ProHoster > Блог > izindaba ze-inthanethi > Ukukhishwa kwe-Chrome 145

Ukukhishwa kwe-Chrome 145

I-Google ikhiphe inguqulo 145 yesiphequluli sewebhu se-Chrome. Ukukhishwa okuzinzile kwephrojekthi ye-Chromium yomthombo ovulekile, isisekelo se-Chrome, nakho kuyatholakala. I-Chrome ihlukile ku-Chromium ngokusebenzisa kwayo ama-logo e-Google, uhlelo lwayo lwesaziso sokuphahlazeka, amamojula okudlala okuqukethwe kwevidiyo okuvikelwe ngamakhophi (i-DRM), ukufakwa kokuvuselelwa okuzenzakalelayo, ukuhlukaniswa kwe-sandbox okuhlala kuvuliwe, ukuhlinzekwa kwezihluthulelo ze-Google API, kanye nokusetshenziswa kwamapharamitha e-RLZ ngesikhathi sokusesha. Kulabo abadinga isikhathi esengeziwe sokubuyekeza, igatsha elihlukile le-Extended Stable ligcinwa amasonto ayisishiyagalombili. Ukukhishwa okulandelayo, i-Chrome 146, kuhlelelwe umhla ziyi-10 kuNdasa.

Izinguquko ezibalulekile ku-Chrome 145:

  • Kungezwe ukwesekwa kwefomethi yesithombe se-JPEG XL, okuqoshwe kusetshenziswa umtapo wezincwadi we-jxl-rs ngokusetshenziswa kwe-Rust kwe-JPEG-XL. Ukusekelwa kwe-JPEG XL okwamanje kukhutshaziwe ngokuzenzakalelayo futhi kudinga ukunika amandla ukulungiselelwa kwe-"chrome://flags/#enable-jxl-image-format".
  • Siqhubekile nokuthuthukisa imodi ye-AI, ekuvumela ukuthi usebenzisane ne-ejenti ye-AI kusuka kubha yekheli noma ekhasini eliboniswayo uma uvula ithebhu entsha. Imodi ye-AI ikuvumela ukuthi ubuze imibuzo eyinkimbinkimbi ngolimi lwemvelo futhi uthole izimpendulo ngokusekelwe ekuhlanganisweni kolwazi oluvela emakhasini afanele kakhulu esihlokweni esithile. Uma kudingeka, umsebenzisi angacacisa ulwazi ngemibuzo eholayo. Imodi ikuvumela futhi ukuthi ubuze imibuzo mayelana nokuqukethwe kwekhasi ngqo kusuka kubha yekheli. Ku-Chrome 145, imodi ye-AI iyatholakala ku-Android naku-iOS. Kubasebenzisi eCanada, eNdiya, naseNew Zealand, i-Gemini chatbot manje inikwe amandla ngokuzenzakalelayo (uma usebenzisa isiNgisi).
  • Indlela ye-DBSC (Device Bound Session Credentials) ingeziwe, okukuvumela ukuthi ubophe iseshini yokuqinisekisa iwebhusayithi kudivayisi ethile ukuze kube nzima ukuhlasela okuvela kwezinye izinhlelo usebenzisa amakhukhi weseshini avinjiwe. Isihloko se-HTTP esithi "Secure-Session-Registration" sihlongozwayo ekudaleni iseshini eboshwe yidivayisi. Le ndlela yokuvikela ihilela ukuhlinzeka ngamakhi amabili e-cryptographic aboshwe kudivayisi yamanje, akhiqizwa lapho kuxhunywa futhi agcinwe ku-TPM (Trusted Platform Module). Iseshini isebenzisa amakhukhi ahlala isikhathi esifushane, abuyekezwa njalo kusetshenziswa ukhiye oyimfihlo futhi angaqinisekiswa kusetshenziswa ukhiye womphakathi.
    Ukukhishwa kwe-Chrome 145
  • Isethingi evumela abasebenzisi ukuthi bakhubaze ukuvimba izengezo zesiphequluli eziphoqelelwe ezitholakale ziphula izinqubomgomo ezincane ze-Chrome Web Store isusiwe. Ukwephulwa okuncane kufaka phakathi ubuthakathaka obungaba khona, ukusunduza izengezo ngaphandle kolwazi lomsebenzisi, ukushintshwa kwemethadatha, ukwephulwa kwezinqubomgomo zedatha yomsebenzisi, kanye nokusebenza okudukisayo.
  • Kuhlobo lwe-Android, i-WebGPU Javascript API ikhutshaziwe uma i-Android Advanced Protection Mode (AAPM) ivuliwe. Amawebhusayithi asebenzisa i-WebGPU ukunikeza okuqukethwe kwe-3D (njenge-Google Maps) angasebenzisa ezinye izindlela ezihamba kancane, njenge-WebGL (ihamba kancane ngo-5.78% ezivivinyweni). Impahla ye-navigator.gpu ingasetshenziswa ukuthola ukuthi i-WebGPU ikhutshaziwe yini.
  • Kuhlobo lwe-Android, uma i-Enhanced Safe Browsing ivuliwe, ukuhlaziywa kwendawo kokubukeka kwekhasi lewebhu kuyasetshenziswa ukuze kutholakale izimpawu zokukhwabanisa. Uma ukuhlolwa kwendawo kwembula okuqukethwe okusolisayo okusolwayo, kwenziwa ukuhlolwa okwengeziwe kumaseva e-Google, futhi uma kuqinisekisiwe, isixwayiso siyaboniswa kumsebenzisi.
  • I-Origin API ingeziwe, inikeza into ye-Origin esebenzisa umqondo we-Web Origin futhi inikeza izindlela zokuqhathanisa, ukufaka i-serialing, kanye nokuhlaziya i-Web Origins. Igama elithi "Web Origin" lichazwa ku-RFC 6454 ukuze kuhlukaniswe phakathi kokuhlukaniswa kokuqukethwe kanye nemingcele yokwethembana. I-Web Origin ihlanganisa ingxenye ye-URL enegama lephrothokholi, igama lomphathi, kanye nenombolo ye-port (isb., https://opennet.ru). Le API entsha yethulwa ukuze ihlanganise imisebenzi ne-Web Origins futhi isuse ubuthakathaka obubangelwa ukuqhathanisa okungalungile kwezethulo ze-ASCII ezi-serialised ze-Web Origins lapho kunqunywa ukuthi izinsiza zingezasesayithini efanayo.
  • Amalungelo okufinyelela ohlelweni lwendawo lapho usebenzisana namasayithi omphakathi ahlukanisiwe. Izicelo ezivela kusayithi ziya ku Amakheli e-IP Izicelo zenethiwekhi yendawo (ikheli le-intranet noma langaphakathi) kanye ne-loopback interface (127.0.0.0/8) manje sezicutshungulwa kusetshenziswa izimvume ezahlukene (inethiwekhi yendawo kanye nenethiwekhi ye-loopback), okudinga umsebenzisi ukuthi aqinisekise ukusebenza ebhokisini lengxoxo elikhethekile. Imizamo yokulanda izinsiza, izicelo zokulanda (), kanye nokufakwa kwe-iframe imbozwe ukuvikelwa. Abahlaseli basebenzisa izicelo zezinsiza zangaphakathi ukwenza ukuhlaselwa kwe-CSRF kuma-router, izindawo zokufinyelela, amaphrinta, izixhumanisi zewebhu zezinkampani, kanye namanye amadivayisi nezinsizakalo ezamukela izicelo ezivela kunethiwekhi yendawo kuphela. Ngaphezu kwalokho, ukuskena izinsiza zangaphakathi kungasetshenziswa ukuhlonza okungaqondile noma ukuqoqa ulwazi mayelana nenethiwekhi yendawo.
  • Isethingi ye-UserAgentReduction, evumele isiphequluli ukuthi sibuyele kusihloko sokuqala se-User-Agent HTTP kanye namapharamitha e-JavaScript i-navigator.userAgent, i-navigator.appVersion, kanye ne-navigator.platform, isusiwe. Isiphequluli manje sihlala sithumela isihloko se-User-Agent esincishisiwe ngaphandle kolwazi oluningiliziwe lweplatifomu (isb., "Android 16; S" esikhundleni se-"Android 16; SM-A205U").
  • Isibukeli se-PDF esakhelwe ngaphakathi manje sisekela ukulondolozwa kwamadokhumenti kusitoreji samafu se-Google Drayivu. Ku-Google Drayivu, amadokhumenti avela ku-Chrome agcinwa kufolda ethi "Okulondoloziwe kusuka ku-Chrome".
  • I-LayoutShift API, elandelela izinguquko endaweni yezinto ze-DOM esikrinini, ishintshelwe ekuboniseni ulwazi kumaphikseli e-CSS esikhundleni samaphikseli esikrini. Amaphikseli e-CSS acabangela i-DPI yesikrini futhi ahambisana ngokubonakalayo kuzo zonke izikrini, kufaka phakathi amamonitha anobuningi bamaphikseli aphezulu. Lolu shintsho lwenziwe ukuze kuvumelaniswe i-Chrome nezinye iziphequluli.
  • Indlela ye-WebRequest.SecurityInfo isetshenziswe ku-Controlled Frame API, okuvumela uhlelo lokusebenza lwewebhu ukuthi lubambe isicelo se-HTTPS, i-WSS, noma i-WebTransport kuseva futhi luthole isitifiketi somunwe. iseva futhi uyisebenzisele ukuqinisekisa ngesandla isitifiketi esisetshenziselwa ukuxhumana okuqondile neseva efanayo nge-TCP/UDP.
  • Kungezwe ukwesekwa kwezakhiwo ze-CSS ze-column-wrap kanye ne-column-height ezichazwe ku-CSS Multi-column Layout 2 specification. Impahla ye-column-wrap ivumela amakholomu ukuthi asonge emgqeni omusha esikhundleni sokuskrola ngokuvundlile uma amakholomu engangeni ngaphakathi kokuphakama okuchazwe yimpahla ye-column-height.
  • Kwengezwe impahla ye-CSS ethi text-justify, ekuvumela ukuthi ucacise uhlobo lokuqondanisa umbhalo uma usebenzisa i-"text-align: justify";
  • Izakhiwo ze-CSS zokuhlukanisa izinhlamvu kanye nezikhala zamagama zikuvumela ukuthi ucacise usayizi wokungena njengephesenti.
  • Izinto ze-JavaScript Map kanye ne-WeakMap zisebenzisa incazelo ethi "upsert", zenza umsebenzi ube lula ngamaqoqo ezibhangqa ze-key/value. Izindlela ze-getOrInsert kanye ne-getOrInsertComputed zengeziwe, zibuyisela inani elivele likhona eqoqweni elihlotshaniswa ne-key ecacisiwe noma zidala okufakiwe okusha uma i-key ingatholakali.
  • Ukuqaliswa kwe-IndexedDB API kubhalwe kabusha kusetshenziswa isizindalwazi se-SQLite njenge-backend (ukuqaliswa kwangaphambilini kuncike ku-LevelDB kumafayela ahlukene). Ukuqaliswa okusha okwamanje kusetshenziswa kuphela ezimweni ezikwimemori, njengakwimodi ye-incognito.
  • Kuthuthukiswe amathuluzi onjiniyela bewebhu. Ikhono lokunciphisa isivinini sezicelo zenethiwekhi ngazinye manje selivuliwe ngokuzenzakalelayo kuphaneli ethi "Izimo Zesicelo" yesixhumi esibonakalayo sokuhlola inethiwekhi.

Ngaphezu kwezici ezintsha nokulungiswa kwamaphutha, inguqulo entsha ibhekana nobuthakathaka obuyi-11. Ubuthakathaka obuningi butholakale ngokuhlola okuzenzakalelayo kusetshenziswa i-AddressSanitizer, i-MemorySanitizer, i-Control Flow Integrity, i-LibFuzzer, kanye ne-AFL. Azikho izinkinga ezibalulekile ezingavumela ukudlula zonke izendlalelo zokuvikela isiphequluli kanye nokusebenzisa ikhodi ngaphandle kwendawo ye-sandbox ezitholiwe. Njengengxenye yohlelo lwayo lwe-vulnency bounty lokukhishwa kwamanje, i-Google isungule imiklomelo eyi-11 futhi inikeze u-$18,500 (umvuzo owodwa ngamunye ongu-$8000, $5000, $2000, kanye no-$500, kanye nemivuzo emithathu engu-$1000). Inani lemiklomelo emine alikakanqunywa.

Source: opennet.ru