Google has released version 129 of the Chrome web browser. At the same time, a stable release of the open-source Chromium project, which forms the foundation of Chrome, is available. The Chrome browser differs from Chromium in that it uses Google branding, includes a crash reporting notification system, supports modules for playing protected video content (DRM), has an automatic update installation system, consistently activates Sandbox isolation, provides keys to Google API, and transmits RLZ parameters during searches. For those who need more time to update, an Extended Stable branch is separately maintained, lasting 8 weeks. The next release, Chrome 130, is scheduled for October 15.
Key changes in Chrome 129:
- A new feature has been added to customize the content of the toolbar, allowing users to pin, unpin, and rearrange icons using a configurator displayed in the sidebar. For example, users can place buttons on the toolbar for accessing the developer interface, clearing browsing data, opening reading mode, switching to the task manager, going to the password manager, and more. A parameter "chrome://flags/#toolbar-pinning" has been added to control the pinning of icons.
- A tab comparison feature has been proposed, which leverages machine learning to generate comparative reviews of products whose pages are open in different tabs. This feature is currently available only to users in the United States.
- In the Android version, inactive tabs can now be moved to a separate section (Inactive Tabs) in the tab-switching interface. Users can view all old tabs and close them simultaneously. By default, this new feature is enabled for 1% of users. Tabs will be automatically removed after remaining in the Inactive Tabs section for more than 60 days.
- An experimental process sharing mode has been added, which allows different tabs opened to the same site to use a single shared rendering process instead of separate processes. This change speeds up page loading and reduces memory consumption. To enable this mode, a setting has been added: 'chrome://flags/#enable-process-per-site-up-to-main-frame-threshold'.
- A feature has been added that allows websites to request temporary permissions, valid only within the current session frames (for example, access to the camera and microphone, which will remain until the tab is closed or navigated away from the site).
- Support for macOS 10.15 has been discontinued, as Apple ceased support for this platform in 2022.
- A new certificate management interface has been implemented in the configurator for Windows and macOS platforms (previously, system interfaces for certificate management were invoked on these platforms).
- Access to IP 0.0.0.0 has been blocked to prevent attacks on local services.
- The upcoming replacement of the TLS key exchange algorithm Kyber768+X25519 has been announced, with ML-KEM768+X25519 (the recently adopted ML-KEM standard is based on the post-quantum Kyber algorithm, but is not fully compatible with its previous implementation).
- A method 'scheduler.yield()' has been added to the Scheduler API, allowing control to be returned to the main browser thread during the execution of long tasks. This enables the current long task to be paused for important operations, such as input processing and frame rendering. The idea is to break down long-running tasks into smaller parts, periodically yielding control back to the main thread via 'await scheduler.yield();' in the code, which helps mitigate the negative impact of long-running tasks on website responsiveness.
- The CSS property 'interpolate-size' has been added, allowing animation sizes to be chosen relative to the values computed using the properties auto, min-content, or fit-content, rather than in absolute units. For more precise size control, the CSS function calc-size() has been proposed, similar to calc(), but supporting operations with actual element sizes that change depending on content.
- CSS properties have been modified to control the display of elements linked to the positions of other elements (CSS Anchor Positioning) without using JavaScript, for instance, for attachment to elements of popovers that appear similarly to tooltips. In accordance with the recommendations of the CSS standardization working group, the CSS property 'inset-area' has been renamed to 'position-area', 'position-try-options' has been renamed to 'position-try-fallbacks', and the requirement to specify inset-area() in the 'position-try' property has been removed, meaning instead of 'position-try-fallbacks: inset-area(top)', it should be written as 'position-try-fallbacks: top'.
- The Intl API has introduced the Intl.DurationFormat method for formatting duration data over time based on the selected locale. For example: const l = 'ru-RU'; const d = {hours: 1, minutes: 46, seconds: 40}; const opts = {style: 'long'}; new Intl.DurationFormat(l, opts).format(d); // '1 hour, 46 minutes, 40 seconds'
- The Web GPU API has been implemented to use the entire range of brightness supported by the display when rendering HDR images.
- The WebRTC API has added support for sending blobs using the RTCDataChannel.send(Blob) method and receiving data of type Blob when handling the onMessage event, if the 'binaryType' attribute is set to 'blob' (previously only string and ArrayBuffer transmission was supported). The size of the blob is limited to the maxMessageSize value.
- The WebAuthn API has added the methods PublicKeyCredential.toJSON(), parseCreationOptionsFromJSON(), and parseRequestOptionsFromJSON() for serializing/deserializing WebAuthn responses using the JSON format.
- The 'Origin trials' mode has implemented the FileSystemObserver API, allowing sites to monitor changes to files and directories.
- The 'Origin trials' mode has added the Mesh2D Canvas API for visualizing large numbers of textured triangles. The API's applications include implementing advanced texture mapping methods and creating deformation effects in a two-dimensional context.
- The capabilities of the tools for web developers have been expanded.
In addition to new features and bug fixes, the new version addresses 9 vulnerabilities. Many of these vulnerabilities were identified through automated testing tools such as AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. One issue has been assigned a high severity level (improper type handling in the V8 engine). No critical issues allowing circumvention of all browser security levels and execution of code outside the sandbox environment were found. As part of the vulnerability reward program for this release, Google has awarded 5 prizes totaling $13,000 (one prize of $8,000, one of $2,000, and three prizes of $1,000). The amount of one reward has not yet been determined.
Source: opennet.ru
