CSS

Graphics

Enhanced Canvas TextMetrics Link copied!

Expand the TextMetrics Canvas API to support selection rectangles, bounding box queries, and glyph cluster-based operations.

This new functionality should enable complex text editing applications with accurate selection, caret positioning, and hit testing. Additionally, cluster-based rendering facilitates sophisticated text effects such as independent character animations and styling.

Offline / Storage

IndexedDB: SQLite backend Link copied!

Chromium's IndexedDB implementation is rewritten on top of SQLite, to replace the previous implementation that uses a hybrid of LevelDB and flat files. There is no change to the Web API.

This is expected to improve reliability and, to a lesser extent, performance.

For now this is applied to new data stores. This is step 2 of a multi-phase rollout. See https://chromestatus.com/feature/5126896685809664 which tracks step 1, the rollout for in-memory i.e. incognito contexts. Step 3 will consist of migrating existing data from LevelDB stores to SQLite stores.

In this step, the first time a user visits a site, or after clearing site data, new IDB data will be stored in a backend that makes use of SQLite, but existing data stored in LevelDB is unimpacted.

See Documentation link below for a list of differences to be aware of.

Security

Local network access restrictions Link copied!

Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a local website (for example, intranet) to loopback.

Gating the ability for websites to perform these requests behind a permission mitigates the risk of cross-site request forgery attacks against local network devices such as routers, and reduces the ability of sites to use these requests to fingerprint the user's local network.

This permission is restricted to secure contexts. If granted, the permissions additionally relax mixed content blocking for local network requests (since many local devices are not able to obtain publicly trusted TLS certificates for various reasons).

This work supersedes a prior effort called Private Network Access, which used preflight requests to have local devices opt in. For more information on this feature, see Adapting your website for new Local Network Access restrictions in Chrome.

Chrome 145 introduced more granular permissions for websites requesting access to a user's local network. The previous single local-network-access permission is being split into two distinct permissions:

  • local-network: Grants access to IP addresses in the local network space (for example, intranets, internal devices).
  • loopback-network: Grants access to loopback IP addresses (for example, localhost, 127.0.0.1).

The old local-network permission will remain as an alias, ensuring existing configurations and permissions policies continue to function as expected.

This change provides both users and Admins with more precise control over how websites interact with internal network resources. Current enterprise policies managing local network access will not be affected by this change.

Chrome 146 introduces two new enterprise policies for managing local network access restrictions: LocalNetworkAccessIpAddressSpaceOverrides and LocalNetworkAccessPermissionsPolicyDefaultEnabled. These policies can be set using custom configurations.

Chrome 147 expands Local Network Access restrictions to include WebSocket and WebTransport connections.

In Chrome 156, the LocalNetworkAccessRestrictionsTemporaryOptOut policy will be removed.

Miscellaneous

closest-corner and farthest-corner radii for circle() and ellipse() basic shapes Link copied!

The circle() and ellipse() CSS basic-shape functions accept the closest-corner and farthest-corner radius keywords, in addition to the existing closest-side and farthest-side. These keywords resolve to the Euclidean distance from the shape center to the nearest or farthest corner of the reference box, matching the long-standing behavior of radial-gradient(). They work in clip-path, shape-outside, and offset-path, so the same shape syntax accepted by gradients now works for shapes.

CL: https://chromium-review.googlesource.com/c/chromium/src/+/7767079

Realtime / Communication

WebRTC Diagnostic Logging API Link copied!

Chrome 156 will introduce an API for WebRTC diagnostic logging. This API allows an application to opt in to diagnostic logging. These logs contain information about the WebRTC activity by the application and are useful for local debugging or to submit bugs.

Logs can optionally be uploaded separately to the browser vendor and can be used for diagnosing bugs. The application gets an ID that can be attached to a bug report, similar to crashes.

Diagnostic logs are enabled with the enterprise policy WebRtcDiagnosticLogCollectionAllowedForOrigins.