Google Inc. release of the web browser . At the same time, the stable release of the open-source project , which serves as the foundation for Chrome. The Chrome browser features the use of Google logos, a crash notification system, the ability to load Flash plugins on demand, modules for playing protected video content (DRM), an automatic update installation system, and the transmission of RLZ parameters during searches. . Due to developers transitioning to remote work during the SARS-CoV-2 pandemic, the release of Chrome 82 was . The next release, Chrome 84, is scheduled for July 14.
:
- massive activation (DoH, DNS over HTTPS) on user systems where DNS providers supporting DoH are specified in system settings (DoH from the same DNS provider will be enabled). For example, if a user has DNS 8.8.8.8 specified in system settings, then the Google DoH service (âhttps://dns.google.com/dns-queryâ) will be activated in Chrome; if DNS is 1.1.1.1, then the Cloudflare DoH service (âhttps://cloudflare-dns.com/dns-queryâ), and so on. To avoid issues with corporate intranet network resolution, DoH is not applied when determining browser usage in centrally managed systems. DoH is also disabled when parental control systems are present.
Management of DoH activation and changing the DoH provider is done through the built-in configurator. - It is proposed interface design web forms, which have been optimized for use on touch screens and systems for people with disabilities. The design was optimized by Microsoft as part of the Edge browser development and transferred to the main Chromium codebase. Previously, some form elements were designed to match operating system elements, while others complied with the most popular styles. As a result, different elements varied in compatibility with touch screens, systems for people with disabilities, and keyboard navigation. The goal of the redesign was to unify the styling of form elements and eliminate style discrepancies.
- The design of the 'Privacy and Security' settings section has been changed, new tools for managing security. Settings are now easier to find and their essence easier to understand. Four basic sections have been proposed, gathering tools related to clearing history, managing cookies and site data, security modes, and bans or permissions tied to specific sites. Users can quickly enable the blocking of third-party cookies for incognito mode or for all sites, as well as block all cookies for specific sites. The new design is included only on systems of a portion of users; others can activate the settings via "chrome://flags/#privacy-settings-redesign."
Site-specific settings are divided into groups â access to location, camera, microphone, notifications, and background data submission. There is also a section with additional settings for blocking JavaScript, images, and redirection on certain sites. The latest action taken by the user related to permission changes is highlighted separately.
- In incognito mode, blocking all cookies set by third-party sites, including advertising networks and web analytics systems, is enabled by default. An expanded interface has also been offered for monitoring cookie settings on sites. Flags "chrome://flags/#improved-cookie-controls" and "chrome://flags/#improved-cookie-controls-for-third-party-cookie-blocking" are provided for management. After activating the mode, a new icon appears in the address bar, which, when clicked, shows the number of blocked cookies and provides the option to disable the blocking. Users can see which cookies are allowed and blocked for the current site in the "Cookies" section of the context menu, accessed by clicking on the padlock symbol in the address bar, or in the settings.
- The settings feature a new button called "Safety check," which provides a summary of potential security issues, such as the use of compromised passwords, the status of malicious site checks (Safe Browsing), the presence of uninstalled updates, and the detection of malicious extensions.
- The password manager has added the ability checks all saved usernames and passwords against a database of compromised accounts, issuing a warning if issues are detected (the check is based on matching hash prefixes on the user side; the actual passwords and their complete hashes are not transmitted). The check is performed against a database covering over 4 billion compromised accounts that have appeared in user data leaks. A warning is also issued when attempting to use trivial passwords like 'abc123'.
- an enhanced protection mode against dangerous websites (Enhanced Safe Browsing), where additional checks are activated to safeguard against phishing, malicious activities, and other threats on the web. It also provides extra protection for Google accounts and Google services (Gmail, Drive, etc.). While in regular Safe Browsing mode the checks are performed locally based on a database periodically downloaded to the client system, Enhanced Safe Browsing sends real-time information about pages and downloads to the Google Safe Browsing service for verification on Google's side, enabling quick responses to threats immediately after detection, without waiting for the local blacklist to update.
to speed up operation, a pre-check against whitelists is supported, which includes hashes of thousands of trusted popular sites. If the opened website is not in the whitelist, the browser checks the URL against Googleâs server, transmitting the first 32 bits of the SHA-256 hash of the link, from which any potential personal data is stripped. According to Google, the new approach can increase the effectiveness of warning outputs for new phishing sites by 30%.
- Instead of automatically pinning extension icons next to the address bar, a new menu has been implemented, marked with a puzzle icon, listing all available extensions and their permissions. After installing an extension, users must now explicitly enable pinning the extension icon to the toolbar, while reviewing the permissions granted to the extension. To prevent the extension from getting lost, a prompt will appear immediately after installation with information about the new extension. This new menu is enabled by default for a certain percentage of users; others can enable it via the setting âchrome://flags/#extensions-toolbar-menuâ.
- A setting has been added: âchrome://flags/#omnibox-context-menu-show-full-urlsâ, which, when enabled, adds an item to the address bar's context menu that says âAlways show full URLâ, preventing URL truncation. It is noteworthy that in Chrome 76, the address bar defaulted to displaying links without âhttps://â, âhttp://â, and âwww.â. A setting was provided to disable this behavior, but it was removed in Chrome 79, causing users to lose the ability to display the full URL in the address bar.
- The tab grouping feature has been enabled for all users (âchrome://flags/#tab-groupsâ), allowing multiple similar tabs to be combined into visually separated groups. Each group can be assigned its own color and name. Additionally, an experimental feature for collapsing and expanding groups has been suggested, which is not yet available on all systems. For example, several unread articles can be temporarily collapsed, leaving only a label to avoid taking up space while navigating, and can be restored when returning to reading. The setting to enable this mode is âchrome://flags/#tab-groups-collapseâ.
- Default warnings are now enabled for attempts to (without encryption) download executable files from links on HTTPS pages (in Chrome 84, downloads of executable files will be blocked, and warnings will begin to be issued for archives). It is noted that downloading unencrypted files can be used for malicious activity through content substitution in MITM attacks. Additionally, files initiated from isolated iframe elements is now prohibited.
- When activating Adobe Flash, a warning about the discontinuation of support for this technology in December 2020 has been added.
- The technology , allows blocking DOM manipulations that lead to cross-site scripting (DOM XSS), for example, during improper handling of user-provided data in eval() blocks or inserts such as '.innerHTML', which can result in the execution of JavaScript code in the context of a specific page. Trusted types require preprocessing of data before passing it to risky functions. For example, enabling Trusted types will result in an error when executing 'anElement.innerHTML = location.href' and will require the use of special TrustedHTML or TrustedScript objects for assignment. Enabling Trusted Types is done through CSP (Content-Security-Policy).
- the new HTTP headers Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy, which allow enabling a special cross-origin isolation mode for the safe use of privileged operations on a page, such as SharedArrayBuffer, Performance.measureMemory(), and profiling APIs, which can be exploited for side-channel attacks like Spectre. The cross-origin isolation mode also prevents changing the document.domain property.
- A new implementation of the network resource access inspection system has been proposed â OOR-CORS (Out-Of-Renderer Cross-Origin Resource Sharing). The old implementation could only inspect core components of the Blink engine, including XHR and Fetch API, but did not cover HTTP requests made from certain internal modules. The new implementation addresses this issue.
- Several new APIs have been added in Origin Trials (experimental features that require separate activation). Origin Trials allow the specified API to be used from applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token, which is valid for a limited time for a specific site.
- API , allowing the creation of web applications that interact with files in the local file system. For instance, the new API may be requested in browser-based integrated development environments, text editors, and image and video editors. In order to gain the ability to read and write files directly, use dialogs for opening and saving files, and navigate through directory contents, the application requests special confirmation from the user;
- Element.getAnimations() to assess memory consumption when processing a web application or web page. It can be used to analyze and optimize memory usage in web applications, as well as to identify regressive increases in memory consumption.
- Element.getAnimations() for scheduling task executions (JavaScript callback calls) with various priority levels (blocking user operations, creating visible changes, and background work). The TaskController object can be used to change priorities and cancel tasks.
- API , allowing applications to create their own data handlers applied when encoding and decoding WebRTC MediaStreamTrack. For example, the API can be used to implement end-to-end encryption of streams transmitted through a transit server.
- Added API for detecting and decoding barcodes in a specific image. The API only works on Android devices with Google Play Services installed.
- A meta tag has been added , allowing the site to provide full support for dark theme styling without using CSS transformations.
- Added the ability to use JavaScript modules in .
- In IndexedDB, in a new argument has been added
"durability", allowing control over data flushing to the storage. Passing the value "relaxed" instead of the default "strict" mode can sacrifice reliability for performance (previously, Chrome always flushed data to disk after each transaction was written). - In selector(), a @supports function has been added that allows determining the availability of CSS selectors (for example, you can first check the availability of a selector before binding CSS styles to it).
@supports selector(::before) {
div { background: green };
} - In Intl.DateTimeFormat, the fractionalSecondDigits property to customize the display format of fractions of a second.
- In the V8 engine, new tools for web developers. For example, an emulation mode for perceiving pages by people with visual impairments and various forms of color blindness has been introduced. An emulation mode for locale switching has also been added, affecting the Intl.* API, *.prototype.toLocaleString, navigator.language, Accept-Language, etc.
- In the network activity inspection interface, a COEP (Cross-Origin Embedder Policy) debugger has been added to assess the reasons for blocking the loading of certain resources over the network. The cookie-path keyword has been introduced to filter requests where cookies are bound to a specific
path. .
The developer tools can now be pinned to the left side of the screen.
The interface for tracking long-running JavaScript code has been redesigned.
- Some planned changes have been postponed due to the COVID-19 pandemic. For example, FTP handling code for an indefinite period. support for TLS 1.0/1.1 protocols until Chrome 84 is released. Initial
support for Client Hints (the alternative to User-Agent) has also been postponed until Chrome 84. Work on has been moved to next year.
56 vulnerabilities. AddressSanitizer , , , and . No critical issues have been found that allow bypassing all browser protection levels and executing code on the system outside of the sandbox environment. As part of the vulnerability reward program for the current release, Google has paid out 28 rewards totaling $76,000 (one reward of $20,000, one reward of $10,000, two rewards of $7,500, two rewards of $5,000, two rewards of $3,000, two rewards of $2,000, two rewards of $1,000, and eight rewards of $500). The amounts for 7 of the rewards are yet to be determined.
Source: opennet.ru
