Chrome 85 released with security fixes, app shortcuts, AVIF support

Google has released Chrome 85 today, August 25th, 2020, to the Stable desktop channel, and it includes numerous security enhancements, features, and APIs for developers.

Chrome 85 is a massive release with numerous features, including a QR code generator, AVIF image support, better protection from mixed content downloads, further securing of same-site cookies, and app shortcuts for PWAs.

With Chrome 85 now being promoted to the Stable channel, Chrome 86 will soon be promoted to the Beta version, and Chrome 87 will be the Canary version.

Windows, Mac, and Linux desktop users can upgrade to Chrome 85 by going to Settings -> Help -> About Google Chrome. The browser will then automatically check for the new update and install it when available.

Faster page loads

Google Chrome 85 is now delivering up to 10% faster page loads using a new compiler optimization technique known as Profile Guided Optimization (PGO).

"Because PGO uses real usage scenarios that match the workflows of Chrome users around the world, the most common tasks get prioritized and made faster," Chrome Engineering Director Max Christoff said today.

"Our testing consistently shows pages loading up to 10% faster at the median, and even greater speed improvements when your CPU is tasked with running many tabs or programs."

PGO makes it possible for the browser's most performance-critical code to run faster which translates into users being able to notice a speed boost while browsing the Internet.

Based on the First Contentful Paint perceived load speed metric and the Speedometer browser benchmark, PGO leads up to increases of up to 3.5% and 11.4%, respectively, as well as a 7.3% rise in overall browser responsiveness.

AVIF image support

With the release of Chrome 85, users now get built-in AVIF image support.

The AV1 Image File Format (AVIF) compresses images using the AV1 codec and has been found to dramatically reduce imagesizes without a significant loss in quality.

In tests conducted by Netflix using AVIF images for show art, they found that AVIF can significantly reduce a file's size while retaining high-level image detail.

"Reduce bandwidth consumption to load pages faster and reduce overall data consumption: AVIF offers significant file size reduction for images compared with JPEG or WebP. Prior to full optimization, Netflix published results on their test set showing ~50% savings vs JPEG across use cases, going past 60% for 4:4:4 content," Google explains in the AVIF Chrome status page.

As AVIF also supporta modern features such as high dynamic range (HDR) and sites such as Netflix, YouTube, and Facebook have shown interest in its use, Google decided to add built-in support for the file format.

To test if your browser supports AVIF images, you can use this test page.

Chrome 85 blocks more mixed content downloads

In April 2019, we reported that Google was beginning a rolled-out plan to block mixed content downloads in Chrome.

Mixed content downloads are files delivered over insecure HTTP connection when they are first initiated from HTTPS websites.

Google Chrome first started displaying warnings in the Chrome console to alert developers that these downloads would be blocked in future versions.

With this release, Chrome will display a visual warning when downloading mixed content audio, video, images, and ext files.

These files include .png, .gif, .jpg, .mp4, etc.

Google Chrome will also block mixed content files that are considered non-safe as they can be abused to deliver malware or other malicious activity.

These files consist of .pdf, .doc, .docx, .xls, etc.

Starting Chrome 86, Google Chrome will begin blocking all mixed content downloads.

You can test this feature using our mixed content download PoC page.

App shortcuts added

Chrome 85 introduces app shortcuts for progressive web apps (PWA) so that users can quickly access commonly used tasks.

When enabled, if a user taps and holds a PWA icon or right-clicks on it, the operating system will display various tasks that can automatically be launched using that web app.

App shortcuts are now active in Microsoft Edge 85 as well.

QR code generator for web pages 

Chrome 85 now comes with a QR code generator to help you easily share your favorite web sites.

When you right on a page, you will see a new context-menu option title 'Create QR code for this page."

When you select it, the browser will generate and display a QR code that you can then share with others.

If a mobile device's camera scans that QR code, it will automatically open the page.

User-Agent Client Hints not enabled in Chrome 85

Google has initially planned to enable a new feature called 'User-Agent Client Hints' in Chrome 85, but due to the COVID-19 pandemic, it has chosen to delay it until 2021.

This feature is designed to reduce user agent strings' complexity and prevent web sites from identifying a user based on the information contained in these strings.

When ultimately enabled, User-Agent Client Hints will freeze a browser's user agent so that it contains a sanitized string

"You can test a version of this by enabling the chrome://flags/#freeze-user-agent flag from Chrome 84. This will return a string with the historical entries for compatibility reasons, but with sanitized specifics," Google explains.

An example user agent string will be:

Mozilla/5.0 (Linux; Android 9; Unspecified Device) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.0.0 Mobile Safari/537.36

Segment heap tests disabled in Chrome 85

With the release of Windows 10 version 2004, Microsoft introduced an easy way for applications to use a new memory optimization feature called 'Segment heaps.'

In Microsoft's tests, they initially found it to reduce memory usage in Microsoft Edge.

After seeing these tests, Google began testing this feature in Google Chrome running on Windows 10 2004.

After two weeks of testing this feature, Google determined that while there were significant savings in memory usage, there was also an increase in CPU utilization.

This tradeoff ultimately led to a decrease in Google Chrome performance, and Google is disabling the test in this release.

Google plans on testing this further to see if it can be enabled again without performance degradation.

New developer features released

Chrome 85 comes with numerous developer features for designing websites and communicating with client hardware.

Some of the new features included are:

• Addition of the Clipboard API feature policy that prevents unauthorized use by iframes.
• Add support for the 'page' CSS property as well as named pages.
• Enhanced support for BlueTooth devices, including allowing websites to discover compatible devices or if they are in range. 
• Adds the logical assignment operators ||=, &&=, and ??= to JavaScript.
• Further securing of same-site cookies [1,2].

The Chrome 85 release also includes numerous patch for security vulnerabilities.

The list of vulnerabilities have not been published yet and this article will be updated when it is released.

We do know that a remote code execution vulnerability in WebGL was fixed in this release and disclosed by Cisco Talos yesterday.