Google has unveiled the release of the Chrome 108 web browser. At the same time, a stable release of the free Chromium project, which is the basis of Chrome, is available. The Chrome browser differs from Chromium in the use of Google logos, the presence of a system for sending notifications in case of a crash, modules for playing copy-protected video content (DRM), an automatic update system, the constant inclusion of Sandbox isolation, the supply of keys to the Google API and transmission when searching for RLZ- parameters. For those who need more time to update, the Extended Stable branch is supported separately, followed by 8 weeks. The next release of Chrome 109 is scheduled for January 10th.
Key changes in Chrome 108:
- The design of the dialog for managing Cookies and site data has been changed (called through the link Cookies after clicking on the padlock in the address bar). The dialog has been simplified to now display information broken down by site.
- Two new browser optimization modes are proposed - Memory Saver and Energy Saver, which are offered in the performance settings (Settings> Performance). The modes are currently only available on ChromeOS, Windows, and macOS platforms.
- The password manager provides the ability to attach a note to each saved password. Like the password, the note is shown on a separate page only after authentication.
- The Linux version uses the built-in DNS client by default, which was previously only available on Windows, macOS, Android, and ChromeOS versions.
- On the Windows platform, when installing Chrome, a shortcut to launch the browser is now automatically pinned to the taskbar.
- Added the ability to track price changes for selected products in some online stores (Shopping List). When the price drops, a notification or email (in Gmail) is sent to the user. Adding a product for tracking is done by pressing the "Track price" button in the address bar when you are on the product page. Tracked products are saved with bookmarks. The function is available only to users with an active Google account, when synchronization is enabled and the "Web & App Activity" service is activated.
- The ability to view search results in the sidebar at the same time as viewing another page is enabled (in one window, you can simultaneously see both the page content and the result of accessing the search engine). After visiting a website from a Google search results page, an icon with the letter βGβ appears in front of the input field in the address bar, when clicked, a sidebar opens with the results of a previously undertaken search.
- In the File System Access API, which allows web applications to read and write data directly to files and directories on the user's device, the getSize(), truncate(), flush(), and close() methods on the FileSystemSyncAccessHandle object have been moved from asynchronous to synchronous execution model, by analogy with the read() and write() methods. The change made it possible to provide a fully synchronous FileSystemSyncAccessHandle API that improves the performance of WebAssembly-based (WASM) applications.
- Added support for additional sizes of the visible area (viewport) - "small" (s), "large" (l) and "dynamic" (d), as well as units of measurement associated with these sizes - "*vi" (vi, svi, lvi and dvi), "*vb" (vb, svb, lvb and dvb), "*vh" (svh, lvh, dvh), "*vw" (svw, lvw, dvw), "*vmax" (svmax, lvmax , dvmax) and "*vmin" (svmin, lvmin and dvmin). The proposed units of measurement allow you to bind the size of elements to the smallest, largest and dynamic size of the visible area as a percentage (the size varies depending on the show, hide and state of the toolbar).
- Added support for variable color vector fonts in COLRv1 format (a subset of OpenType fonts that contain a layer with color information in addition to vector glyphs).
- The @supports CSS rules have added the font-tech() and font-format() functions to check for color font support, and the tech() function has been added to the @font-face CSS rules.
- A Federated Credential Management (FedCM) API has been proposed to allow the creation of federated identity services that preserve privacy and work without cross-site tracking mechanisms such as handling third-party cookies.
- Added the ability to apply the pre-existing "overflow" CSS property to replaced elements that draw outside the content boundary, which, in combination with the object-view-box property, can be used to create custom shadow images.
- Added break-before, break-after and break-inside CSS properties that allow you to customize the behavior of breaks in fragmented output in the context of individual pages, columns and areas. For example, "figure { break-inside: avoid;}" will prevent the page from breaking inside a figure.
- The align-items , justify-items , align-self , and justify-self CSS properties provide the ability to use the "last baseline" value to align to the last baseline in a flex or grid layout.
- Added the ContentVisibilityAutoStateChanged event that fires for elements with the "content-visibility: auto" property when the element's rendering state changes.
- The ability to access the Media Source Extensions API in the context of workers is provided, which can be used, for example, to improve the performance of buffered playback of multimedia data by creating a MediaSource object in a separate worker and broadcasting the results of its work to an HTMLMediaElement in the main thread.
- The Permissions-Policy HTTP header, which is used to delegate permissions and enable advanced features, allows wildcards, such as "https://*.bar.foo.com/".
- Removed deprecated window.defaultStatus, window.defaultstatus, ImageDecoderInit.premultiplyAlpha, navigateEvent.restoreScroll(), navigateEvent.transitionWhile() APIs.
- Improvements have been made to tools for web developers. Hints for inactive CSS properties have been added to the Styles panel. The Recorder panel implements automatic detection of XPath and text selectors. The debugger provides the ability to step through comma-separated expressions. Expanded "Settings > Ignore List" settings.
In addition to innovations and bug fixes, 28 vulnerabilities have been fixed in the new version. Many of the vulnerabilities were identified as a result of automated testing tools AddressSanitizer, MemorySanitizer, Control Flow Integrity, LibFuzzer and AFL. No critical issues that allow bypassing all browser protection levels and executing code in the system outside the sandbox environment have been identified. As part of the vulnerability discovery program for the current release, Google paid 10 awards worth $74 (one each of $15000, $11000, and $6000, five $5000 awards, three $3000 and $2000 awards, two $1000 awards) . The amount of 6 rewards has not yet been determined.
Source: opennet.ru