Google has released version 106 of the Chrome web browser. At the same time, a stable release of the open-source project Chromium, which underlies Chrome, is available. Chrome differs from Chromium in its use of Google logos, the inclusion of a crash reporting system, modules for playing protected video content (DRM), an automatic update installation system, always-enabled sandbox isolation, the provision of keys for Google API, and the transmission of RLZ parameters during searches. For those needing more time to update, an Extended Stable branch is separately supported for 8 weeks. The next release of Chrome 107 is scheduled for October 25.
Key changes in Chrome 106:
- For users of the desktop builds, the Prerender2 mechanism for pre-rendering recommendations content in the Omnibox address bar is enabled by default. Pre-rendering complements the previously available ability to load the most likely recommendations without waiting for user clicks. In addition to loading, the content of related recommendation pages can now be pre-rendered in the background (including executing scripts and forming the DOM tree), enabling instant display of suggestions after a click.
- The ability to search history, bookmarks, and tabs directly from the Omnibox address bar has been introduced. Control tags for localization of searches are proposed as @history, @bookmarks, and @tabs. For example, to search through bookmarks, one needs to enter "@bookmarks search phrase." A special option in the search settings is provided to disable address bar search.
- Support for Server Push technology, defined in the HTTP/2 and HTTP/3 standards and allowing server Send resources to the client without waiting for their explicit request. The reason for discontinuing support is cited as the excessive complexity of implementing the technology when simpler and equally effective alternatives, such as the tag, HTTP response 103, and the WebTransport protocol, are available. According to Google statistics, in 2021 about 1.25% of websites operating on HTTP/2 used Server Push, and in 2022 this figure dropped to 0.7%. The Server Push technology is also present in the HTTP/3 specification, but in practice, many server and client software products, including the Chrome browser, did not initially implement it.
- The ability to use non-ASCII characters in domains specified in the Cookie header has been disabled (for IDN domains, they should be specified domains in punycode format). This change aligns the browser with the requirements of RFC 6265bis and the behavior implemented in Firefox.
- Clearer labels have been proposed for identifying screens in multi-monitor configurations. Such labels can be displayed in authorization dialogs for opening windows on external screens. For example, instead of the external screen number ('External Display 1'), the model name of the monitor ('HP Z27n') will now be shown.
- Improvements in the Android version:
- The visit history page has been updated to support the 'Journey' mechanism, which summarizes past activity by grouping information on previously performed search queries and viewed pages. When entering keywords in the address bar, if they were previously used in queries, the option to continue searching from where it left off is suggested.
- On devices with Android 11, the option to lock a page opened in incognito mode after switching to another app has been provided. To continue viewing after the lock, authentication is required. By default, the lock is disabled and must be activated in the privacy settings.
- When trying to download files from incognito mode, an additional confirmation request for saving the file is displayed along with a warning that the downloaded file can be seen by other users of the device, as it will be saved in the downloads manager.
- The provision of the chrome.runtime API for all sites has been discontinued. This API is now only available with browser extensions that are connected to it. Previously, chrome.runtime was accessible for all sites as it was used by the built-in CryptoToken extension implementing the U2F API, support for which has been discontinued.
- Several new APIs have been added in Origin Trials (experimental features that require separate activation). Origin Trials allow the specified API to be used from applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token, which is valid for a limited time for a specific site.
- The concept of anonymous iframes allows loading a document in a separate context that is not linked to other iframes and the main document.
- The Pop-Up API organizes the display of interface elements over other elements, for example, for the operation of interactive menus, tooltips, content selection tools, and educational systems. To display an element at the very top layer, a new attribute 'popup' is used. Unlike dialogs created using the
- Support for interpolation has been implemented for the properties 'grid-template-columns' and 'grid-template-rows' used in CSS Grid to create smooth transitions between different grid states.
- The CSS property 'forced-color-adjust' has been enhanced with the value 'preserve-parent-color', which allows the 'color' property to inherit its value from the parent element.
- The property '-webkit-hyphenate-character' has been removed from the '-webkit-' prefix and is now available as 'hyphenate-character'. This property can be used to set a string that will be used instead of the character for breaking a word onto a new line ('-').
- The third edition of the Intl.NumberFormat API has been implemented, introducing new functions formatRange(), formatRangeToParts(), and selectRange(), set grouping, new rounding options and precision settings, and the ability to interpret strings as decimal numbers.
- The ReadableStream API has added support for efficient direct transfer of binary data from a serial port, bypassing internal queues and buffers. Direct piping is enabled by setting the BYOB mode — 'port.readable.getReader({ mode: ‘byob’ })'.
- Audio and video interface APIs (AudioDecoder, AudioEncoder, VideoDecoder, and VideoEncoder) now support the 'dequeue' event and associated callback calls, which are activated when the codec begins processing queued encoding or decoding tasks.
- The WebXR Device API has implemented raw access to camera image textures, synchronized with the current position in the virtual environment.
- Improvements have been made to the web developer tools. The Sources panel now allows for grouping files by source. Stack tracing for asynchronous operations has been enhanced. There is now an option to automatically ignore known third-party scripts during debugging. The option to hide ignored files in the menu and panels has been introduced. The call stack handling in the debugger has also seen improvements.
A new Interactions track has been added to the Performance panel for visualizing interactions with the page and identifying potential responsiveness issues.
In addition to new features and bug fixes, this version also addresses 20 vulnerabilities. Many of the vulnerabilities were discovered through automated testing with tools like AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues that would allow bypassing all levels of browser protection and executing code outside the sandbox environment have been identified. As part of the bug bounty program for this release, Google has awarded 16 prizes totaling $38,500 (including one prize each of $9,000, $7,500, $7,000, $5,000, $4,000, $3,000, $2,000, and $1,000). The amount of eight rewards is yet to be determined.
Source: opennet.ru
