Add support for passing an option bag (WebSocketInit dictionary) as the second argument to the WebSocket constructor. The option bag will initially support a "protocols" option, allowing developers to specify subprotocols (mirroring the existing protocols argument), and also serves as an extension point for future options.

Before, this would be written const socket = new WebSocket("wss://example.com:8080", "soap"). After, this could also be written const socket = new WebSocket("wss://example.com:8080", { protocols: "soap" }).

See https://github.com/whatwg/websockets/issues/42 and spec PR https://github.com/whatwg/websockets/pull/76 for this change.

Surfaces the abort reason, if one is provided, to the methods of the Response object and its ReadableStream, rather than just the fetch promise. This fills a gap in our compliance with the standard, surfacing the developer-supplied abort reason everywhere it is intended to.

Add support for passing a targetAddressSpace option in the WebSocket constructor. This allows developers to specify that a WebSocket connection to a public hostname should be treated as going to a "local" or "loopback" destination, matching the existing support on the Fetch API. The main use case is to offer an escape hatch to bypass mixed content restrictions for connecting to local servers that cannot yet support HTTPS (as Local Network Access permissions require a secure context).

Example: A public site that connects to a local server can use a hostname to avoid needing manual configuration of the exact private IP address in use:

const ws = new WebSocket("ws://local-server.example", { targetAddressSpace: "local"}

This will flag the WebSocket connection as going to a local address, bypassing mixed content blocking when run in a secure context. The user must grant the site the local network permission for the WebSocket connection to succeed, and the hostname must resolve to a local IP address (otherwise it will be blocked).

This builds on https://chromestatus.com/feature/5080055102439424 which adds an options bag to the WebSocket constructor.

Add post-quantum cryptography and a common symmetric AEAD to the set of cryptographic algorithms available in the Web Cryptography API. This will enable developers to have access browser-provided implementations of common quantum-resistant cryptographic algorithms standardized by NIST.

• ML-KEM - 768, 1024
• ML-DSA - 44, 65, 87
• ChaCha20-Poly1305
• X-Wing

Starting in Chrome 154, the Background Fetch API will enforce Cross-Origin Resource Sharing (CORS). This update aligns Chromium's implementation with the intent of the Background Fetch spec. This ensures that Background Fetch requests are subject to the same security policies, such as Local Network Access checks. This update prevents sites from bypassing CORS (and other security policy checks) by using Background Fetch instead of regular Fetch.

Background Fetch requests will soon require that the service worker's origin has the necessary Local Network Access (LNA) permission in order to send requests to local or loopback servers.

This aligns Chromium's implementation with the intent of the Background Fetch spec, which states that such requests go through the Fetch spec and have the same security policies applied to them, in this case LNA checks. This prevents sites from bypassing LNA checks by using Background Fetch spec instead of regular Fetch.

For enterprises, you can use existing LNA enterprise policies in the same way you previously would have for regular Fetch API requests from service workers:

• LocalNetworkAccessRestrictionsTemporaryOptOut
• LocalNetworkAccessAllowedForUrls
• LoopbackNetworkAllowedForUrls
• LocalNetworkAccessPermissionsPolicyDefaultEnabled
• LocalNetworkAccessIpAddressSpaceOverrides).

The scroll-marker-group property is enhaced to support modes:

1. 'links' - The generated ::scroll-marker-group operates in "links" mode, functioning like a navigation list. This is the default mode if omitted.
2. 'tabs' - The generated ::scroll-marker-group operates in "tabs" mode, functioning like a tablist.

Each mode changes focus order and accessibility behavior of ::scroll-marker-group and ::scroll-markers, following WAI-ARIA patterns.

More details:

The links mode (default)

This mode is designed to mimic standard Navigation Landmarks combined with fragment anchors.

Semantic roles

The ::scroll-marker-group takes on the navigation role, and the ::scroll-marker elements take on the link role. This perfectly maps to the <nav> + <a> structural pattern.

Keyboard navigation

All ::scroll-marker elements are sequential tab stops, natively acting like a list of standard anchor links.

Unaffected targets

The originating elements do not get forced into any role, leaving the document's natural semantic structure intact.

Activation focus management

When a link marker is activated, it sets the sequential focus navigation starting point to the target element (the originating element), and focus is lost from the marker. This mimics the native behavior of clicking a standard internal <a href="#target"> link.

The tabs mode

This mode is designed to natively replicate the Tabs Pattern and serves as the interactive foundation for the Tabbed Carousel Pattern.

Semantic roles

The ::scroll-marker-group is implicitly assigned the tablist role, ::scroll-marker elements act as tab roles, and their originating elements get the tabpanel role. This mirrors the required WAI-ARIA Tabs structure.

Keyboard navigation (roving tabindex)

It follows the complex keyboard interactions outlined in standard practices. Only the active ::scroll-marker acts as a tab stop. Users use arrow keys to navigate the focusgroup (switching between markers), preventing the "tab trap" of having to tab through 20 carousel dots.

Focus scope management

The marker acts as a focus navigation scope owner. Pressing Tab from the active marker moves focus directly into the active tabpanel content, matching the specification for tabbed interfaces.

Tree pruning

Content from inactive tabs is explicitly hidden from the accessibility tree. This mimics the expected behavior of aria-hidden="true" or inert on inactive tab panels, saving developers from manually scripting state changes.

Activation focus

When a marker is activated, focus is retained on the marker, which is exactly how standard tabs operate.

CSS text-decoration-inset controls how far underlines, overlines, and line-through decorations are inset from or extended beyond text run edges. It supports auto, length, and percentage values, including one-value and two-value syntax for setting the start and end offsets. This lets developers adjust decoration spacing and create reveal effects with native text decorations instead of background gradients or additional elements.

sampler: https://static.januschka.com/i-468928416/?asddsaasd MDN: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/text-decoration-inset

CL: https://chromium-review.googlesource.com/c/chromium/src/+/7748204

The text-decoration-skip-spaces CSS property controls whether text decoration lines (underlines, overlines, line-throughs, etc.) skip over whitespace characters. This allows authors to prevent decorations from being drawn under spaces, which is often more visually appealing.

Exposes the width attribute on FontFace and the @font-face font-width descriptor as aliases for stretch and font-stretch. Aligns Chromium with the updated CSS Font Loading and CSS Fonts 4 specifications. Developers can now inspect or initialize font face widths using FontFace.width and CSS font-width interchangeably with stretch and font-stretch.

The CSS Typed OM spec exposes the CSSStyleValue hierarchy to worker global scopes ([Exposed=(Window, Worker, PaintWorklet, LayoutWorklet)]), but Blink only exposed CSSStyleValue, CSSKeywordValue, CSSNumericValue, CSSUnitValue and CSSUnparsedValue to Window and the worklets. As a result these constructors were undefined in Workers, unlike in Firefox and Safari.

Allow sites to opt into iframes having responsive sizing (sizing the <iframe> element in the parent document to the iframe document's layout overflow sizing, so that scrolling in the child document is avoided).

Updates Secure Payment Confirmation's locale data field to return a Not Supported DOMException if none of the language tags provided in the field match the language used by the Secure Payment Confirmation's dialog. If the field is not set or empty, this validation is skipped.

This helps web developers with matching the language of the data that they are supplying to Secure Payment Confirmation with the dialog.

A TC39 proposal to allow the developer to ask whether an iterator yields a given value. Analogue to Array.prototype.includes.

Improves and simplifies the light dismiss behavior for popovers and dialogs to fix a few bugs. "Light dismiss" is the behavior where clicking outside of a popover or dialog closes it. The fixed bugs include making scrolling gestures on touch screens no longer trigger light dismiss and making right clicks no longer trigger light dismiss.

The underlying mechanism of this change is that the browser will use click events to trigger light dismiss instead of a combination of pointerdown and pointerup events.

ServiceWorkerAutoPreload mode is an optional browser optimization mode that changes the existing service worker behavior. In ServiceWorkerAutoPreload mode, the browser issues the network request in parallel with the service worker bootstrap.

If the fetch handler returns the response with respondWith(), the browser consumes the network request result inside the fetch handler. If the fetch handler result is fallback, it passes the network response directly to the browser.

Admins can control this feature using an enterprise policy called ServiceWorkerAutoPreloadEnabled.

WebHID now allows web applications to interact with a wider range of devices. Standard Human Interface Device (HID) examples include mice, keyboards, touchscreens, and gamepads. Those are accessible with high-level input events. However, specialized HID devices and features (for example, custom keyboards, game controllers, and call control headsets) require extended access.

WebHID allows web applications to request access, send and receive HID reports, and retrieve information about the report descriptor. This feature was previously launched on desktop platforms (Windows, macOS, Linux, and ChromeOS). Support on Android is planned for Chrome 157. To read more, see Connect to uncommon HID devices.

This feature can be controlled by the following enterprise policies:

• DefaultWebHidGuardSetting
• WebHidAllowAllDevicesForUrls
• WebHidAllowDevicesForUrls
• WebHidAllowDevicesWithHidUsagesForUrls
• WebHidAskForUrls
• WebHidBlockedForUrls

Adds the ability to provide a less or greater modifier to the @builtin(frag_depth) in WGSL.

The current @builtin(frag_depth) can potentially introduce a performance penalty due to disabling the early-Z optimizations on a draw call. The new modifiers allow the explicit setting of the buffer mode and allow the early-Z optimizations to be applied.

Window Shape API enables allowlisted Isolated Web Apps on ChromeOS to have a customized window shape. By enabling non-rectangular and non-contiguous window layouts, developers can implement unique user experiences (such as widgets, floating panels, and overlays) that match the look-and-feel of native applications. The window.setShape API requires the window to be in unframed display mode and requires the window-management permission to be granted.

Administrators can manage this feature with existing policies for window management:

• DefaultWindowManagementSetting configures the default state for the window management for all apps. The policies below can override this default.
• WindowManagementAllowedForUrls allows IWAs with specified origins to enter unframed mode and set custom window shapes without any user interaction.
• WindowManagementBlockedForUrls blocks the permission for specified origins, forcing Chrome to remove any custom window shapes and fallback to other available display modes.

Automated traffic is increasing across the web, and many websites have responded with more user friction in the form of CAPTCHAs and other challenges to combat unwanted traffic. This degrades the web user experience for all users, with a particularly outsized impact to users in private browsing modes.

Private Verification Tokens (PVT) is a low entropy mechanism that allows websites to transfer the trust that their users have established in regular browsing into private browsing mode to reduce their experienced user friction. PVTs are issued during a regular browsing session and redeemed in private browsing mode.