Google has released version 154 of the Chrome web browser. At the same time, a stable release of the open-source project Chromium, which serves as the foundation for Chrome, is available. Chrome differs from Chromium in that it uses Google logos, includes a crash reporting system, has modules for playing copy-protected video content (DRM), features automatic update installation, always includes Sandbox isolation, comes with access keys for Google APIs, and transmits RLZ parameters during searches. For those who need more time to update, the Extended Stable branch is separately supported for 8 weeks. The next release, Chrome 155, is scheduled for October 6 as part of a new two-week development cycle. <\/p>\n
Key changes in Chrome 154 (1, 2, 3, 4): <\/p>\n
\n
The development of the AI mode continues, allowing interaction with the AI assistant from the address bar or the page displayed when opening a new tab. In the new version, users in the US can use the AI assistant Gemini for virtual clothing fitting while shopping at certain online stores. Chrome for iOS has implemented support for real-time voice communication with Gemini, for example, to discuss the content of an open web page.\n
Programming interfaces and technologies developed under the Privacy Sandbox initiative, intended to replace third-party cookies, have been removed. The rationale for supplying these APIs was lost after the decision not to discontinue third-party cookie support in Chrome. The following APIs have been removed: Topics (which replaced the FLoC API), Protected Audience API, Shared Storage API, Attribution Reporting API, Private Aggregation, Related Website Sets API, and requestStorageAccessFor.\n
In the Android version, the LNP (Local Network Protection) mode has been activated, which requires separate confirmation for an application to access internal intranet subnets (192.168.x.x, 10.x.x.x, etc.). This mode helps block attacks on local network resources and prevents network scans aimed at covertly identifying the user and gathering information about their environment.\n
To make API Background Fetch requests, LNA (Local Network Access) permissions are now required when sending data to servers in the local network (192.168.0.0\/16, 10.0.0.0\/8, etc.) or when accessing the loopback interface (127.0.0.0\/8). Additionally, CORS (Cross-Origin Resource Sharing) checks have been applied to the API Background Fetch to unify restrictions imposed on both API Background Fetch and Fetch. These changes block the use of Background Fetch to bypass Cross-Origin restrictions and carry out CSRF attacks on routers, access points, printers, corporate web interfaces, and other devices and services that only accept requests from the local network.\n
An optional optimization mode \u2018ServiceWorkerAutoPreload\u2019 has been added, which sends a network request simultaneously with the initialization of the Service Worker.\n
The HTML element and the JavaScript API Web Install (method navigator.install()) have been introduced to prompt users for the installation of a web application. Installation occurs only after the user explicitly confirms the operation. This feature can be utilized when creating app store directories or to simplify the installation of web applications for use with the current site.\n
The Window Shape API (method window.setShape) has been added, allowing isolated web applications to change the window shape, such as creating non-rectangular windows, floating panels, and overlapping elements. This API is currently available only on ChromeOS.\n
Settings have been added to manage the types of content for which autofill will be applied in web forms. For example, it is possible to disable saving and autofilling contact information and payment details. URL templates can also be configured to disable autofill for specific sites.\n
By default, a confirmation request prompt is enabled when accessing sites over HTTP.\n
Support for adaptive sizing of iframe blocks has been added, automatically adjusting to content to prevent the appearance of internal scroll bars. This feature is activated by specifying the CSS property \u2018frame-sizing\u2019 (e.g., \u2018frame-sizing: content-height\u2019) in the parent page and adding the iframe header element \u2018\u2019.\n
The CSS property scroll-marker-group implements the modes 'links' and 'tabs' to control the order of focus switching. In 'links' mode, the marker group (::scroll-marker-group) functions like a regular navigation menu (scroll markers are handled as links that can be cycled through with the Tab key). In 'tabs' mode, the marker group acts like a set of tabs, navigable using control keys. There are also two parameters, 'before' and 'after', which manage the handling of the marker group relative to the content (when 'before' is specified, markers will be processed first, whereas 'after' will only be processed after content navigation is complete).\n
The CSS property text-decoration-inset has been implemented, allowing customization of the start and end of the rendering of decorators (such as underlines, strikethroughs, etc.) relative to the edges of the text. For example, to shorten the decorator by 10 pixels, you can specify 'text-decoration-inset: 10px;', while to lengthen it, you would use 'text-decoration-inset: -10px.'.\n
In the JavaScript Iterator interface, the method Iterator.prototype.includes has been added to check for the presence of a specific element in the iterator.\n
In 'Origin trials' mode, a mechanism for Private Verification Tokens (PVT) has been implemented, allowing the separation of real users from bots through the transmission of anonymous tokens when opening sites in private browsing mode. This helps avoid the need for CAPTCHA requests, mandatory authentication, and tracking through cookies. The tokens reflect a successful prior authentication or anti-bot check (previously passed checks on one site can be used to connect to other sites without additional verifications). <\/ul>\n
In addition to new features and bug fixes, the new version resolves 108 vulnerabilities. 11 issues have been assigned a critical danger level, indicating that the vulnerabilities allow bypassing all browser protection layers and executing code in the system outside the sandbox environment. 4 critical issues were caused by accessing already freed memory (use-after-free) in AdFilter, WindowDialog, ServiceWorker, and the Fullscreen API, while 7 were due to buffer overflows in WebGL, ANGLE, and GPU-related code. <\/p>\n