Chrome Release Summary

Chrome version: 132, 131, 130, 129, 128, 127, 126, 125, 124, 123, 122, 121, 120, 119, 118, 117, 116, 115, 114, 113, 112, 111, 110, 109, 108, 107, 106, 105, 104, 103, 102, 101, 100, 99, 98, 97, 96, 95, 94, 93, 92, 91, 90, 89, 88, 87, 86, 85, 84, 83, 82, 81, 80, 79, 78, 77, 76, 75, 74, 73, 72, 71, 70, 69, 68, 67, 66, 65, 64, 63, 62, 61, 60, 59, 58, 57, 56, 55, 54, 53, 52, 51, 50, 49, 48, 47, 46, 45, 44, 43, 42, 41, 40, 39, 38, 37, 36, 35, 34, 33, 32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0

Chrome 129

Enabled (12) | Origin Trial (1) | Behind a flag (2) | Deprecated (0) | Removed (2)

Enabled by default in 129

This release of Chrome had 12 new features.

Blob support in WebRTC data channels

RTCDataChannel.send(Blob) is now implemented and the onMessage event can now optionally receive data of type Blob using the binaryType attribute. In addition to supporting sending strings and ArrayBuffers, you can chose to send a Blob instead as long as its size is below the SCTP transport maxMessageSize as indicated in the WebRTC specification. Using the binaryType attribute set to "blob", the onMessage event data attribute will be of type Blob instead of the currently supported ArrayBuffer. #

This feature was specified in this Spec.

CSS Anchor Positioning: Unwrapped inset-area()

Replaces the inset-area() function with inset-area values directly within position-try-fallbacks. This means that you now just write e.g. position-try-fallbacks:top instead of position-try-fallbacks:inset-area(top). #

This feature was specified in this Spec.

CSS interpolate-size property and calc-size() function

The CSS interpolate-size property allows a page to opt in to animations and transitions of CSS intrinsic sizing keywords such as auto, min-content, fit-content, etc., in the cases where we can animate those keywords. The CSS calc-size() function is a CSS function similar to calc(), but that also supports operations on exactly one supported sizing keyword. Currently supported sizing keywords are auto, min-content, max-content, fit-content, and (for flex-basis) content. Other sizing keywords that may be supported in the future include stretch (currently supported as prefixed -webkit-fill-available) and contain. This function is used to represent the values in the middle of the animations allowed by the interpolate-size property. #

This feature was specified in this Spec.

Compute Pressure WebDriver extension commands

This exposes WebDriver commands for creating, removing and updating pressure source samples for so called "virtual pressure sources": pressure sources that do not depend on underlying hardware or operating system support and can be used for testing. #

This feature was specified in this Spec.

Intl.DurationFormat

Intl.DurationFormat API is a TC39 ECMA402 proposal See https://github.com/tc39/proposal-intl-duration-format for the proposal The proposal advanced to Stage 3 on 2021-10 Spec: https://tc39.es/proposal-intl-duration-format/ #

This feature was specified in this Spec.

Resources

Docs: https://docs.google.com/document/d/1UMwkeeiqVyVNhNW8CS1vwN9g2cIH0AryaU16DT-vGg0/edit

Samples: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/DurationFormat

Private Aggregation API: client-side contribution merging

Modifies the Private Aggregation API to merge histogram contributions with the same bucket and filtering ID before embedding in the aggregatable report's encrypted payload. Private Aggregation imposes a limit on the number of contributions that can be embedded in a single aggregatable report, with any additional contributions being dropped. By merging together contributions where possible, we can get additional utility out of the limit. Note that, ignoring the dropping of excess contributions, merging these sorts of contributions should not have any impact on the final outputs (i.e. summary reports). #

This feature was specified in this Spec.

Remove PointerEvent.getCoalescedEvents() from insecure contexts

The Pointer Events Working Group made PointerEvent.getCoalescedEvents() restricted to secure contexts 4+ years ago, which removed the API from insecure contexts. Chrome originally shipped the old behavior and didn't follow the spec change immediately because of compat concerns. We are now removing it from insecure contexts because Chrome usage in insecure contexts turned out to be very low. #

This feature was specified in this Spec.

Rename inset-area to position-area

The CSSWG resolved to rename this property from `inset-area` to `position-area`. See the CSSWG discussion here: https://github.com/w3c/csswg-drafts/issues/10209#issuecomment-2221005001 Chrome disagrees with this change, but would like to ship an interoperable implementation. We will ship the new property name, `position-area`, as a synonym for `inset-area` first. Then after a suitable amount of time, we will remove `inset-area`. The latter removal will be done under a separate Intent. #

This feature was specified in this Spec.

Update CSS backdrop-filter to use mirror edgeMode

The backdrop-filter CSS property applies one or more filters to the "backdrop" of an element. The "backdrop" basically means all of the painted content that lies behind the element. A common filter is a blur allowing designers to construct "frosted glass" dialog boxes, video overlays, translucent navigation headers, and more. This was initially implemented the same way as a regular blur, but sampling beyond the edges of the element allowed colors from the edges to bleed in. The spec was changed to sample pixels outside the backdrop edges by duplicating the pixels at the edge. This however, results in extreme flickering of content as it enters the backdrop edge. The latest spec change mirrors the backdrop when sampling beyond the edge which allows for a smooth gradual introduction of new colors at the edges without overweighting on single lines of color. #

This feature was specified in this Spec.

Web Authentication API: JSON serialization methods

The WebAuthn PublicKeyCredential.toJSON(), parseCreationOptionsFromJSON() and parseRequestOptionsFromJSON() methods let developers serialize a WebAuthn response into a JSON object or deserialize a WebAuthn request object from its JSON representation. #

This feature was specified in this Spec.

WebGPU extended range (HDR) support

Adds tone mapping parameters to the WebGPU canvas configuration, and adds options of "standard" (the current behavior of restricting content to the SDR range of the display) as the default, and "extended" (not imposing this restriction) as a new behavior. This allows WebGPU content to use the full range of a display. #

This feature was specified in this Spec.

Resources

Docs: https://github.com/ccameron-chromium/webgpu-hdr/blob/main/EXPLAINER.md

Samples: https://ccameron-chromium.github.io/webgpu-hdr/example.html

scheduler.yield()

Provides a method for yielding control to the browser, which can be used to break up long tasks. Awaiting the promise returned by scheduler.yield() causes the current task to yield, continuing in a new browser task. This can be used to improve responsiveness issues caused by long tasks. Continuations are prioritized to mitigate performance problems of existing alternatives. #

This feature was specified in this Spec.

Origin Trials in-progress in 129

This release of Chrome had 1 new origin trials.

Deprecate 0.0.0.0 for Private Network Access

We propose to block access to IP address 0.0.0.0 in advance of PNA completely rolling out. Chrome is deprecating direct access to private network endpoints from public websites as part of the Private Network Access (PNA) specification (https://developer.chrome.com/blog/private-network-access-preflight/). Services listening on the localhost (127.0.0.0/8) are considered private according to the specification (https://wicg.github.io/private-network-access/#ip-address-space-heading). Chrome's PNA protection (rolled out as part of https://chromestatus.com/feature/5436853517811712) can be bypassed using the IP address 0.0.0.0 to access services listening on the localhost on macOS and Linux. This can also be abused in DNS rebinding attacks targeting a web application listening on the localhost. Since 0.0.0.0 is not used in practice (and should not be used), but was overlooked during https://chromestatus.com/feature/5436853517811712, we're deprecating it separately from the rest of the private network requests deprecation. #

This feature was specified in this Spec.

Flagged features in 129

This release of Chrome had 2 are available behind a flag.

Dynamic safe area insets

Dynamically change the safe area inset based on the shown ration for the browser controls. This is used when to keep the web contents from the display cutout area when Chrome is drawing edge to edge. Why this is important: 1. When Chrome draws edge to edge, bottom controls in the web contents can be covered by bottom system bars. This feature will place web elements using safe-area-insets* to place their controls gradually (e.g. m.youtube.com) 2. Similar feature behavior is already available for Chrome on iOS[1] and other browsers (e.g. Safari on iOS). We are aligning Chrome on Android to parity with the iOS behavior as part of this change. 3. safe-area-inset* is an established feature since Chrome M69. This feature is available to all platform; at the moment only Android would put cutout into viewport, but developers can use the env() variables on all platforms the same way and we would set it if another platform did intrude into the viewport. Detailed design & implementation, please see crbug.com/324436581 [1] Chrome on iOS behavior: https://drive.google.com/file/d/19kaNBAr8RFQ0X9odMjx4g-t28lnCHSS_/view?usp=drive_link #

This feature was specified in this Spec.

Resources

Docs: https://docs.google.com/document/d/1VL0KNzdQwATk9Uf8kP0kcbO1-dDx86pPvB_bMQdLLHE/edit#heading=h.n0k4hyoo4m10

Samples: https://drive.google.com/file/d/1IhIiYMaG5bK2n-ufahEqkQwcPTok7sFe/view?usp=drive_link

Unrestricted WebUSB (available only to Isolated Web Apps)

Enables trusted applications to bypass security restrictions in the WebUSB API. The WebUSB specification defines a blocklist of vulnerable devices and a table of protected interfaces classes that are blocked from access through WebUSB. With this feature, Isolated Web Apps with permission to access the "usb-unrestricted" Permission Policy feature will be allowed to access blocklisted devices and protected interface classes. #

This feature was specified in this Spec.

Deprecations and Removals

Deprecation policy

To keep the platform healthy, we sometimes remove APIs from the Web Platform which have run their course. There can be many reasons why we would remove an API, such as:

Some of these changes will have an effect on a very small number of sites. To mitigate issues ahead of time, we try to give developers advanced notice so they can make the required changes to keep their sites running.

Chrome currently has a process for deprecations and removals of API's, essentially:

You can find a list of all deprecated features on chromestatus.com using the deprecated filter and removed features by applying the removed filter. We will also try to summarize some of the changes, reasoning, and migration paths in these posts.

Deprecated features in 129

This release of Chrome had 0 features deprecated.

Removed features in 129

This release of Chrome had 2 features removed.

Deprecate the includeShadowRoots argument on DOMParser

The includeShadowRoots argument was a never-standardized argument to the DOMParser.parseFromString() function, which was there to allow imperative parsing of HTML content that contains declarative shadow DOM. This was shipped in M90 [1] as part of the initial shipment of declarative shadow DOM. Since the standards discussion rematerialized in 2023, the shape of DSD APIs changed, including this feature for imperative parsing. (See [2] for more context on the standards situation and recent changes, and see [3] and [4] for other related deprecations.) Now that a standardized version of this API, in the form of setHTMLUnsafe() and parseHTMLUnsafe() will ship in Chrome 124 ([5]), the non-standard includeShadowRoots argument needs to be deprecated and removed. All usage should shift accordingly: Instead of: (new DOMParser()).parseFromString(html,'text/html',{includeShadowRoots: true}); this can be used instead: document.parseHTMLUnsafe(html); [1] https://chromestatus.com/feature/5191745052606464 [2] https://chromestatus.com/feature/5161240576393216 [3] https://chromestatus.com/feature/5081733588582400 [4] https://chromestatus.com/feature/6239658726391808 [5] https://chromestatus.com/feature/6560361081995264 #

This feature was specified in this Spec.

Deprecation of non-standard declarative shadow DOM serialization

The prototype implementation (which was shipped in 2020 and then shape-changed in 2023) contained a method called `getInnerHTML()` that could be used to serialize DOM trees containing shadow roots. That part of the prototype was not standardized with the rest of declarative shadow dom, and only recently has it reached spec consensus (https://github.com/whatwg/html/issues/8867). As part of that consensus, the shape of the getInnerHTML API changed. This feature represents the deprecation of the old, shipped `getInnerHTML()` method. The replacement is called `getHTML()`, and it shipped in M125. See https://chromestatus.com/feature/5102952270528512 for that feature. #

This feature was specified in this Spec.