Google Inc. release of the web browser . At the same time, the stable release of the open-source project , which serves as the foundation for Chrome. The Chrome browser features the use of Google logos, a crash notification system, the ability to load Flash plugins on demand, modules for playing protected video content (DRM), an automatic update installation system, and the transmission of RLZ parameters during searches. The next release of Chrome 86 is scheduled for October 6.
:
- the ability to collapse tab groups. Tabs can be grouped using the context menu and can be associated with a specific color and label. Clicking on the group label now hides the associated tabs, leaving only the label visible. A second click on the label un-hides the tabs.
- Tab content previews have been implemented. When hovering over the tab button, a thumbnail of the page in the tab is now displayed. This feature is not yet enabled for all users and can be activated through the setting 'chrome://flags/#tab-hover-cards'.
- The ability to save edited PDF forms has been added, along with settings 'chrome://flags#pdf-viewer-update' and 'chrome://flags/#pdf-two-up-view' for experimenting with for viewing PDF documents.
- The ability to share links via QR codes has been introduced. A special icon for generating a QR code for the current page appears in the address bar when clicked. This feature is not yet available for all users and can be enabled through the setting 'chrome://flags/#sharing-qr-code-generator'.
- An option has appeared on the page about:flags called 'Omnibox UI Hide Steady-State URL Path, Query, and Ref' ('chrome://flags#omnibox-ui-hide-steady-state-url-path-query-and-ref-on-interaction') the hiding of path and query parameters in the address bar, leaving only the domain visible. Hiding occurs when interaction with the page begins (during loading and until the user starts scrolling, the full URL is shown). After the hiding, to view the full URL, you can click on the address bar. There is also an option 'chrome://flags#omnibox-ui-reveal-steady-state-url-path-query-and-ref-on-hover' for showing the full URL when hovering over. An option in the context menu 'Always show full URL' counteracts the hiding of 'https://', 'www.', paths, and parameters. By default, this hiding is currently only activated for a small percentage of users. The motivation for this change is to protect users from phishing that manipulates parameters in URLs.
- In tablet mode for touch screen devices, horizontal navigation through open tabs is enabled, displaying large thumbnails of the pages related to the tabs alongside their titles. Tabs can be moved and regrouped using on-screen gestures. Thumbnail display can be toggled using a dedicated button located near the address bar and user avatar. Settings for disabling the mode can be found at 'chrome://flags/#webui-tab-strip' and 'chrome://flags/#scrollable-tabstrip'.
- In the Android version, when typing in the address bar, a prompt is provided in the suggested pages list for quick access to already open tabs.
- In the Android version, in the context menu of links that appears upon a long press on a link, tags for highlighting quick pages are included. The speed is determined based on metrics , which take into account aggregate load time, responsiveness, and content stability metrics.
- Blocking is ensured (without encryption) of executable files is implemented, and warnings are added for unsafe downloads of archives (zip, iso, etc.). The next release is expected to block archives and provide warnings for documents (docx, pdf, etc.). In the future, support for downloading files without encryption will gradually be phased out. Blocking is implemented since downloading files without encryption can be used for malicious activities by altering content during MITM attacks.
- Support for the AVIF (AV1 Image Format) image format is enabled by default, which utilizes intra-frame compression technologies from the AV1 video encoding format. The container for distributing compressed data in AVIF is completely analogous to HEIF. AVIF supports both images in HDR (High Dynamic Range) and wide-gamut color space, as well as those in standard dynamic range (SDR).
- When compiling builds for Windows and macOS, MSVC and Clang compilers are called by default. optimizations based on code profiling results (PGO — Profile-guided optimization) that allow for generating more optimal code based on analyzing program execution features. The inclusion of PGO enabled a loading speed improvement of approximately 10% (a speed test increase of 7.7% in macOS and 11.4% in Windows). The interface responsiveness increased by 3.9% in macOS and 7.3% in Windows.
- An experimental mode for throttling background tabs ('Tab Throttling') has been added, accessible through the setting 'chrome://flags##intensive-wake-up-throttling' (default activation is expected in Chrome 86). When enabled, the management handoff to background tabs (TaskQueues) decreases to 1 call per minute if the page has been in the background for more than 5 minutes.
- A mode for reducing CPU resource consumption has been activated for all user categories when the browser window is not in the user's view. Chrome checks if the browser window is obscured by other windows and excludes pixel rendering in overlapping areas.
- protection against loading mixed media content (when resources are loaded over http:// on an HTTPS page). On pages opened via HTTPS, automatic replacement of 'http://' links with 'https://' has been implemented in blocks related to loading images (earlier replacements were made for scripts, iframes, audio files, and videos). If an image is not available over https, its loading is blocked (it can be manually marked for blocking via a menu accessible through the lock symbol in the address bar).
- For TLS certificates issued from September 1, 2020, a new expiration limit will apply — the lifespan of these certificates cannot exceed 398 days (13 months). Similar limits have been applied in Firefox and Safari. For certificates obtained before September 1, trust will be maintained but limited to 825 days (2.2 years).
- Several new APIs have been added in Origin Trials (experimental features that require separate activation). Origin Trials allow the specified API to be used from applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token, which is valid for a limited time for a specific site.
- concept To ensure seamless navigation between websites and the embedding of one page within another for content preview before proceeding. A new tag has been proposed, allowing another page to be displayed as an embed, while focusing on which, the shown embedded page will switch to the state of the main document, within which navigation is permitted. Unlike an iframe, the embed is completely isolated from the base page and is processed as a separate document.
- API , allowing fetch requests to load content as a stream (previously, the request required the content to be fully ready, but now data can start being sent as a stream without waiting for the entire request body to be ready). For example, a web application can start sending web form data as soon as the user starts typing in the input field, and when typing is finished, the data will already be sent via fetch(). This includes transferring audio and video data generated on the client side through the new API.
- A new API has been proposed for creating new root branches in , for instance, to separate an imported third-party style of an element and its associated DOM subtree from the main document. The proposed declarative API enables detaching DOM branches using only HTML without the need to write JavaScript code.
- A property has been added , allowing the sender of RTC (real-time communication) streams to control the activation of an adaptive packet sending mechanism.
- The provision of persistent storage for already installed PWA (Progressive Web Apps) and TWA (Trusted Web Activities) has been simplified.
The application only needs to call the navigator.storage.persist() method and will be automatically provided.
- A new CSS rule has been implemented , allowing the registration of with inheritance, type checking, and default values. The action of @property is similar to the previously added method registerProperty().
- For systems with Windows OS, the ability to use the method has been provided to determine the installation of PWA applications. Previously, this method worked only on the Android platform.
- Support for , allowing quick access to frequently used actions within the application. To create shortcuts, simply add elements to the web application manifest in PWA (Progressive Web Apps) format. Previously, app shortcuts were only available on the Android platform.
- A new CSS property has been added to manage the visibility of content for rendering optimization. When set to ‘auto’, visibility is determined by the browser based on the proximity of the element to the edge of the visible area. The value ‘hidden’ allows full control of the element's display through scripts.
- A new CSS property has been added to set a specific value for existing counters. The new CSS property complements the previously available properties counter-reset and counter-increment, used for creating a new counter or incrementing an existing one.
- The CSS property ‘page’ has been added to reflect the page when printing, as well as the property ‘page-orientation’ to obtain information about the page orientation (‘upright’, ‘rotate-left’, and ‘rotate-right’). Support for addressing pages by name has been implemented, for example, ‘@page foobar {}’.
- API has been implemented to measure event delays before and after page load.
- The leavepictureinpicture event now passes a reference to the pictureInPictureWindow for accessing the Picture-in-Picture window.
- When filling out the Referrer header by default now the strict-origin-when-cross-origin rule (to send the Referrer trimmed to other hosts from which resources are loaded) instead of no-referrer-when-downgrade (the Referrer is not filled when switching from HTTPS to HTTP but is sent when loading resources over HTTPS).
- In the WebAuthn API new methods getPublicKey(), getPublicKeyAlgorithm(), and getAuthenticatorData() have been introduced.
- In WebAssembly support for importing and exporting 64-bit integer function parameters using the JavaScript type BigInt has been added.
- In WebAssembly, an extension has been implemented. , functions to return multiple values.
- The Liftoff baseline compiler for WebAssembly is employed across all architectures and platforms, not just Intel systems. The key difference between Liftoff and the previously used TurboFan compiler is that Liftoff aims for maximum initial compilation speed at the cost of lower performance of the generated code. Liftoff is significantly simpler than TurboFan and generates ready-to-execute machine code very quickly, allowing almost immediate execution while minimizing compilation delay. To accelerate the draft code, an optimizing recompilation phase runs in parallel, utilizing the Turbofan compiler. Once the optimized machine instructions are ready, the initial draft is replaced with faster code. Overall, by reducing the delay before execution begins, the use of Liftoff has resulted in approximately a 20% performance increase in the WebAssembly test suite.
- In JavaScript New logical assignment operators: "??=", "&&=", and "||=". The operator "x ??= y" assigns only if "x" is null or undefined. The operator "x ||= y" assigns only if "x" is FALSE, and "x &&= y" assigns if "x" is TRUE.
- The method String.prototype.replaceAll() has been added, returning a new string (with the original remaining unchanged) where all matches based on the specified pattern are replaced. Patterns can be simple masks or regular expressions.
- The method Promise.any() has been implemented, which returns the first fulfilled Promise from a list.
- The AppCache manifest has been deprecated (a technology for enabling web applications to work offline). The reason given is the desire to eliminate one of the vectors for attacks related to cross-site scripting. The API is recommended as an alternative to AppCache. .
- The transmission of Cookies in SameSite=None mode is prohibited for unencrypted connections. The SameSite attribute is specified in the Set-Cookie header to control the transmission of cookies and is set to "SameSite=Lax" by default, which limits the sending of cookies for cross-site sub-requests, such as image requests or content loading via iframe from another site.
Websites can override the default SameSite mode by explicitly setting the SameSite attribute to None when installing a Cookie. The SameSite=None value for Cookies can now only be set in Secure mode, which applies to connections over HTTPS. - In web development tools support for editing styles created by CSS-in-JS frameworks using the CSSOM (CSS Object Model) API, as well as styles added from JavaScript. The auditing panel has been updated to the release , which adds new metrics for Largest Contentful Paint (LCP), Cumulative Layout Shift (CLS), and Total Blocking Time (TBT).
- The performance assessment panel shows information about . When a user navigates through the page, the scale displays the time relative to the start of navigation, instead of the start of recording.
56 vulnerabilities. AddressSanitizer , , , and . No critical issues were found that could bypass all levels of browser protection and execute code on the system outside the sandbox environment. As part of the bug bounty program for the current release, Google has awarded 14 prizes totaling $10,000 (one prize of $5,000, three prizes of $1,000, and four prizes of $500). The amount for 6 of the rewards has not yet been determined.
Source: opennet.ru
