Google has released version 123 of the Chrome web browser. At the same time, a stable release of the free project Chromium, which forms the basis of Chrome, is available. Chrome differs from Chromium in that it uses Google logos, has a notification system in case of crashes, includes modules for playing copy-protected video content (DRM), has an automatic update installation system, always has Sandbox isolation enabled, provides keys to the Google API, and transmits RLZ parameters during searches. For those who need more time for updates, an Extended Stable branch, which is supported for 8 weeks, is available. The next version, Chrome 124, is scheduled for April 16.
Key changes in Chrome 123:
- On the page shown when opening a new tab, a new section is offered where links from tabs recently opened on other devices linked to the same Google account are displayed.
- Support for content encoding using the Zstandard (zstd) compression algorithm has been added, in addition to the previously supported gzip, brotli, and deflate algorithms.
- The implementation of the free video codec Theora, created by the Xiph.org Foundation based on the VP3 codec and supported in Firefox and Chrome since 2009, has been removed, but is not supported in Chrome for Android or browsers based on WebKit, such as Safari. The reason for discontinuing support for Theora includes concerns that the implementation may have vulnerabilities similar to the recent critical issues with the VP8 encoder due to its complex binary data parsing logic and stream decoding. Developers believe that due to the increase in 0-day attacks on media codecs, the associated security risks outweigh the demand for the Theora codec, which is rarely used in practice but remains a significant target for potential attacks.
- The gradual increase in the percentage of users for whom support for third-party cookies set while visiting sites other than the current page's domain is disabled has continued. Such cookies are used for tracking user movements between sites in advertising network code, social media widgets, and web analytics systems. The changes are being promoted as part of the Privacy Sandbox initiative, aimed at reaching a compromise between users' need for privacy and the desire of advertising networks and sites to track visitor preferences. The disabling of third-party cookies is planned to be gradually expanded, with a goal of reaching 100% by Q3 2024. To disable this feature without waiting for external changes, the setting "chrome://flags/#test-third-party-cookie-phaseout" is available.
- For a small percentage of users in the U.S., support for features utilizing machine learning has been enabled—such as the smart tab grouping mode, theme generator, and interactive assistant announced in the Chrome 121 release. For systems with centralized configuration management, administrators can enable AI tools at the policy level without the need to activate experimental mode.
- Support for versions prior to Chrome 82 has been discontinued in the settings synchronization service for preferences, history, and bookmarks (Chrome Sync).
- When enhanced protection in the browser is enabled (Safe Browsing > Enhanced protection), information about requests for advanced permissions made by sites is sent to Google (such pages are checked against an external database of malicious content, and if matched, the user is immediately shown a warning). Telemetry about the user's dismissal of warnings shown before opening pages blacklisted by Google has also been enabled.
- Google has published an article explaining the methods used to check the security of pages opened by users against a database of malicious content hosted externally. serverTo preserve privacy when checking user-opened URLs, only partial hashes of the URLs are sent to Google, specifically the prefix with the first 4 bytes of the hash. server This prefix is checked against the database of malicious pages, and if there is a match, a list of corresponding full hashes is returned to the user's browser, where a final verification with the complete 32-byte URL hash is performed. To prevent the request from being associated with the user's IP address, the hash prefix is initially sent to an intermediate proxy, which forwards the request to the Safe Browsing system server on its behalf.
- Warnings are issued in the web developer tools console when a page sends a request to the internal network (192.168.x.x, 10.x.x.x, etc.) if such requests are made outside of a secure context and have not undergone proactive verification. Before actually sending a request initiated by the site to a resource in the internal network, the browser will first send a preemptive test request and check if the server returns the HTTP header 'Access-Control-Allow-Private-Network: true', which allows access to the intranet. If access is not permitted, this indicates an attempt to improperly target an internal service, which may signal an attempt to carry out an attack through the browser on resources in the local network (for example, an attacker might embed in an iframe a request to the web interface of a home router, like ''). In Chrome 130, the warning is expected to be replaced with an error output, blocking requests that fail the check.
- Chrome for Android and iOS has added the ability to continue browsing sites previously opened on other devices connected to the same Google account.
- In Chrome for Android, the method of storing local passwords that do not sync with other devices has been changed. Previously, local passwords were stored in the Chrome profile, but now they will be moved to the password storage provided by Google Play services, which is already used to store passwords for the Google account. In Chrome 123, the new storage mode is activated for users without local passwords, and in Chrome 124 it will be applied to users with local passwords.
- An API for static routing of Service Workers has been added, which allows excluding JavaScript execution and intercepting Service Workers when requesting resources that meet specified conditions. In other words, the API enables the determination of how certain resources should be loaded and disables the invocation of the Service Worker for resources that can be fetched from the cache or loaded directly. URL patterns, request methods, content types (document, embed, font, video, etc.), and execution status ('running', 'not-running') can be used as decision criteria. For example, to send a POST request with web form data directly, without invoking the Service Worker, you can specify: addEventListener('install', (event) => { event.addRoutes({ condition: { urlPattern: '/form/*', requestMethod: 'post' }, source: 'network' }); });
- A light-dark() function has been added to CSS to adapt the color scheme to light or dark mode settings. The function can take two values that will be chosen based on the light or dark mode. For example, 'background-color: light-dark(lime, green);'.
- The Long Animation Frames API has been introduced for diagnosing the responsiveness of website interfaces and identifying bottlenecks during rendering.
- Support for the 'picture-in-picture' value has been added to the media query 'display-mode', allowing the creation of CSS rules applicable only when the web application is displayed in 'picture-in-picture' mode. @media all and (display-mode: picture-in-picture) { body { margin: 0; } h1 { font-size: 0.8em; } }
- The 'align-content' CSS property has been enhanced to work with block containers and table cells. For example, 'display: block', 'display: list-item', 'display: table-cell' can now be aligned using 'align-content'.
- A CSS property 'field-sizing' has been added, allowing the size of form elements to depend on their content, for example, enabling the automatic increase of a text field's size as data is entered.
- The NavigationActivation interface in JavaScript has been updated with the parameter navigation.activation, which reflects the activation state of the document (for instance, it can determine if the document has been restored from cache after pressing the forward or back navigation buttons). This parameter can be used to customize the page content based on the user's entry point; for example, a different animation might be shown if the user arrived from the homepage.
- Improvements have been made to the web development tools.
In addition to new features and bug fixes, the latest version addresses 12 vulnerabilities. Many of these vulnerabilities were identified through automated testing using tools like AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues were found that would bypass all browser security levels and execute code on the system outside of the sandbox environment. Under the vulnerability reward program for this release, Google has awarded seven prizes totaling $22,000 (one prize of $10,000, one of $4,000, one of $3,000, one of $1,000, and two prizes of $2,000). The amount of one reward has not yet been determined.
Source: opennet.ru
