Google Inc. release of the web browser . At the same time, the stable release of the open-source project , which serves as the foundation for Chrome. The Chrome browser features the use of Google logos, a crash notification system, the ability to load Flash plugins on demand, modules for playing protected video content (DRM), an automatic update installation system, and the transmission of RLZ parameters during searches. The next release of Chrome 79 is scheduled for December 10.
:
- Experimental support for "DNS over HTTPS" (DoH) will be selectively enabled for certain user categories in system settings where DNS providers that support DoH are specified. For example, if a user has DNS 8.8.8.8 in their system settings, the Google DoH service ("https://dns.google.com/dns-query") will be activated in Chrome. If the DNS is 1.1.1.1, then the Cloudflare DoH service ("https://cloudflare-dns.com/dns-query") will be used, and so on.
To manage the activation of DoH, a setting is provided at "chrome://flags/#dns-over-https". Three modes of operation are supported: "secure", "automatic", and "off". In "secure" mode, hosts are resolved solely based on previously cached secure values (obtained through a secure connection) and DoH requests, with no fallback to regular DNS. In "automatic" mode, if DoH and the secure cache are not available, data can be obtained from an insecure cache, and traditional DNS queries may be made. In "off" mode, the common cache is checked first, and if no data is found, a query is sent through the system DNS.
- The synchronization tools now feature preliminary support for shared clipboard, which is not yet activated for all users. In instances of Chrome linked by the same account, it is now possible to access the clipboard contents of another device, including sharing clipboard content between mobile and desktop systems. The clipboard content is encrypted using end-to-end encryption, preventing access to the text on Google servers.
- For certain user categories, an experimental feature has been included that allows customization of the theme and the screen displayed when opening a new tab. In the 'Customize' menu, visible in the lower right corner of the new tab screen, besides choosing a background image, support for changing the layout method of shortcuts has been added, along with the option to change the theme. Shortcuts can be automatically suggested based on frequently visited sites, chosen by the user, or completely disabled. The theme can be selected from a set of predefined themes or created based on a selection of desired colors from the palette. New features can be enabled using the flags 'chrome://flags/#ntp-customization-menu-v2' and
'chrome://flags/#chrome-colors'; - For enterprises, the default address bar now includes the ability to search for files in Google Drive storage. The search is conducted not only by titles but also by the content of documents, taking into account their opening history in the past;
- The package includes the Password Checkup component, which will gradually become active for certain user categories (a flag 'chrome://flags/#password-leak-detection' is available for forced activation). Password Checkup previously in the form of , designed for analyzing the reliability of passwords used by the user. When attempting to log in to any website, Password Checkup checks the username and password against a database of compromised accounts and displays a warning if any issues are detected (the check is based on a hash prefix on the user's side). The check is conducted against a database encompassing over 4 billion compromised accounts that have appeared in user database leaks. A warning is also displayed when attempting to use trivial passwords, such as 'abc123';
- The ability to initiate a call from an Android device linked to the same Google account has been added. In the desktop browser, the user can highlight a phone number in the text, right-click, and redirect the call operation to the Android device, after which a notification will pop up on the phone allowing the call to be initiated;
- The format of the tooltip displayed when hovering over the tab header has been changed. The tooltip now appears as a popup block showing the full title text and the page URL. This block can be conveniently used to quickly find the desired page when opening a large number of tabs (instead of sifting through tabs, you can hover over the tab bar to locate the sought page). In the future, this block is expected to display a page thumbnail as well;
- An experimental feature has been added (chrome://flags/#enable-force-dark) that forces the use of a dark theme when viewing websites. The dark representation of the site is achieved by inverting colors;
- specification support , allowing the registration of custom CSS properties that always have a defined type, enable a default value to be set, and allow for the binding of animation effects. The registerProperty() method or the CSS rule "@property" can be used to register a property, for example:
CSS.registerProperty({
name: "—my-font-size",
syntax: "‹length›",
initialValue: "0px",
inherits: false
}); - In Origin Trials mode (experimental features that require separate ) several new APIs are proposed. The Origin Trial allows the specified API to work with applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token that is valid for a limited time for a specific site.
- API , allowing the creation of web applications that interact with files in the local file system. For instance, the new API may be requested in browser-based integrated development environments, text editors, and image and video editors. In order to gain the ability to read and write files directly, use dialogs for opening and saving files, and navigate through directory contents, the application requests special confirmation from the user;
- The mechanism , allowing verified copies of web pages to be placed on other sites, appearing to users as the original pages (without changing the URL), with the ability to load sub-resources (CSS, JS, images, etc.) from the original site. The source of the resource is specified via the HTTP Link header, which also indicates a verification hash for the validation of each resource. With this new capability, content providers can create a single signed HTML file that encompasses all associated sub-resources;
- API , allowing a web application to access SMS messages, for example, for automating the verification of an operation involving a one-time code sent via SMS. Access is granted only to SMS messages that contain a special tag, linking the message to a specific web application;
- API , allowing the creation of web applications that interact with files in the local file system. For instance, the new API may be requested in browser-based integrated development environments, text editors, and image and video editors. In order to gain the ability to read and write files directly, use dialogs for opening and saving files, and navigate through directory contents, the application requests special confirmation from the user;
- The loading performance of ArrayBuffer objects via WebSocket has significantly increased. On the Linux platform, the loading speed has increased by 7.5 times, in Windows by 4.1 times, and in macOS by 7.8 times;
- The ability to specify opacity values in percentages in CSS properties such as opacity, stop-opacity, fill-opacity, stroke-opacity, and shape-image-threshold has been added. For example, instead of "opacity: 0.5", you can now specify "opacity: 50%";
- In the API arbitrary timestamps can now be passed to performance.measure() and performance.mark() calls for measurements between them, as well as the specification of arbitrary metadata;
- In the Media Session API support for defining position change handlers in the stream (seekto) has been added, in addition to previously available pause and play handlers;
- In the JavaScript engine V8 the background parsing mode of scripts on the fly as they are loaded over the network has been implemented. This optimization has reduced script compilation time by 5–20%. The new release also increased the performance of object destructuring (transforming "const {x, y} = object;" into "const x = object.x; const y = object.y;"). The speed of RegExp expression processing with mismatching matches has also been improved.
The speed of calling JavaScript functions from WebAssembly and vice versa has significantly increased (by 9-20%). During bytecode compilation, the efficiency of building source position lookup tables has been improved, reducing memory consumption.
1-2.5%.
- tools for web developers. The audit panel can now be used in combination with other features, such as request blocking and resource overrides. Support for debugging payment handlers via the Payment API has been added. In the performance analysis panel, LCP (Largest Contentful Paint) markers have been introduced, reflecting the rendering time of the largest elements;
- the XSS Auditor cross-site scripting blocking mechanism has been deemed ineffective (attackers have long been using methods to bypass XSS Auditor protection) and adds new vectors for information leakage;
- The Android version has implemented the ability to use a dark theme for menus, settings, and navigation mode across open sites.
56 vulnerabilities. AddressSanitizer , , , and No critical issues have been found that allow bypassing all browser security levels and executing code in the system beyond the sandbox environment. As part of the vulnerability discovery reward program for the current release, Google has paid out 21 prizes totaling $59,500 (one prize of $20,000, one prize of $15,000, one prize of $5,000, two prizes of $3,000, three prizes of $2,000, five prizes of $1,000, and five prizes of $500). The amount of four rewards has not yet been determined.
Source: opennet.ru
