Chromium Blog: beta

Chrome 103 Beta: Early Navigation Hints, a Host of Completed Origin Trials, and More

Thursday, May 26, 2022

Completed Origin TrialsThe following features, previously in a Chrome origin trial, are now enabled by default.Local Font AccessWeb applications can now enumerate local fonts and metadata about each. The new API also gives web applications access to table data stored within local fonts, allowing those fonts to be rendered within their applications using custom text stacks.Note: The Chrome 102 beta post erroneously listed this feature as shipping in that version.Same-Origin Prerendering Triggered by the Speculation Rules APIPrerendering loads a web page before it is needed, so that when the actual navigation to that page occurs, it can be shown instantly. To speed up page loads. Chrome's previous prerender mechanism is now replaced with No State Prefetch. No State Prefetch doesn't generally result in an instant page load experience, but the new feature does. This feature is supported on Android only.Update User-Agent Client Hints GREASE ImplementationThe implementation of GREASE in User Agent Client Hints is now aligned with the current spec, which includes additional GREASE characters beyond the current semicolon and space, and which recommends varying the arbitrary version. This helps prevent bad assumptions from being built on top of User-Agent strings.Other Features in this ReleaseAbortSignal.timeout() Static MethodReturns a new AbortSignal object that is automatically aborted after a given number of milliseconds. Use this method to easily implement timeouts for signal-accepting asynchronous APIs, such as fetch(). For example:

fetch(url, { signal: AbortSignal.timeout(10_000) });ARIA Attribute Reflection for the role AttributeThe Element and ElementInternal interfaces now include an ARIA property called ariaRoleDescription which returns or modifies the ARIA role attribute directly. This feature is only supported on desktop.avif is Now a Permitted Web Share File ExtensionThe avif image file format is now sharable by Web Share. Adding avif to the other allowed image file types helps spread the use of it. A website might like their users to be able to share pictures and other files through social media, email, chat, etc. The Web Share API is already shipped to more platforms such as ChromeOS and Windows, but avif is not supported yet."deflate-raw" Compression FormatChrome supports a new compression format, deflate-raw, to give web developers access to the raw deflate stream without any headers or footers. This is needed, for example, to read and write zip files.form rel AttributeThe 'rel' attribute has been added to form elements. This makes it possible to prevent window.opener from being present on websites navigated to by form elements which have rel=noopener. It also prevents the referer header from being sent with rel=noreferrer.popstate Fires Before LoadChromium now matches Firefox and by firing popstate immediately after URL changes so that the order of events is now popstate then hashchange across both platforms. Before this change, Chromium fired hashchange asynchronously after a task, and delayed popstate until the load event. This means the event order could be either hashchange then popstate, or popstate then hashchange, depending on how long a document took to load. Restrict Gamepad UsageThe Gampepad API now requires a secure context. Additionally a new feature policy called 'gamepad' has been added with a default allowlist of 'self'.SerialPort forget()The SerialPort forget() method allows web developers to voluntarily revoke a permission to a serial port that was granted by a user. Some sites may not be interested in retaining long-term permissions to access serial ports. For example, for an educational web application used on a shared computer with many devices, a large number of accumulated user-generated permissions creates a poor user experience.

In addition to user agent mitigations to avoid this problem, such as defaulting to a session scoped permission on the first request or expiring infrequently used permissions, it should be possible for the site itself to clean up user-generated permissions it no longer needs.This follows the recent additions of a forget() method for the HIDDevice and USBDevice interfaces.Support visual-box on overflow-clip-marginThe overflow-clip-margin CSS property now supports visual-box, which specifies the box edge to use as the overflow clip edge origin. Valid values are content-box, padding-box (the default), or border-box. The overflow-clip-margin property specifies how far an element's content is allowed to paint before being clipped. User Activation Required for SPC Credential EnrollmentA user activation requirement has been added for Secure Payment Confirmation credential enrollment in a cross-origin iframe. This is being done to help mitigate a privacy issue.Deprecations, and RemovalsThis version of Chrome introduces the deprecations and removals listed below. Visit ChromeStatus.com for lists of current deprecations and previous removals.Block External Protocol in Sandboxed iframeSandboxed iframes are not blocked from opening external applications. Currently, developers sandbox untrusted content and block user navigation. Blocking probably should have also included links to external apps or to the Play store. This has now been fixed. Sites that need navigation can add the following values to the <iframe> element's sandbox property:

allow-popups

allow-top-navigation

allow-top-navigation-with-user-activation

Remove Battery Status API on Insecure OriginsThe Battery Status API is no longer supported on insecure contexts, specifically HTTP pages and HTTPS iframes embedded in HTTP pages. This is being removed in accordance with our policy of deprecating powerful features on insecure origins, This also follows a spec change.Remove <param> ElementGiven the removal of plugins from the web platform, and the relative lack of use of <param>, it is being removed from the web platform.Posted by Joseph Medley

Chrome 102: Window Controls Overlay, a Host of Finished Origin Trials, PWAs as File Handlers and More

Thursday, April 28, 2022

Completed Origin TrialsThe following features, previously in a Chrome origin trial, are now enabled by default. Origin trials allow you to try new features and give feedback on usability, practicality, and effectiveness to the web standards community. To register for any of the origin trials currently supported in Chrome, including the ones described below, visit the Chrome Origin Trials dashboard. To learn more about origin trials in Chrome, visit the Origin Trials Guide for Web Developers. Microsoft Edge runs its own origin trials separate from Chrome. To learn more, see the Microsoft Edge Origin Trials Developer Console.Capture HandleA new mechanism allows an application to opt-in to exposing information to applications that are video-capturing it. This allows collaboration between capturing and captured applications. For example, a video conference application that's video-capturing a presentation, could expose user-facing controls in the video conference tab for navigating the presentation in the captured tab.Network State PartitioningNetwork state is now partitioned by the network partition key (which consists of top frame site and possibly frame site), to protect against cross-site tracking through the use of side channels. "Network State" here includes connections (H1, H2, H3, websocket), the DNS cache, ALPN/H2 support data, TLS/H3 resumption information, Reporting/NEL configuration and uploads, and Expect-CT information. Cross-site tracking is a major privacy concern for users. This is a necessary part of addressing the problem.Speculation RulesSpeculation rules provides a flexible syntax for defining what outgoing links are eligible to be prefetched before navigation. It also enables additional enhancements, such as use of a private prefetch proxy, where applicable.Subresource loading with Web BundlesThis feature provides a new approach to loading a large number of resources efficiently using a format that allows multiple resources to be bundled, e.g. Web Bundles.Other Features in this ReleaseFile Handlers Web App Manifest MemberFile Handling provides a way for web applications to declare the ability to handle files with given MIME types and extensions. The web application will receive an event when the user intends to open a file with that web application.To define a PWA as a file handler, add the file_handlers member to the Web App Manifest. You can read about its members in the spec.inert AttributeThe new inert attribute lets you mark parts of the DOM tree as inert. When a node is inert:

Hit-testing must act as if the pointer-events CSS property were set to 'none'.

Text selection functionality must act as if the user-select CSS property were set to 'none'.

If it is editable, the node behaves as if it were non-editable.

The user agent may ignore the node for the purposes of find-in-page.

For more information, see Introducing inert.Local Font AccessWeb applications can now enumerate local fonts and metadata about each. The new API also gives web applications access to table data stored within local fonts, allowing those fonts to be rendered within their applications using custom text stacks.Notes: This feature actually shipped in 103 instead of 102 as originally reported.Navigation APIThe new Navigation interface (accessible on window) lets apps intercept and initiate navigations, and introspect an application's history entries. This provides a more useful alternative to window.history and window.location specifically aimed at the needs of single-page web applications.New until-found Value for the hidden AttributeChrome adds a new value, until-found, for the hidden attribute, which makes an element searchable by find-in-page, scroll to text fragment, and fragment navigation. When these search/navigation features want to scroll to something inside a hidden=until-found element, the browser removes the hidden attribute from the element and fires the beforematch event on it so that the newly revealed content can be scrolled into view. For more information, see Making collapsed content accessible with hidden=until-found - Chrome Developers.Origin Private File System extension: AccessHandleThe Origin Private File System (part of the File System Access API) is augmented with a new surface that improves the performance of data access. This new surface differs from existing ones by offering in-place and exclusive write access to a file's content. This change, along with the ability to consistently read unflushed modifications and the availability of a synchronous variant on dedicated workers, significantly improves performance and unblocks new use cases.Private Network Access Preflight Requests for SubresourcesA CORS preflight request is now sent ahead of schedule for private network requests for subresources, requesting explicit permission from the target server. If the preflight fails, a warning is displayed in DevTools but the request proceeds as before. This is not expected to be a breaking change. Websites whose servers ignore or fail the new preflight request will continue to work as before.A private network request is any request from a public website to a private IP address or localhost, or from a private website (e.g. intranet) to localhost. Sending a preflight request mitigates the risk of cross-site request forgery attacks against private network devices such as routers, which are often not prepared to defend against this threat.Secure Payment Confirmation API ChangesThis release contains three changes to the Secure Payment Confirmation API, specifically to the data passed to the PaymentMethod() constructor.

A new required property, data.rpId, which should contain the relying party ID. Implementations that don't currently specify this will need to be updated.

A new optional property, data.instrument.iconMustBeShown, allows a placeholder icon to be used when the card art icon cannot be downloaded. Setting this field to false allows a payment to proceed when the icon can be downloaded. The default is true.

A new optional property, data.payeeName, allows callers to display a natural name for the payee instead of or alongside the existing data.payeeOrigin.

WebHID exclusionFilters Option in requestDevice()The options object passed HID.requestDevice() now includes an exclusionFilters property. (HID is accessed via navigator.hid.) This property lets you exclude some devices from the browser picker. You can use it to exclude devices that are known to be malfunctioning. Previously, developers had to test a selected device with custom code, then ask the user to pick another if the selected device did not work. The exclusionFilters property (you will need to search for that term in the text) is an array of objects with the same members as the existing options. Here's an example of how to use the requestDevice() options argument. The example first requests access to a device with vendor ID 0xABCD. The device must also have a collection with usage page Consumer (0x000C) and usage ID Consumer Control (0x0001). The device with product ID 0x1234 is malfunctioning.const [device] = await navigator.hid.requestDevice({ filters: [{ vendorId: 0xabcd, usagePage: 0x000c, usage: 0x0001 }], exclusionFilters: [{ vendorId: 0xabcd, productId: 0x1234 }], }); Deprecations, and RemovalsThis version of Chrome introduces the deprecations and removals listed below. Visit ChromeStatus.com for lists of current deprecations and previous removals.Deprecate PaymentRequest.show() without User ActivationSites can no longer call PaymentRequest.show() without a user activation. Allowing PaymentRequest.show() to be triggered without a user activation could be abused by malicious websites. To protect users, the spec was changed to require user activation. To avoid a broken purchase experience, calls to this method should now be inside a user event such as click.Firefox has not shipped PaymentRequest at all, while Safari's implementation already requires user activation for calling show().Remove SDP Plan BThe Session Description Protocol (SDP) used to establish a session in WebRTC has been implemented with two different dialects in Chromium: Unified Plan and Plan B. Plan B is not cross-browser compatible and is hereby removed. In this version of Chrome an exception will be thrown when Plan B is used. Developers needing to avoid the exception can participate in a deprecation trial until May 25, 2022. If you participated in the previous deprecation trial that ended in December, and want to participate in the current trial, you will need to request a new token.

Chrome 101: Federated Credential Management Origin Trial, Media Capabilities for WebRTC, and More

Thursday, March 31, 2022

A relying party ID that is a required input. Because this is required, existing code will need to be updated.

An optional boolean to allow failed instrument icon download.

A payeeName property as an optional input.

USBDevice forget()The USBDevice forget() method allows web developers to voluntarily revoke a permission to a USBDevice that was granted by a user.WebUSB sameObject BehaviorUSBConfiguration, USBInterface, USBAlternateInterface, and USBEndpoint instances are now only strictly equal ("===") when they are retrieved from accessors on the same USBDevice.Deprecations, and RemovalsThis version of Chrome introduces the deprecations and removals listed below. Visit ChromeStatus.com for lists of current deprecations and previous removals.Remove WebSQL in Third-Party ContextsWebSQL in third-party contexts is now removed. The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. Gecko never implemented this feature and WebKit deprecated it in 2019. The W3C encourages Web Storage and Indexed Database for those needing alternatives.Developers should expect that WebSQL itself will be deprecated and removed when usage is low enough.

Chrome 100 Beta: Reduced User-Agent Strings, Multi-Screen Window Placement, and More

Thursday, March 3, 2022

A slideshow app presenting on a projector, while showing speaker notes on a laptop screen.

A financial app opening a dashboard of windows across multiple monitors.

A medical app opening images (for example, x-rays) on a high-resolution grayscale display.

A creativity app showing secondary windows (for example, a palette) on a separate screen.

Multi-screen layouts in gaming, signage, artistic, and other types of apps.

For more information, see Managing several displays with the Multi-Screen Window Placement API. Origin TrialsThis version of Chrome introduces the origin trials described below. Origin trials allow you to try new features and give feedback on usability, practicality, and effectiveness to the web standards community. To register for any of the origin trials currently supported in Chrome, including the ones described below, visit the Chrome Origin Trials dashboard. To learn more about origin trials in Chrome, visit the Origin Trials Guide for Web Developers. Microsoft Edge runs its own origin trials separate from Chrome. To learn more, see the Microsoft Edge Origin Trials Developer Console. Continuing Origin TrialsThe following origin trial is being extended to the listed version.Media Source Extensions in WorkersChrome is continuing an origin trial for making the Media Source Extensions (MSE) API available from dedicated workers. This feature improves performance when buffering playing media in an HTMLMediaElement on the main Window. By creating a MediaSource object in a dedicated worker, an application may then create an ObjectURL for it and call postMessage() to pass that URL to the main thread for attaching to an HTMLMediaElement. The context that created the MediaSource object may then use it to buffer media. Web authors have consistently requested that MSE be available from Worker contexts. This extended origin trial is expected to end in Chrome 103, in late July 2022.Completed Origin TrialsThe following feature, previously in a Chrome origin trial, is now enabled by default.Digital Goods APIChrome now provides an API for querying and managing digital products to facilitate in-app purchases from web applications. The new API works with the Payment Request API, which is used for the actual purchases. The API can be linked to a digital distribution service connected through the user agent. In Chromium, this is specifically a web API wrapper around the Android Play Billing API.This API lets web apps in the Play Store accept purchases for digital goods. (Play policies prevent them from accepting payment via any other method.) Without this, websites that sell digital goods are not installable through the Play Store.For more information, see Receive Payments via Google Play Billing with the Digital Goods API and the Payment Request API - Chrome Developers.Other Features in this ReleaseAbortSignal.prototype.throwIfAborted()Chrome now throws an AbortSignal object's reason if the signal is aborted. This convenience method allows signal-handling functions to check a signal's abort status and propagate the abort reason. For example, it could be called after asynchronous operations that might change a signal's state.Abort signal handling functions often need to check the signal's status and propagate the error if the signal has been aborted. This provides a convenient and consistent way to do this. An example is already available on MDN.Capability DelegationCapability delegation means allowing a frame to relinquish its ability to call a restricted API and transfer that ability to a (sub) frame it trusts. If an app wants to delegate its ability to call a restricted JavaScript feature (for example, popups, or fullscreen) to a known and trusted third-party frame, this API allows it to transfer this ability to the target frame for a specified period. This is in contrast to static mechanisms such as an iframe's allow attributes. Many merchant websites host their online store on their own domain but outsource the payment collection and processing infrastructure to a payment service provider (PSP) to comply with security and regulatory complexities around card payments. This workflow is implemented as a "pay" button inside the top (merchant) frame where it can blend better with the rest of the merchant's website, and payment request code inside a cross-origin iframe from the PSP. The Payment Request API used by the PSP code is gated by transient user activation (to prevent malicious attempts like unattended or repeated payment requests). Because the top (merchant) frame's user interaction is not visible to the iframe, the PSP code needs to delegate in response to a click in the top frame before it can start payment processing.HIDDevice forget()The HIDDevice forget() method allows web developers to voluntarily revoke a permission to an HIDDevice that was granted by a user. Some sites may not be interested in retaining long-term permissions to access HID devices. For example, for an educational web application used on a shared computer with many devices, a large number of accumulated user-generated permissions creates a poor user experience.

In addition to user agent mitigations to avoid this problem, such as defaulting to a session scoped permission on the first request or expiring infrequently used permissions, it should be possible for the site itself to clean up user-generated permissions it no longer needs.mix-blend-mode: "plus-lighter"The mix-blend-mode property now supports the "plus-lighter" value, which adds the source and destination colors multiplied by their respective alphas. This operation is useful when crossfading between two elements that contain common pixels. In that case, "plus-lighter" ensures that the common pixels do not change in appearance as opacity changes from 0 to 1 on one element and from 1 to 0 on the other.Sec-CH-UA-WoW64 Client HintThis hint serves solely as a backwards compatible shim for sites relying on "WoW64-ness" (32-bit apps running in 64-bit Windows) as they transition from the User-Agent string to UA-CH. It returns a boolean value.SerialPort Integration with WritableStream Controller's Abort SignalWhen using WritableStream, serial ports can now be closed without waiting for all write operations to finish. If the port is waiting for the peer device to provide a flow control signal it could be blocked indefinitely. The intent of aborting a WritableStream is to immediately stop writing data to the underlying sink. TLS ALPN Extension in wss-schemed WebSockets ConnectionsThe TLS ALPN extension is now included when initiating a new connection for wss-schemed WebSockets, offering just the default "http/1.1" protocol. Currently, unlike HTTPS connections, such connections do not offer ALPN at all. Changing this aligns with Firefox and Safari, hardens against cross-protocol attacks (ALPACA, for example), and makes wss eligible for the false start optimization. It also simplifies work on the HTTPS DNS record.Web NFC: NDEFReader makeReadOnly()The NDEFReader makeReadOnly() method allows web developers to make NFC tags permanently read-only with Web NFC.WebTransport serverCertificateHashes OptionIn WebTransport, the serverCertificateHashes option allows a website to connect to a web transport server by authenticating the certificate against the expected certificate hash instead of using the Web public key infrastructure (PKI).This feature allows Web developers to connect to WebTransport servers that would normally find obtaining a publicly trusted certificate challenging, such as hosts that are not publically routable, or virtual machines that are ephemeral in nature.Deprecations, and RemovalsThis version of Chrome has only one deprecation, described at the top of this article.
Visit ChromeStatus.com for lists of ongoing deprecations and previous removals.

Chrome 99: CSS Cascade Layers, a New Picker for Input Elements, and More

Thursday, February 3, 2022

Developers have been asking for years for a way to programmatically open a browser date picker. Without it, they've had to rely on custom widget libraries and CSS hacks for specific browsers.This is currently possible in some browsers, for some controls, via the click() method. Unfortunately, that doesn't work in all browsers, making the experience inconsistent across systems and users. Providing showPicker() gives developers a supported alternative to click(), and aligns Chromium's click() behavior with the specification and other browsers in in the future. For more information, see Show a browser picker for date, time, color, and files.Origin TrialsThis version of Chrome introduces the origin trials described below. Origin trials allow you to try new features and give feedback on usability, practicality, and effectiveness to the web standards community. To register for any of the origin trials currently supported in Chrome, including the ones described below, visit the Chrome Origin Trials dashboard. To learn more about origin trials in Chrome, visit the Origin Trials Guide for Web Developers. Microsoft Edge runs its own origin trials separate from Chrome. To learn more, see the Microsoft Edge Origin Trials Developer Console. New Origin TrialsDark Mode Support for Web AppsWeb app manifests now support the color_scheme_dark field for specifying a different theme color and background color for dark mode. Currently in the web app manifest, only a single theme color and background color can be defined. This means there is no way for apps to specify a different color to use for dark mode. Completed Origin TrialsThe following features, previously in a Chrome origin trial, are now enabled by default.Handwriting Recognition APIThis API lets web applications use handwriting recognition services that are available on operating systems to recognize hand-written text in real time. This reduces the need for third-party integration by apps that use handwriting recognition. For more information, see Recognize your users' handwriting.Window Controls Overlay for Installed Desktop Web AppsWindow controls overlay extends an app's client area to cover the entire window, including the title bar, and the window control buttons (close, maximize/restore, minimize). The web app developer is responsible for drawing and input-handling for the entire window except for the window controls overlay. Developers can use this feature to make their installed desktop web apps look like operating system apps. For more information, see Customize the window controls overlay of your PWA's title bar.Other Features in this ReleaseAllow infinity, -infinity and NaN in CSS calc()To improve conformance with the spec, the CSS calc() method now allows infinity and NaN using the 'infinity', '-infinity', and 'NaN' keywords or expressions that can be evaluated as such, for example: 'calc(1/0)'.CSS Color Adjust: 'only' Keyword for color-schemeNote: This feature was erroneously listed as shipping in Chrome 98. It actually shipped in Chrome 99.The only keyword, which has been re-added to the specification for color-scheme, is now supported in Chrome. It allows opting out of color-scheme for single, specific elements. For example, this allows overriding of force darkening. A few examples illustrate its use.div { color-scheme: light } This forces the div element out of color-scheme dark.div { color-scheme: only light } This keeps the color-scheme for the element light as above, and opts it out of forced darkening by the user agent.document.adoptedStyleSheets is Now MutableIn compliance with the spec, the document.adoptedStyleSheets property is now mutable, meaning operations such as push() and pop() work on it. The previous implementation of adoptedStyleSheets was unwieldy. For example, to add a sheet, the entire array had to be re-assigned:document.adoptedStyleSheets = [...adoptedStyleSheets, newSheet]; With the new implementation, the same operation looks like this:document.adoptedStyleSheets.push(newSheet); Note: Previously, this feature was incorrectly listed as shipping in Chrome 98.Improve Alignment with Spec for Exposing nextHopProtocol Across Origin BoundariesThe PerformanceResourceTiming interface exposes the nextHopProtocol property to describe the underlying connection type used to fetch a resource. To follow the spec, Chrome is removing an old special case where cross-origin requests exposed potentially sensitive information, putting users at risk.New Canvas 2D FeaturesChrome has added several new attributes to the CanvasRenderingContext2D interface to conform to specs:

ContextLost and ContextRestored events

"willReadFrequently" option for canvases where lots of readback is expected

More CSS text modifier support

A reset() method

A roundRect draw primitive

Conic gradients

Better support for SVG filters

For more information, see It's always been you Canvas2D.Unprefixed text-emphasis PropertiesChrome 99 introduces unprefixed versions of text emphasis CSS properties, specifically: "text-emphasis", "text-emphasis-color", "text-emphasis-position", and "text-emphasis-style" CSS properties. These are unprefixed versions of "-webkit-text-emphasis", "-webkit-text-emphasis-color", "-webkit-text-emphasis-position", and "-webkit-text-emphasis-style".Deprecations, and RemovalsThis version of Chrome introduces the deprecations and removals listed below. Visit ChromeStatus.com for lists of current deprecations and previous removals.Remove Battery Status API on Insecure OriginsBattery Status API is no longer supported on insecure origins, such as HTTP pages or HTTPS iframes embedded in HTTP pages. The Battery Status API allows web developers to access, among other things, a system's battery charging level and whether it is being charged. It is a powerful feature that has been around for over a decade and, as such, was originally designed with different security constraints.Remove font-family -webkit-standardThis version of Chrome removes support for the font-family value "-webkit-standard". This value is merely an alias for the proprietary keyword "-webkit-body" and is only exposed because it's inherited from WebKit. Removing this improves alignment with the CSS specifications and with Firefox.Remove GamepadListThe navigator.getGamepads() method now returns an array of Gamepad objects instead of a GamepadList. GamepadList is no longer supported in Chrome. This brings Chrome in line with spec and with Gecko and Webkit. For information on Gamepads generally, see Play the Chrome dino game with your gamepad.
Update WebCodecs to Match SpecChrome has removed two items because of recent changes in the WebCodecs spec..

The EncodedVideoChunkOutputCallback() method takes an EncodedVideoChunkMetadata dictionary. Previously a member called temporalLayerId was located at EncodedVideoChunkMetadata.temporalLayerId. In conformance with the spec, it is now located at EncodedVideoChunkMetadata.SvcOutputMetadata.temporalLayerId.

The spec requires that the VideoFrame() constructor include a timestamp argument (VideoFrameInit.timestamp) for CanvasImageSource types that don't implicitly have a timestamp (e.g. HTMLCanvasElement). Failing to include the timestamp should result in a TypeError, but Chrome previously defaulted the timestamp to zero. This seems helpful, but is problematic if you then send the VideoFrame to a VideoEncoder, where timestamps are used to guide bitrate control.

Chrome 98 Beta: Color Gradient Vector Fonts, Region Capture Origin Trial, and More

Monday, January 10, 2022

Two national park emojis, one crisp, one blurry and a bar chart comparing binary size of Noto Emoji as Bitmap font and as COLRv1 font, about 9MB
vs. 1.85MB

Crisp COLRv1 vector font (left) compared to a bitmap font (right).
Noto Emoji font size as bitmap font vs. COLRv1 font after WOFF2 compression.

For more information, see COLRv1 Color Gradient Vector Fonts in Chrome 98.Preparing for a Three Digit Version NumberThis year, Chrome will release version 100, adding a digit to the version number reported in Chrome's user agent string. To help site owners test for the new string, Chrome 96 introduced a runtime flag that causes Chrome to return '100' in its user agent string. This new flag called chrome://flags/#force-major-version-to-100 has been available from Chrome 96 onward. For more information, see Force Chrome major version to 100 in the User-Agent string.Origin TrialsThis version of Chrome introduces the origin trials described below. Origin trials allow you to try new features and give feedback on usability, practicality, and effectiveness to the web standards community. To register for any of the origin trials currently supported in Chrome, including the ones described below, visit the Chrome Origin Trials dashboard. To learn more about origin trials in Chrome, visit the Origin Trials Guide for Web Developers. Microsoft Edge runs its own origin trials separate from Chrome. To learn more, see the Microsoft Edge Origin Trials Developer Console. New Origin TrialRegion CaptureRegion Capture is an API for cropping a self-capture video track. Applications can currently obtain a capture of the tab in which they run using getDisplayMedia(), either with or without preferCurrentTab. In this case, the application may want to crop the resulting video track to remove some content from it (typically before sharing it remotely). Other Features in this ReleaseAdding auto Keyword for contain-intrinsic-sizeSupport for the auto keyword in contain-intrinsic-size is added, letting websites use the last-remembered size of an element (if any), which provides for a better user experience than for elements with content-visibility: auto. Without this feature, web developers have to guess the rendered size of the element; when used with content-visibility: auto, this may lead to elements jumping around.AudioContext.outputLatencyThe new AudioContext.outputLatency property is an estimate in seconds of audio output latency. Technically, this is the interval between the time the user agent requests the host system to buffer and the time at which the first sample in the buffer is processed by the audio output device. For devices such as speakers or headphones that produce an acoustic signal, this latter time refers to the time when a sample's sound is produced. This is already implemented in Firefox.CSS Color Adjust: 'only' Keyword for color-schemeThe only keyword, which has been re-added to the specification for color-scheme, is now supported in Chrome. It allows opting out of color-scheme for single, specific elements. For example, this allows overriding of force darkening. A few examples illustrate its use.
div { color-scheme: light } This forces the div element out of color-scheme dark.

div { color-scheme: only light } This keeps the color-scheme for the element light as above, and opts it out of forced darkening by the user agent.document.adoptedStyleSheets is Now MutableNote: This feature was incorrectly listed as shipping in Chrome 98. It actually shipped in Chrome 99.In compliance with the spec, the document.adoptedStyleSheets property is now mutable, meaning operations such as push() and pop() now work on it. The previous implementation of adoptedStyleSheets was unwieldy. For example, to add a sheet, the entire array had to be re-assigned:

document.adoptedStyleSheets = [...adoptedStyleSheets, newSheet];

With the new implementation, the same operation looks like this:document.adoptedStyleSheets.push(newSheet); High Dynamic Range Color Media QueriesChrome now supports the CSS media queries 'dynamic-range' and 'video-dynamic-range' for detecting the current display device's support for HDR. Possible values are 'standard' and 'high'. These queries allow pages to toggle CSS rules or respond using Window.matchMedia().New window.open() Behavior for Popups, Tabs, and WindowsAs per a spec update, this version of Chrome lets you specify whether window.open() launches a new window or a new tab. The following examples show the new syntax. The first will open a pop up window. The second will open a new tab or window.

const popup = window.open('_blank','','popup=1');



const tab = window.open('_blank','','popup=0');

Additionally, window.statusbar.visible now correctly returns correct values: specifically, false for popups, and true for tabs, and windows.Private Network Access Preflight Requests for SubresourcesCORS preflight requests are now sent ahead of private network requests for subresources, asking for explicit permission from the target server. A private network request is any request from a public website to a private IP address or localhost, or from a private website (e.g. intranet) to localhost. Sending a preflight request mitigates the risk of cross-site request forgery attacks against private network devices such as routers, which are often not prepared to defend against this threat.structuredClone() Method on Windows and WorkersWindows and Workers now support the structuredClone() methods for making deep copies of objects. A deep copy is one that copies an object's properties, but invokes itself recursively when it finds a reference to another object, creating a copy of that object as well. This ensures that two pieces of code don't accidentally share an object and unknowingly manipulate each others' state. For an explanation of deep copies and how to use them, see Deep-copying in JavaScript using structuredClone.WebAuthn minPinLength ExtensionChrome now exposes the CTAP 2.1 minPinLength extension via Web Authentication. This allows sites preconfigured for a security key to learn the configured minimum PIN length for the authenticator. Window Controls Overlay for Installed Desktop Web AppsWhen the window controls overlay is enabled for installed desktop web apps, the app's client area is extended to cover the entire window—including the title bar area—and the window control buttons (close, maximize/restore, minimize) are overlaid on top of the client area. The web developer is responsible for drawing and input-handling for the entire window except for the window controls overlay. Developers can use this feature to make their installed desktop web apps look like OS apps.WritableStream controller AbortSignalWritableStreamDefaultController now supports a signal property which returns an instance of AbortSignal, allowing a WritableStream operation to be stopped if needed. The streams APIs provide ubiquitous, interoperable primitives for creating, composing, and consuming streams of data. This change permits an underlying sink to rapidly abort an ongoing write or close when requested by the writer. Previously, when writer.abort() was called, a long-running write would still have to continue to completion before the stream could be aborted. With this change, the write can be aborted immediately. In addition to being exposed to streams authored in JavaScript, this facility will also be used by platform-provided streams such as WebTransport.Deprecations, and RemovalsThis version of Chrome introduces the deprecations and removals listed below. Visit ChromeStatus.com for lists of current deprecations and previous removals.Remove SDES Key Exchange for WebRTC The SDES key exchange mechanism for WebRTC has been declared a MUST NOT in the relevant IETF standards since 2013. Its usage in Chrome has declined significantly over the last year. SDES is removed because it is a security problem. It exposes session keys to Javascript, which means that entities with access to the negotiation exchange, or with the ability to subvert the Javascript, can decrypt the media sent over the connection.

Chrome 96 Beta: Conditional Focus, Priority Hints, and More

Thursday, October 21, 2021

Unless otherwise noted, changes described below apply to the newest Chrome beta channel release for Android, Chrome OS, Linux, macOS, and Windows. Learn more about the features listed here through the provided links or from the list on ChromeStatus.com. Chrome 96 is beta as of October 21, 2021.Preparing for a Three Digit Version NumberNext year, Chrome will release version 100. This will add a digit to the version number reported in Chrome's user agent string. To help site owners test for the new string, Chrome 96 introduces a runtime flag that causes Chrome to return '100' in its user agent string. This new flag called chrome://flags/#force-major-version-to-100 is available from Chrome 96 onward.Origin TrialsThis version of Chrome introduces the origin trials described below. Origin trials allow you to try new features and give feedback on usability, practicality, and effectiveness to the web standards community. To register for any of the origin trials currently supported in Chrome, including the ones described below, visit the Chrome Origin Trials dashboard. To learn more about origin trials in Chrome, visit the Origin Trials Guide for Web Developers. Microsoft Edge runs its own origin trials separate from Chrome. To learn more, see the Microsoft Edge Origin Trials Developer Console. New Origin TrialsConditional FocusApplications that capture other windows or tabs currently have no way to control whether the calling item or the captured item gets focus. (Think of a presentation feature in a video conference app.) Chrome 96 makes this possible with a subclass of MediaStreamTrack called FocusableMediaStreamTrack, which supports a new focus() method. Consider the following code:stream = await navigator.mediaDevices.getDisplayMedia(); let [track] = stream.getVideoTracks(); Where formerly, getVideoTracks() would return an array of MediaStreamTrack objects, it now returns FocusableMediaStreamTrack objects. (Note that this is expected to change to BrowserCaptureMediaStreamTrack in Chrome 97. At the time of this writing, Canary already does this.)To determine which display media gets focus, the next line of this code would call track.focus() with either "focus-captured-surface" to focus the newly captured window or tab, or with "no-focus-change" to keep the focus with the calling window. On Chrome 96 or later, you can step through our demo code to see this in action. Priority HintsPriority Hints introduces a developer-set "importance" attribute to influence the computed priority of a resource. Supported importance values are "auto", "low", and "high". Priority Hints indicate a resource's relative importance to the browser, allowing more control over the order resources are loaded. Many factors influence a resource's priority in browsers including type, visibility, and preload status of a resource.Other Features in this ReleaseAllow Simple Range Header Values Without PreflightRequests with simple range headers can now be sent without a preflight request. CORS requests can use the Range header in limited ways (only one valid range) without triggering a preflight request.Back-forward Cache on DesktopThe back-forward cache stores pages to allow for instant navigations to previously-visited pages after cross-site navigations.Cross-Origin-Embedder-Policy: credentiallessCross-Origin-Embedder-Policy has a new credentialless option that causes cross-origin no-cors requests to omit credentials (cookies, client certificates, etc.). Similarly to COEP:require-corp, it can enable cross-origin isolation.Sites that want to continue using SharedArrayBuffer must opt-in to cross-origin isolation. Doing so using COEP: require-corp is difficult to deploy at scale and requires all subresources to explicitly opt-in. This is fine for some sites, but creates dependency problems for sites that gather content from users (Google Earth, social media generally, forums, etc).CSS:autofill Pseudo ClassThe new autofill pseudo class enables styling autofilled form elements. This is a standardization of the :-webkit-autofill pseudo class which is already supported in WebKit. Firefox supports the standard version.Disable Propagation of Body Style to Viewport when ContainedSome properties like writing-mode, direction, and backgrounds are propagated from body to the viewport. To avoid infinite loops for CSS Container Queries, the spec and implementation were changed to not propagate those properties when containment is applied to HTML or BODY.font-synthesis PropertyThe font-synthesis CSS property controls whether user agents are allowed to synthesize oblique, bold, and small-caps font faces when a font family lacks faces.EME MediaKeySession Closed ReasonThe MediaKeySession.closed property now uses an enum to indicate the reason the MediaKeySession object closed. The closed property returns a Promise that resolves when the session closes. Where previously, the Promise simply resolved, it now resolves with a string indicating the reason for closing. The returned string will be one of "internal-error", "closed-by-application", "release-acknowledged", "hardware-context-reset", or "resource-evicted".HTTP to HTTPS Redirect for HTTPS DNS RecordsChrome will always connect to a website via HTTPS when an HTTPS record is available from the domain name service (DNS).InteractionID in EventTimingThe PerformanceEventTiming interface now includes an attribute called interactiveID. This is a browser-generated ID that enables linking multiple PerformanceEventTiming entries when they correspond to the same user interaction. Developers can currently use the Event Timing API to gather performance data about events they care about. Unfortunately, it is hard to link events that correspond to the same user interaction. For instance, when a user taps, many events are generated, such as pointerdown, mousedown, pointerup, mouseup, and click. New Media Query: prefers-contrastChrome supports a new media query called 'prefers-contrast', which lets authors adapt web content to the user's contrast preference as set in the operating system (specifically, increased contrast mode on macOS and high contrast mode on Windows). Valid options are 'more', 'less', 'custom', or 'no-preference'.Unique id for Desktop PWAsWeb app manifests now support an optional id field that globally identifies a web app. When the id field is not present, a PWA falls back to start_url. This field is currently only supported on desktop.URL Protocol Handler Registration for PWAs Enable web applications to register themselves as handlers of custom URL protocols/schemes using their installation manifest. Operating system applications often register themselves as protocol handlers to increase discoverability and usage. Web sites can already register to handle schemes via registerProtocolHandler(). The new feature takes this a step further by letting web apps be launched directly when a custom scheme link is invoked.WebAssemblyContent Security PolicyChrome has enhanced Content Security Policy to improve interoperability with WebAssembly. The wasm-unsafe-eval controls WebAssembly execution (with no effect on JavaScript execution). Additionally, the script-src policies now include WebAssembly.Reference TypesWebAssembly modules can now hold references to JavaScript and DOM objects. Specifically, they can be passed as arguments, stored in local and global variables, and stored in WebAssembly.Table objects.Deprecations and RemovalsThis version of Chrome introduces the deprecations and removals listed below. Visit ChromeStatus.com for lists of current deprecations and previous removals.The "basic-card" Method of PaymentRequest APIThe PaymentRequest API has deprecated the basic card payment method. Its usage is low and declining. It underperforms when compared to other payment methods in time-to-checkout and completion rate. Developers can switch to other payment methods as an alternative. Examples include Google Pay, Apple Pay, and Samsung Pay.

Removal timeline:

Chrome 96: the basic-card method is deprecated in the Reporting API.

Chrome 100: the basic-card method will be removed.

Sunsetting the "basic-card" payment method in the Payment Request API

Thursday, October 21, 2021

The Payment Request API is a soon-to-be-recommended web standard that aims to make building low-friction and secure payment flows easier for developers. The browser facilitates the flow between a merchant website and "payment handlers". A payment handler can be built-in to the browser, a native app installed on user’s mobile device, or a Progressive Web App. Today, developers can use the Payment Request API to access several payment methods, including “basic-card” and Google Pay in Chrome on most platforms, Apple Pay in Safari, Digital Goods API on Google Play, and Secure Payment Confirmation in Chrome.

Earlier last year, we announced that we will deprecate the "basic-card" payment handler on iOS Chrome, followed by other platforms in the future. The "basic-card" is a payment method that is typically built into the browser to help users easily enter credit card numbers without remembering and typing them. This was designed to make a good transition from a form based credit card payment to an app based tokenized card payment. In order to better pursue the goal of app based payment (and a few other reasons), the Web Payments WG decided to remove it from the specification.

Starting from version 96, Chrome will show a warning message in DevTools Console (together with creating a report to Reporting API) when the "basic-card" payment method is used. In version 100, the "basic-card" payment method will be no longer available and canMakePayment() will return false unless other capable payment methods are specified. This applies to all platforms including Android, macOS, Windows, Linux, and Chrome OS.

If you are using the Payment Request API with the "basic-card" payment handler, we suggest removing it as soon as possible and using an alternative payment method such as Google Pay or Samsung Pay.

Posted by Eiji Kitamura, Developer Advocate on the Chrome team

Chrome 95 Beta: Secure Payment Confirmation, WebAssembly Exception Handling and More

Thursday, September 23, 2021

Unless otherwise noted, changes described below apply to the newest Chrome beta channel release for Android, Chrome OS, Linux, macOS, and Windows. Learn more about the features listed here through the provided links or from the list on ChromeStatus.com. Chrome 95 is beta as of September 23, 2021.Origin TrialsThis version of Chrome introduces the origin trials described below. Origin trials allow you to try new features and give feedback on usability, practicality, and effectiveness to the web standards community. To register for any of the origin trials currently supported in Chrome, including the ones described below, visit the Chrome Origin Trials dashboard. To learn more about origin trials in Chrome, visit the Origin Trials Guide for Web Developers. Microsoft Edge runs its own origin trials separate from Chrome. To learn more, see the Microsoft Edge Origin Trials Developer Console. New Origin TrialsAccess Handles for the File System Access APIIt's our eventual goal to merge the origin private file system of the File System Access API with the Storage Foundation API to reduce the number of entry points for getting access to file-based storage in the browser. A first step toward this objective is the newly proposed access handle. The new feature differs from existing functionality by offering in-place and exclusive write access to a file's content. This change, along with the ability to consistently read unflushed modifications and the availability of a synchronous variant on dedicated workers, significantly improves performance and unblocks new use cases. To join the origin trial, see its entry on Chrome Origin Trials. For more on access handlers, see the information we've added to The File System Access API: simplifying access to local files.Reduce User Agent String InformationChrome is trying to reduce the amount of information the user agent string exposes in HTTP requests as well as in navigator.userAgent, navigator.appVersion, and navigator.platform. The user agent string can be used for passive user fingerprinting. To join the origin trial, see its entry on Chrome Origin Trials.Completed Origin TrialsThe following features, previously in a Chrome origin trial, are now enabled by default.Secure Payment ConfirmationSecure payment confirmation augments the payment authentication experience on the web with the help of the Web Authentication API. The feature adds a new 'payment' extension to that API, which allows a relying party such as a bank to opt-in to creating a PublicKeyCredential that can be queried by any merchant origin as part of an online checkout via the Payment Request API using the 'secure-payment-confirmation' payment method.This feature enables a consistent, low friction, strong authentication experience using platform authenticators. Strong authentication with the user's bank is becoming a requirement for online payments in many regions, including the European Union. The proposed feature provides a better user experience and stronger security than existing solutions.WebAssembly Exception HandlingWebAssembly now provides exception handling support. Exception handling allows code to break control flow when an exception is thrown. The exception can be any that is known by the WebAssembly module, or it may be an unknown exception that was thrown by a called imported function. Other Features in this ReleaseAdding droppedEntriesCount to PerformanceObserver CallbackCurrently, web developers can call PerformanceObserver.observe() with the buffered option to listen to past and future performance entries about their site. Unfortunately, past entries need to be stored, and there is a buffer size limit. The droppedEntriesCount parameter helps developers know if they may have lost an entry due to storage being full. The droppedEntriesCount property is one of the options specified as the third parameter of the callback passed in the PerformanceObserver constructor. It provides the number of entries dropped due to the buffer being full. EyeDropper APIThe EyeDropper API provides a browser-supplied eyedropper for the construction of custom color pickers. Creative applications built for the web could benefit from an ability to sample a color from pixels on the screen. Many OS applications, PowerPoint for example, have this ability but are unable to carry it over to their web equivalents.

Even though some browsers have eyedropper capability built into <input type=color> elements, web applications are limited in their ability to integrate this into their custom color pickers since the eyedropper is generally accessible only through the non-customizable popup triggered by the <input> element.New UA platform Version Source on Windows for User Agent Client HintsChrome has updated the value provided by the Sec-CH-UA-Platform-Version on Windows to provide a reasonable level of fidelity to allow sites to identify meaningful Windows platform changes. This enables sites to deliver appropriate binary executables and help content specific to a particular operating system version. The current user agent string and existing Sec-CH-UA-Platform-Version implementation provides the major and minor version Windows components. However, as of Windows 10, Windows generally doesn't increase either of these numbers across significant releases. Notably, Windows 11 does not increase either of these numbers. You can find a table of value mappings to Windows releases in the UA Client Hints' repo issue 220.self.reportError()This function, available in windows and workers, allows developers to report errors to the console and any global "error" event handlers in the same way as an uncaught JavaScript exception. It is mainly useful for custom event-dispatching or callback-manipulating libraries.
This allows library developers to report exceptions in the same way the browser does, which is useful when they need custom control over running the callback. URLPatternURLPattern is a new web API that provides operating system support for matching URLs given a pattern string. It can be used in JavaScript directly or by passing patterns to other web platform APIs such as, for example, as a service worker scope. Both web platform features and JavaScript applications often need to match against URLs. Examples include, service worker scopes on the web platform and URL routing in JavaScript frameworks. Past web platform features have individually created their own URL matching mechanisms. JavaScript has relied on libraries such as path-to-regexp.Deprecations, and RemovalsThis version of Chrome introduces the deprecations and removals listed below. Visit ChromeStatus.com for lists of current deprecations and previous removals.FTP Support RemovedChrome is removing support for FTP URLs. Use of FTP in the browser is sufficiently low that it is no longer viable to invest in improving the existing FTP client. In addition, more capable FTP clients are available on all affected platforms.

Google Chrome 72 and later removed support for fetching document subresources over FTP and rendering of top level FTP resources. Currently navigating to FTP URLs results in showing a directory listing or a download depending on the type of resource. A bug in Google Chrome 74 and later resulted in dropping support for accessing FTP URLs over HTTP proxies. Proxy support for FTP was removed entirely in Google Chrome 76. In Chrome 86 FTP support was turned off for pre-release channels (Canary and Beta) and experimentally turned off for one percent of stable users, though it could be reenabled via the command line. In Chrome 87 it was turned off for fifty percent of users but could also be enabled through the command line. Since Chrome 88, it was only available through a deprecation trial and is now disabled.Support for URLs with non-IPv4 Hostnames Ending in NumbersMost hostnames that aren't valid IPv4 addresses, but end in numbers are treated as valid, and looked up via DNS (for example, http://foo.127.1/). Per the Public Suffix List spec, the eTLD+1 of the hostname in that URL should be 127.1. If that is ever fed back into a URL, http://127.1/ is mapped to http://127.0.0.1/ by the URL spec, which seems potentially dangerous. 127.0.0.0.1 could also potentially be used to confuse users. URLs with these hostnames are now rejected.WebAssembly Cross-Origin Module SharingChrome now deprecates sharing WebAssembly modules between cross-origin, but same-site environments to allow agent clusters to be scoped to origins long term. Deprecate U2F API (Cryptotoken)Chrome's legacy U2F API for interacting with security keys is deprecated and beginning a deprecation trial in Chrome 95 wherein the API remains enabled by default, but the trial token will disable the key for participating sites. U2F security keys themselves are not deprecated and will continue to work.Affected sites should migrate to the Web Authentication API. Credentials that were originally registered via the U2F API can be challenged via web authentication. USB security keys that are supported by the U2F API are also supported by the Web Authentication API.U2F is Chrome's original security key API. It allows sites to register public key credentials on USB security keys and challenge them for building phishing-resistant two-factor authentication systems. U2F never became an open web standard and was subsumed by the Web Authentication API (launched in Chrome 67). Chrome never directly supported the FIDO U2F JavaScript API, but rather shipped a component extension called cryptotoken, which exposes an equivalent chrome.runtime.sendMessage() method. U2F and Cryptotoken are firmly in maintenance mode and have encouraged sites to migrate to the Web Authentication API for the last two years.The following timeline is currently planned for deprecation and removal:Chrome 93Stable as of August 31, 2021. Support added for the googleLegacyAppIdSupport extension.Chrome 95Beta as of September 23, 2021. The following changes were implemented:

Gated U2F API requests behind a user permission prompt.

Logged a deprecation notice in the DevTools console for every request.

Chrome 98Beta expected in early January 2022, stable in February. The deprecation trial will continue, but its behavior will reverse: the API will be disabled by default, but may be kept alive by trial participants.Chrome 103Beta expected in late May 2022, stable in late June. The deprecation trial will end.Chrome 104Beta expected in late June 2022, stable in early August. The U2F API will be fully removed.

Chromium Blog