Google has released version 135 of the Chrome web browser. At the same time, a stable release of the free Chromium project, which serves as the foundation for Chrome, is available. The Chrome browser differs from Chromium by its use of Google logos, a system for sending notifications in case of crashes, modules for playing DRM-protected video content, an automatic update installation system, the constant inclusion of Sandbox isolation, the provision of keys for Google API, and the transmission of RLZ parameters during searches. For those who need more time to update, an Extended Stable branch is available, supported for 8 weeks. The next release, Chrome 136, is scheduled for April 29.
Key changes in Chrome 135:
- Protection against hidden user identification has been added using HSTS (HTTP Strict Transport Security) caching. HSTS allows websites to redirect users to HTTPS when accessing via HTTP. During operation, the hostname set through HSTS is stored in an internal cache, which allows the presence or absence of the host in the cache to be used to store a single bit of information.
To hide a 32-bit user identifier, an array of 32 images can be used, served from different hosts via HTTP (http://bit0.example.com/image.jpg, http://bit1.example.com/image.jpg, etc.). The identifier is determined by checking which hosts the images were loaded from via HTTPS and which ones via HTTP (if images were previously served through HTTP and redirected to HTTPS via HSTS, they will immediately be loaded via HTTPS on subsequent requests, bypassing the HTTP call). The protection has been reduced to allowing HSTS updates only for top-level resources while blocking HSTS updates in subresource requests.
- A locally executed machine learning model has been added to improve the detection of password input forms on pages and automatic password changes. If a password is deemed compromised, Chrome will display a warning suggesting changing the password upon attempting to log in with that password. If the user agrees, the browser will generate a strong password, change the password on the site, and save the new password in the password manager — the AI will automatically fill out and submit the necessary web forms on the required site and update the saved password.
- The extended protection mode in the browser (Safe Browsing > Enhanced protection) has added the capability to utilize a large language model for identifying fraudulent pages based on their content. The AI model runs on the client side, but if suspicious content is detected, additional verification is performed on servers Google. If the additional verification is confirmed, a warning is displayed to the user. Verification is currently only performed for pages using the Keyboard Lock API.
- For users who have linked Chrome to their Google account, there is now the ability to save installed extensions to their Google Account for automatic use of these extensions on all devices the user utilizes.
- Users who have recently linked their Google account or are using Chrome Sync have their synchronized settings, site shortcuts, and themes stored separately from local settings. This means that after disabling Chrome Sync on a device, the original settings will remain, and local settings will not load when connecting to Google.
- In the Android version, support for the built-in password manager has been discontinued, replaced by the unified Google Password Manager, which is delivered through Google Play. Users can save the contents of the old password manager in CSV format for transfer to other password managers.
- In incognito mode, a non-disconnectable browser-side blocking of third-party cookies has been implemented, set when visiting sites other than domain the current page (such cookies are used to track user movements across sites in the code of advertising networks, social media widgets, and web analytics systems). The ability to manage third-party cookie blocking on the website side remains unchanged, but the BlockThirdPartyCookies setting in incognito mode cannot now be set to false in the browser.
- CSS has introduced pseudo-elements ‘::column’, ‘::scroll-button’, ‘::scroll-marker’, and ‘::scroll-marker-group’, which can be used to implement scrolling in the form of a carousel.
- HTML attributes "command" and "commandfor" have been implemented, which can be used in buttons instead of the attributes "popovertargetaction" and "popovertarget" for declarative menu interaction settings upon button clicks. When using the new attributes, all the menu interaction logic is handled by the browser, without the need for custom JavaScript handlers. For example, to create a dropdown menu, it is sufficient to specify: <button commandfor="»my-menu»" command="»show-popover»">Open Menu</button> <div popover id="»my-menu»"> … </div>
- The shape() function has been added in CSS, allowing for the creation of shapes using the CSS properties clip-path and offset-path. The shape() function supports shape creation commands equivalent to the path() function but allows for the use of standard CSS syntax.
- The Web Speech API, which provides functionalities for speech synthesis and recognition, has been updated to support the MediaStreamTrack interface for processing audio coming from various sources, including external audio tracks. Previously, the Web Speech API could only handle audio from the default microphone.
- JavaScript has introduced support for typed arrays Float16Array, intended for storing values of type Float16.
- An Observable API has been added for handling event streams asynchronously. This API allows subscribing to an object to receive events as they arrive and declaratively describe the transformation stream that will be applied to incoming events.
- The method navigator.xr.supportsSession, which was previously marked as deprecated, has been removed. Instead, you should use the method navigator.xr.isSessionSupported as specified in the WebXR specification.
- The settings InsecurePrivateNetworkRequestsAllowedForUrls and InsecurePrivateNetworkRequestsAllowed, which were used to enable the PNA 1.0 (Private Network Access) mechanism that restricts loading resources from publicly available sites that reference hosts on the internal network (127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8, etc.), have been removed. This behavior was exploited by attackers to carry out CSRF attacks on routers, access points, printers, corporate web interfaces, and other devices and services that accept requests only from the local network.
Due to incompatibility with some devices, PNA 1.0 could be enabled only optionally. The PNA 2.0 specification has been developed to replace PNA 1.0, which does not require changes on the device side and only necessitates changes on the websites that need access to intranet resources. PNA 1.0 and PNA 2.0 are not compatible with each other, so Google intends to first remove support for PNA 1.0 before implementing PNA 2.0.
- The option to restore support for the deprecated MutationEvent interface and the associated synchronous DOM events DOMSubtreeModified, DOMNodeInserted, DOMNodeRemoved, DOMNodeRemovedFromDocument, DOMNodeInsertedIntoDocument, and DOMCharacterDataModified has been removed. This interface was used to track changes in the DOM tree but had a negative impact on page performance and hindered the implementation of some new features. This API was disabled by default last summer, but Chrome retained the MutationEventsEnabled option to restore support. As an alternative, it is recommended to use the Mutation Observer API.
- The web development tools have enhanced performance analysis capabilities.
In addition to new features and bug fixes, the new version addresses 14 vulnerabilities. Many of these vulnerabilities were identified through automated testing with AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL tools. No critical issues that allow bypassing all levels of browser protection and executing code in the system outside of the sandbox environment were found. As part of the bug bounty program for the current release, Google has awarded 8 bounties totaling $17,000, including one $10,000 reward and two $2,000, $1,000, and $500 rewards.
Source: opennet.ru
