Google Inc. release of the web browser . At the same time, the stable release of the open-source project , which serves as the foundation for Chrome. The Chrome browser features the use of Google logos, a crash notification system, the ability to load Flash plugins on demand, modules for playing protected video content (DRM), an automatic update installation system, and the transmission of RLZ parameters during searches. The next release of Chrome 87 is scheduled for November 17.
:
- Protection has been added against the unsafe submission of input forms on pages loaded via HTTPS but sending data via HTTP, creating a risk of interception and data tampering during MITM attacks. The protection consists of three changes:
- Auto-filling of any mixed input forms is disabled, similar to how the auto-filling of authentication forms on pages opened via HTTP has long been disabled. Previously, the indication for disabling was based on opening the page with the form over HTTPS or HTTP; now, encryption during data submission to the form handler is also considered. The password manager's operation for mixed authentication forms remains active, as the risk from using an unreliable password and reusing passwords across different sites exceeds the potential risk of traffic interception.
- When starting to input in mixed forms, a warning is displayed to inform the user about sending filled data over an unencrypted communication channel.
- When attempting to submit a mixed form, a separate page appears with a notification about the potential risk of sending data over an unencrypted communication channel. In previous versions, the lock indicator was used in the address bar to indicate mixed forms, but this marking was not obvious to users and did not effectively reflect the emerging risks.
- Blocking (without encryption) of executable files has been supplemented with blocking unsafe uploads of archives (zip, iso, etc.) and warnings during unsafe uploads.
of documents (docx, pdf, etc.). In the next release, blocking of documents and a warning for images, text, and multimedia files are expected. Blocking has been implemented as uploading files without encryption could be used for malicious actions by tampering with content during MITM attacks. - In the context menu, the option 'Always show full URL' is now shown by default, which previously required changing settings on the about:flags page. The full URL can also be viewed by double-clicking on the address bar. It should be noted that starting from by default, the address is now displayed without the protocol and subdomain www. In the setting to revert to the old behavior was removed, but after user dissatisfaction in a new experimental flag was added, which adds an option to the context menu to disable hiding and showing the full URL under any circumstances.
- For a small percentage of users, launched by by default only the domain appears in the address bar, without path elements and query parameters. For instance, instead of "https://example.com/secure-google-sign-in/" it will show "example.com". Rolling out this proposed mode to all users is expected in one of the upcoming releases. To disable this behavior, the option "Always show full URL" can be used, and to view the entire URL, one can click on the address bar. The rationale for this change is to protect users from phishing, which manipulates parameters in the URL—attackers exploit users' inattention to create the appearance of opening a different site and commit fraudulent actions (while such substitutions may be obvious to technically skilled users, unsuspecting novices can easily be deceived by such simple manipulations).
- Resumed the removal of FTP support. In Chrome 86, FTP is disabled by default for about 1% of users, and in Chrome 87 the scope of this disabling will increase to 50%, but support can be restored using the flag "—enable-ftp" or "—enable-features=FtpProtocol". In Chrome 88, FTP support will be fully disabled.
- In the Android version, similarly to the desktop version, the password manager implements a check of saved logins and passwords against a database of compromised accounts, providing a warning if problems are detected or if there is an attempt to use trivial passwords. The check is performed against a database covering more than 4 billion compromised accounts that have appeared in user data leaks. To maintain privacy, a hash prefix verification is done on the user's side, and the actual passwords and their full hashes are not transmitted externally.
- The Android version also The "Safety check" button and the enhanced protection mode against dangerous sites (Enhanced Safe Browsing). The "Safety check" button shows a summary of potential security issues such as the use of compromised passwords, the state of malicious site checks (Safe Browsing), any pending updates, and the detection of malicious extensions. The enhanced protection mode activates additional checks to guard against phishing, malicious activity, and other online threats, as well as providing extra protection for Google accounts and services (Gmail, Drive, etc.). While in normal Safe Browsing mode, checks are performed locally using a periodically updated database on the client's system, in Enhanced Safe Browsing, information about pages and downloads is sent for real-time checks on Google's side, allowing for immediate responses to threats as soon as they are identified, without waiting for the local blacklist to be updated.
- Support for the file indicator ".well-known/change-password", which allows website owners to specify the address of the web form for changing passwords. In the event of compromised user credentials, Chrome will now immediately offer the user a form to change their password, based on the information from this file.
- A new 'Safety Tip' warning has been implemented, displayed when opening websites with domains that are very similar to another site and heuristics indicate a high likelihood of spoofing (for example, opening goog0le.com instead of google.com).
- Support for back-forward cache, providing instant navigation when using the "Back" and "Forward" buttons or when navigating through previously viewed pages on the current site. The cache can be enabled using the setting chrome://flags/#back-forward-cache.
- Optimization of CPU resource consumption by windows
that are off-screen. Chrome checks if the browser window is covered by other windows and excludes rendering pixels in overlapping areas. This optimization was enabled for a small percentage of users in Chrome 84 and 85 and is now activated universally. Compared to previous releases, an incompatibility with virtualization systems that caused empty white pages to be displayed has also been resolved. - Resource trimming for background tabs has been strengthened. Such tabs can now consume no more than 1% of CPU resources and can be activated no more than once a minute. After five minutes in the background, tabs are frozen, except for those playing multimedia content or recording.
- Work has resumed on the HTTP User-Agent header. In the new version, support for the mechanism , developed as a replacement for User-Agent. The new mechanism implies selective delivery of data on specific browser and system parameters (version, platform, etc.) only after a request from the server, allowing users to selectively provide such information to website owners. When using User-Agent Client Hints, the identifier is not sent by default without an explicit request, making passive identification impossible (by default, only the browser name is indicated).
- The indication of the availability of an update and the need to restart the browser for its installation has been changed. Instead of a colored arrow in the account avatar field, the text 'Update' now appears.
- Work has been done to transition the browser to inclusive terminology. In policy names, the terms “whitelist” and “blacklist” have been replaced with “allowlist” and “blocklist” (existing policies will continue to work, but a warning about their deprecation will be displayed). In and references to “blacklist” have been replaced with “blocklist”.
User-visible references to “blacklist” and “whitelist” were replaced as early as 2019. - An experimental feature for editing saved passwords has been added, activated using the flag “chrome://flags/#edit-passwords-in-settings.”
- Moved to a stable and publicly available API , allowing the creation of web applications that interact with files in the local file system. For example, the new API may be in demand in integrated development environments launched in browsers, text, image, and video editors. To enable direct file reading and writing or to use dialogs for opening and saving files, as well as to navigate through directory contents, the application requests special confirmation from the user.
- A CSS selector ““ has been added, which uses the same heuristic that the browser uses when deciding to show the focus change indicator (when focus moves to a button via keyboard shortcuts, the indicator appears, but it does not when clicked with a mouse). The previously available CSS selector “:focus” always highlights the focus.
Additionally, the settings have been updated with a “Quick Focus Highlight” option, where activating it will display an additional focus indicator next to active elements, which remains visible even if the visual style elements for focus highlighting are disabled on the page via CSS. - Several new APIs have been added in Origin Trials (experimental features that require separate activation). Origin Trials allow the specified API to be used from applications loaded from localhost or 127.0.0.1, or after registration and obtaining a special token, which is valid for a limited time for a specific site.
- for low-level access to HID devices (Human Interface Device, keyboards, mice, gamepads, touch panels), allowing for the implementation of logic for working with HID devices in JavaScript to support rare HID devices without the need for specific drivers in the system.
First and foremost, the new API is aimed at supporting game controllers. - , expanding the capabilities of the Window Placement API with support for multi-monitor configurations. Unlike window.screen, the new API allows manipulation of window placement within the overall screen space of multi-monitor systems, without being limited to the current screen.
- Meta tag , which allows the website to inform the browser about the need to activate power-saving modes and optimize CPU load.
- API to report potential violations of isolation modes (COEP) and (COOP), without applying actual restrictions.
- In the API a new type of credentials has been proposed , providing additional confirmation for the payment process. The verifying party, for example, a bank, can generate a PublicKeyCredential, which can be requested by the vendor for additional safe payment confirmation.
- for low-level access to HID devices (Human Interface Device, keyboards, mice, gamepads, touch panels), allowing for the implementation of logic for working with HID devices in JavaScript to support rare HID devices without the need for specific drivers in the system.
- In the API support for height angles (the angle between the stylus and the screen) and azimuth (the angle between the X-axis and the stylus's projection on the screen) has been added for tilt detection, replacing TiltX and TiltY (the angles between the plane of the stylus and one of the axes, and the plane of the Y and Z axes). Functions for converting between height/azimuth and TiltX/TiltY have also been added.
- The encoding of spaces in URLs has been changed; when calculated in protocol handlers, the method navigator.registerProtocolHandler() now replaces spaces with "" instead of "+", which standardizes the behavior with other browsers like Firefox.
- A pseudo-element "", has been added in CSS, allowing customization of the color, size, shape, and type of numbers and bullets for lists in <ul> and <ol>.
- Support for the HTTP header , document access rules resembling a sandbox isolation mechanism for iframes, but more universal. For instance, through Document-Policy, one can restrict the use of low-quality images, disable slow JavaScript APIs, configure loading rules for iframes, images, and scripts, limit the overall document size and traffic, prohibit methods that lead to page reflow, and disable the function. .
- In the element support has been added for the 'inline-grid', 'grid', 'inline-flex', and 'flex' values specified through the CSS 'display' property.
- A method has been added to replace all child elements of a parent node with another DOM node. Previously, node replacement could be achieved using a combination of node.removeChild() and node.append() or node.innerHTML and node.append().
- a spectrum of URL schemes allowed for overriding using registerProtocolHandler(). The list includes decentralized protocols such as cabal, dat, did, dweb, ethereum, hyper, ipfs, ipns, and ssb, enabling link definitions independent of the site or gateway providing access to the resource.
- In the API support has been added for the text/html format for copying and pasting HTML via the clipboard (when writing to and reading from the clipboard, dangerous HTML constructs are cleaned). This change allows for formatted text with images and links to be pasted and copied in web editors.
- In WebRTC the ability to connect custom data handlers invoked at the encoding or decoding stages of a WebRTC MediaStreamTrack. For example, this feature can be used to add support for end-to-end encryption of data transmitted through intermediate servers.
- In the JavaScript engine V8, 75% implementation of Number.prototype.toString. The asynchronous classes have been enhanced with a .name property initialized to an empty value. The Atomics.wake method, which was renamed to Atomics.notify to comply with the ECMA-262 specification, has been removed. The fuzzing testing toolkit code has been opened. .
- In the previously utilized baseline compiler Liftoff for WebAssembly, the ability to use vector instructions has been included to accelerate computations. According to tests, optimization has allowed for some tests to run 2.8 times faster. Another optimization significantly sped up the invocation of JavaScript functions imported from WebAssembly.
- Web development tools: The Media panel now includes information about players used for video playback on the page, including event data, logs, property values, and frame decoding parameters (for example, it is now possible to determine the causes of frame drops and issues during interaction from JavaScript).
The context menu in the Elements panel has been updated to allow for creating screenshots of selected elements (for instance, you can take a screenshot of the table of contents or a table).
In the web console, the issue warning panel has been replaced with a standard message, and problems with third-party cookies are hidden by default under the Issues tab, to be enabled with a special checkbox.
The Rendering tab has added the 'Disable local fonts' button, allowing you to simulate the absence of local fonts, and the Sensors tab now includes the ability to simulate user inactivity (for applications using the Idle Detection API).
The Application panel provides detailed information about each iframe, open window, and pop-ups, including data on Cross-Origin isolation using COEP and COOP.
- replacement of the protocol implementation with the version being developed in the IETF specification, instead of the Google variant QUIC.
56 vulnerabilities. AddressSanitizer , , , and . One vulnerability (CVE-2020-15967, accessing freed memory in the code for interaction with Google Payments) is marked as critical, meaning it allows bypassing all browser security levels and executing code on the system outside the sandbox environment. As part of the vulnerability reward program for this release, Google has paid out 27 awards totaling $71,500 (one award of $15,000, three awards of $7,500, five awards of $5,000, two of $3,000, one of $200, and two awards of $500). The amounts for 13 awards are yet to be determined.
Source: opennet.ru
