Chrome 98 release.

Google has released version 98 of the Chrome web browser. Simultaneously, a stable release of the open-source Chromium project, which serves as the foundation of Chrome, is available. The Chrome browser features Google's logo, a notification system for crashes, modules for playing DRM-protected video content, an automatic update installation system, and the transmission of RLZ parameters during searches. The next release, Chrome 99, is scheduled for March 1.

Key changes in Chrome 98:

• The browser integrates its own store of root certificates from certificate authorities (Chrome Root Store), which will be used instead of external stores specific to each operating system. The store is implemented similarly to the independent root certificate store in Firefox, serving as the first link in verifying the certificate trust chain when opening sites via HTTPS. This new store is not yet used by default. To simplify the translation of configurations tied to system stores and ensure portability, there will be a transitional period during which the Chrome Root Store will include a complete collection of certificates approved on most supported platforms.
• The plan to enhance protection against attacks related to accessing resources on the local network or the user's computer (localhost) from scripts loaded when opening a site continues. Such requests are exploited by attackers to carry out CSRF attacks on routers, access points, printers, corporate web interfaces, and other devices and services that accept requests only from the local network.

  To protect against such attacks, when accessing any subresources on the internal network, the browser will start sending an explicit loading permission request for these subresources. The permission request is made by sending to server The main site request for CORS (Cross-Origin Resource Sharing) with the header "Access-Control-Request-Private-Network: true" must be made before accessing an internal network or localhost. Upon confirmation of the operation in response to this request, the server must return the header "Access-Control-Allow-Private-Network: true." In Chrome 98, the check is implemented in test mode, and if confirmation is absent, a warning is displayed in the web console, but the subresource request is not blocked. Blocking is not planned to be enabled until at least Chrome 101 is released.

• Account settings now include tools for managing the activation of Enhanced Safe Browsing, which activates additional checks to protect against phishing, malicious activity, and other web threats. When this mode is activated, users will now see a prompt in their Google account to enable it in Chrome.
• A model for detecting phishing attempts on the client side has been added, implemented using the TFLite (TensorFlow Lite) machine learning platform, and it does not require sending data for verification on Google's side (telemetry containing model version information and calculated weight coefficients for each category is sent, however). When a phishing attempt is detected, users will see a warning page before opening a suspicious site.
• In the Client Hints API, being developed as a replacement for the User-Agent header and allowing selective delivery of data about specific browser and system parameters (version, platform, etc.) only after a request. proxy server, the capability has been implemented to substitute fake names into the browser identifiers list, similar to the mechanism used in TLS known as GREASE (Generate Random Extensions And Sustain Extensibility). For example, in addition to '"Chrome"; v="98"' and '"Chromium"; v="98"', a random identifier of a non-existing browser such as '"(Not;Browser"; v="12"' can be added to the list. This substitution will help identify issues with processing identifiers of unknown browsers, which cause alternative browsers to pretend to be other popular browsers in order to bypass checks against the list of allowed browsers.
• Starting January 17, the Chrome Web Store catalog will no longer accept extensions using the second version of the Chrome manifest. New extensions will now only be accepted with the third version of the manifest. Developers of previously added extensions will still be able to publish updates using the second version of the manifest. Full support for the second version of the manifest is set to be discontinued in January 2023.
• Support for colored vector fonts in the COLRv1 format (a subset of OpenType fonts that includes not just vector glyphs but also a color information layer) has been added. This can be used, for example, to create multicolored emojis. Unlike the previously supported COLRv0 format, COLRv1 introduces the ability to use gradients, overlays, and transformations. The format also provides a compact storage form, ensures efficient compression, and allows for contour reuse, significantly reducing font size. For example, the Noto Color Emoji font in raster format takes up 9MB, whereas in the COLRv1 vector format it is only 1.85MB.
• The Origin Trials mode (experimental features requiring separate activation) has implemented the Region Capture API, which allows cropping captured video. For instance, cropping may be necessary in web applications that capture video from their tab's content to remove specific content before sending. The Origin Trial allows the specified API to be used from applications loaded from localhost or 127.0.0.1, or after registering and obtaining a special token that is valid for a limited time for a specific site.
• The CSS property 'contain-intrinsic-size' has been updated to support the 'auto' value, which will use the last recorded size of the element (when used with 'content-visibility: auto', developers no longer need to guess the rendered size of the element).
• The AudioContext.outputLatency property has been added, allowing information about the predicted latency before sound output to be retrieved (the delay between requesting sound and the beginning of processing the received data by the output device).
• The CSS property color-scheme allows you to specify which color schemes an element can be correctly displayed in ("light", "dark", "day mode", and "night mode"). An "only" parameter has been added, allowing for the exclusion of forced changes in color schemes for specific HTML elements. For example, if you specify "div { color-scheme: only light }", then only the light theme will be used for the div element, even if the browser is set to enforce a dark theme.
• CSS has introduced support for media queries ‘dynamic-range’ and ‘video-dynamic-range’ to determine the presence of a screen that supports HDR (High Dynamic Range).
• The window.open() function now allows you to choose to open a link in a new tab, a new window, or a popup. Additionally, the window.statusbar.visible property now returns "false" for popups and "true" for tabs and windows. const popup = window.open(‘_blank’,’,’popup=1′); // Open in a popup const tab = window.open(‘_blank’,’,’popup=0′); // Open in a tab
• The structuredClone() method has been implemented for windows and workers, allowing the creation of recursive copies of objects that include properties not only of the specified object but also of all other objects that the current object references.
• The Web Authentication API has added support for the FIDO CTAP2 specification extension, which allows you to set a minimum allowable PIN code size (minPinLength).
• A Window Controls Overlay component has been added for installed standalone web applications, expanding the application screen area to the entire window, including the title area, on which standard window control buttons (close, minimize, maximize) are overlaid. The web application can manage rendering and input handling for the whole window except for the overlaid block with window control buttons.
• The WritableStreamDefaultController has added a signal handling property that returns an AbortSignal object, allowing immediate stopping of write operations in a WritableStream without waiting for their completion.
• In WebRTC, support for the SDES key agreement mechanism has been removed, which was declared obsolete by the IETF in 2013 due to security issues.
• The U2F API (Cryptotoken) is disabled by default, which was previously deprecated and replaced by the Web Authentication API. The U2F API will be completely removed in Chrome 104.
• The API Directory has deprecated the field installed_browser_version, which has been replaced by the new field pending_browser_version. This new field contains information about the browser version taking into account downloaded but not yet applied updates (i.e., the version that will take effect after restarting the browser).
• Support for TLS 1.0 and 1.1 has been removed.
• Improvements have been made to web developer tools. A tab has been added to evaluate back-forward cache performance, providing instant transitions when using the 'Back' and 'Forward' buttons. The ability to emulate forced-color media queries has also been added. In the Flexbox editor, buttons have been added to support the row-reverse and column-reverse properties. In the 'Changes' tab, changes after code formatting are now displayed, simplifying the analysis of minified pages.

  The code viewing panel has been updated to release CodeMirror 6, which significantly enhances performance when working with very large files (WASM, JavaScript). Issues with random offsets during navigation have been resolved, and autocomplete system recommendations for code editing have been improved. The CSS properties panel has added the ability to filter output by the name or value of the property.

  

In addition to new features and bug fixes, the latest version has addressed 27 vulnerabilities. Many of these vulnerabilities were identified through automated testing using tools like AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues allowing bypassing all layers of browser protection to execute code outside the sandbox environment have been found. As part of the vulnerability reward program for this release, Google has awarded 19 prizes totaling $88,000 (two prizes of $20,000, one prize of $12,000, two prizes of $7,500, four prizes of $1,000, and one prize each of $7,000, $5,000, $3,000, and $2,000).

Source: opennet.ru