Google has published the release of web browser Chrome 141. A stable release of the free project Chromium, which serves as the foundation for Chrome, is also available. The Chrome browser differs from Chromium in that it uses Google logos, includes a system for sending notifications in case of crashes, has modules for playing copy-protected video content (DRM), features an automatic update installation system, always includes Sandbox isolation, provides keys to Google API, and transmits RLZ parameters during searches. For those who need more time to update, a separate Extended Stable branch is supported for 8 weeks. The next release of Chrome 142 is scheduled for October 28.
Key changes in Chrome 141:
- For some users, the integrated chat-bot Gemini has been activated within the browser, which can explain the content of the viewed page and answer related questions without switching tabs. A button has been added to the upper right corner of the screen to call Gemini, allowing users to ask questions in natural language and select tabs whose content the AI should consider when forming a response. Both text and voice communication with the bot are supported. This feature is available to users in the US who have access to the Gemini application and use macOS, iOS, and Windows platforms.
- Protection against requests to the local system (loopback, 127.0.0.0/8) or internal network (192.168.0.0/16, 10.0.0.0/8, etc.) when interacting with public websites has been implemented. When attempting to load internal resources, the browser will now prompt the user for confirmation of the operation. Accessing internal resources is used by attackers to carry out CSRF attacks on routers, access points, printers, corporate web interfaces, and other devices and services that accept requests only from the local network. In addition, scanning internal resources can be used for indirect identification or information gathering about the local network.
- The transition to a more granular process isolation model — 'Origin Isolation' — has begun, whereby each content source (origin — a combination of protocol, domain And the port, such as "https://foo.example.com", is isolated in a separate rendering process. Since increasing fragmentation of isolation can lead to higher memory consumption and increased CPU load, the new isolation mode is only enabled on systems with more than 4 GB of RAM. On low-powered devices, the old isolation approach will continue to be used, where all different content sources related to a single site (e.g., foo.example.com and bar.example.com) are isolated in separate processes. This capability is currently activated for a portion of users, and coverage will gradually increase.
- The application of the 'Same Origin' policy is enabled for the Storage Access API. The call to 'document.requestStorageAccess()' from code loaded via an iframe from another site will now, by default, only cover the site from which that iframe was loaded, rather than the site where the iframe is hosted.
- Heuristics have been added to detect client-side interception or redirection of search queries entered in the address bar or on the page shown when opening a new tab. Such interception is employed by some malicious extensions. The check is performed through matching user-entered queries with the appearance of a search results page. If tampering is detected in Safe Browsing mode, telemetry is sent to Google for more detailed analysis, taking into account telemetry from different users. server Telemetry is sent to Google for more detailed analysis, accounting for telemetry from various users.
- On the new tab opening page, in the lower panel where information about extensions that affect the content of the new tab page is displayed, information about activity on the device subject to centralized management is provided.
- On systems with user profiles linked to third-party authentication providers, the ability to execute remote administration commands, such as clearing cache or cookies, has been implemented.
- The IndexedDB API has implemented the getAllRecords() method, allowing retrieval of all records from an object store (IDBObjectStore) and index (IDBIndex). getAllRecords() combines the functionalities of the getAllKeys() and getAll() methods to fetch both primary keys and their associated values. The getAll() and getAllKeys() methods now include a 'direction' parameter to determine the data retrieval direction, speeding up certain read operations compared to using cursors.
- The 'WebRTC Encoded Transform' API has been added for processing encoded multimedia data transmitted through RTCPeerConnection.
- Support for 'width' and 'height' attributes has been added for nested elements, which can now be controlled through CSS or SVG markup.
- Improvements have been made to the tools for web developers. An experimental MCP (Model Context Protocol) server has been added, allowing access to Chrome DevTools capabilities from external AI assistants.
Information about fixed vulnerabilities is currently absent from the announcement and change tracker at the time of writing this news.
Supplement: A day after the release, details about fixed vulnerabilities have been disclosed. In Chrome 141, 21 vulnerabilities were addressed. Many of these vulnerabilities were identified through automated testing using tools like AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer, and AFL. No critical issues that allow bypassing all levels of browser protection and executing code on the system outside the sandbox environment have been identified. As part of the bounty program for discovering vulnerabilities for this release, Google has awarded 12 bounties totaling $50,000 (including one $25,000 bounty, one $5,000, one $4,000, and one $2,000, as well as four $3,000 awards and two $1,000 awards). The amount of one reward has not yet been determined.
Source: opennet.ru
