In Chrome 118, the web developer tools now provide warnings when sending cookies that are subject to future blocking. A command-line option «—test-third-party-cookie-phaseout» and the setting «chrome:\/\/flags\/#test-third-party-cookie-phaseout» have also been added to force the activation of blocking for testing purposes. The actual blocking of third-party cookies will begin in the first quarter of 2024, and during the testing period until the third quarter, it will cover only 1% of Chrome users. After the third quarter of 2024, the blocking coverage will be increased to 100%. <\/p>\n
Instead of tracking cookies, the following APIs are proposed: <\/p>\n
- \n
- FedCM (Federated Credential Management) allows for the creation of unified identification services that ensure privacy and work without third-party cookies.\n
- Private State Tokens allow for differentiating between users without using cross-site identifiers and sharing user authentication information across different contexts.\n
- Topics (critique) enables determining user interest categories that can be used to highlight groups of users with similar interests without identifying individual users using tracking cookies. Interests are computed based on the user's activity in the browser and stored on the user's device. Using the Topics API, an ad network can obtain general information about individual interests without having information about specific user activity.\n
- Protected Audience, a solution for retargeting tasks and assessing one's own audience (working with users who have previously visited the site).\n
- Attribution Reporting, allows for evaluating advertising effectiveness metrics such as clicks and conversion (a purchase on the site after clicking).\n
- Storage Access API, can be used to request user permissions to access the Cookie storage if third-party Cookies are blocked by default. <\/ul>\n
- All users now have access to the ECH (Encrypted Client Hello) mechanism, which continues the development of ESNI (Encrypted Server Name Indication) and is used to encrypt information about TLS session parameters, such as the requested domain name. A key difference between ECH and ESNI is that ECH encrypts the entire ClientHello TLS message rather than encrypting individual fields, which helps block leaks through fields not covered by ESNI, such as the PSK (Pre-Shared Key) field. To manage the activation of ECH, the setting «chrome:\/\/flags#encrypted-client-hello» is provided.\n
- With enhanced browser protection enabled (Safe Browsing > Enhanced protection), it is now possible to remotely disable malicious extensions that were not installed from the official extension store. The decision to remove an extension is made on Google's servers based on manual reviews or through the activation of an automated malware detection system.\n
- With standard browser protection enabled (Safe Browsing > Standard protection), real-time security checks of open URLs are performed based on the transmission to servers<\/a> partial hashes of the URLs opened by the user to Google. To exclude matches an IP address<\/a> the user and a hash; the data is sent through an intermediary proxy. Previously, the checks were conducted by downloading a local copy of the unsafe URL list to the user's system. The new scheme allows for more prompt blocking of malicious URLs.\n
- The design of pages displayed when attempting to open a site deemed unsafe during checks via the Safe Browsing mechanism has been improved.
![\"Release](\"\/wp-content\/uploads\/2023\/10\/77171e2b4504325dc2f1cd0729dcfe9b.png\")
<\/center>\n- In the telemetry sent to Google's servers with enhanced browser protection enabled (Safe Browsing > Enhanced protection), requests from extensions to the chrome.tabs API are now considered. Data is collected to identify malicious activity and rule violations in extensions.\n
- With enhanced browser protection enabled (Safe Browsing > Enhanced protection), support for deep scanning of encrypted ZIP and RAR archives on Google's side has been provided (the user is prompted for the extraction password, after which the contents are sent for verification to Google's servers).\n
- The configurator and privacy policy guidance have been updated with new text explaining the essence of Safe Browsing protection levels and links to relevant articles for additional information. Descriptions of standard protection, disabling protection, and password compromise warnings have been simplified.
![\"Release](\"\/wp-content\/uploads\/2023\/10\/bf798ee40f6ed0d20026cf95caffb231.png\")
<\/center>\n- The Quests section (price tracking in online stores) on the new tab page has been updated with information on discount availability. The discount indicator may also appear in the address bar when opening product pages from online stores tracked by the Google service.\n
- In accordance with the RFC-6265bis specification, blocking of all cookies containing control characters and set via JavaScript has been implemented. Previously, cookies with null characters, carriage returns, and line breaks were truncated at the problematic character instead of being blocked, which could be exploited for malicious actions in some cases. To disable this new behavior, you can use the option \u2018--disable-features=BlockTruncatedCookies\u2019.\n
- Service Workers registered with extensions are now allowed to access the WebUSB API.\n
- The need for users to activate the ability to display dialogs for payment requests and confirmations has been eliminated.\n
- Decoding ASCII character representation as codes «%xx» has been discontinued. For example, previously «http:\/\/example.com\/» was decoded to «http:\/\/example.com\/A» before being written to url.href, but now it will remain as «http:\/\/example.com\/».\n
- The ability to vertically align text in web form elements such as select, meter, progress, button, textarea, and input has been added. Text positioning in forms is set using the CSS property writing-mode, which can take values vertical-rl or vertical-lr for vertical display.\n
- Support for non-standard keywords has been dropped in the CSS property \u2018appearance\u2019: inner-spin-button, media-slider, media-sliderthumb, media-volume-slider, media-volume-sliderthumb, push-button, searchfield-cancel-button, slider-horizontal, sliderthumb-horizontal, sliderthumb-vertical, and square-button. Statistics were collected to evaluate the demand for these keywords, which were not included in the specification, and they were used only in 0.001% of cases.\n
- A CSS rule @scope has been added that binds CSS styles based on the proximity of the style definition to the elements. The @scope rule can be applied to bypass the typical arrangement of styles based on the order of element occurrence or to adjust the style of a component without affecting the styles of nested elements. For example, for nested divs: <div class="»lightpink-theme»"> <a href="\/en\/»\/#»">I’m lightpink!<\/a> <div class="»pink-theme»"> <a href="\/en\/»\/#»">Different pink!<\/a> <\/div> <\/div> all content will be colored lightpink due to the style block 'lightpink-theme' affecting the entire parent div. Using @scope allows changing the visibility and applying the 'pink-theme' style to the nested div based on the proximity of the style definition rather than the order in the code: @scope (.pink-theme) { a { color: hotpink; } } @scope (.lightpink-theme){ a { color: lightpink; } }\n
- Support for the media query (@media) \u2018scripting\u2019 has been added, allowing the check for script execution capability (for example, in CSS, it can be determined whether JavaScript support is enabled).\n
- Support for the media query prefers-reduced-transparency has been added, enabling the detection of changes in system settings that reduce the application of transparency or semi-transparency effects (for example, the \u2018Reduce transparency\u2019 mode in macOS, used to improve text readability).\n
- New values have been added to CSS: \u2018float: inline-start\u2019, \u2018float: inline-end\u2019, \u2018clear: inline-start\u2019, \u2018clear: inline-end\u2019, \u2018resize: block\u2019, \u2018resize: inline\u2019, which control the logical positioning of elements (to support languages written not top-to-bottom and left-to-right, logical positioning utilizes concepts of start, end, and text direction).\n
- In the CSS property \u2018transform-box\u2019, support for values stroke-box, content-box, and border-box has been added, allowing modification of the reference area calculation method for transformation operations, for instance, to implement advanced graphic effects.\n
- The ability to focus on scroll blocks while navigating using the keyboard has been added (for example, focus can be set to scroll by pressing the Tab key and scrolling with the arrow keys).\n
- Improvements have been made to the tools for web developers. The functionality of the Sources panel has been expanded, where instead of the 'Filesystem' section, a 'Workspace' tab is offered, allowing synchronization of changes made through the developer tools with the source files.
- The design of pages displayed when attempting to open a site deemed unsafe during checks via the Safe Browsing mechanism has been improved.