment. Eight critical issues stem from use-after-free memory access, one from insufficient validation of untrusted input, and one from the use of uninitialized variables.
Additionally, notable is the implementation of experimental support for Chrome delivery on Linux in Flatpak format packages, with system interaction facilitated through the use of XDG portals.
Source: opennet.ru
