Security

CORS enforcement for Background Fetch Link copied!

Starting in Chrome 157, the Background Fetch API now enforces Cross-Origin Resource Sharing (CORS). This update aligns Chromium's implementation with the intent of the Background Fetch spec. This ensures that Background Fetch requests are subject to the same security policies as regular Fetch requests, such as Local Network Access checks.

This update prevents sites from bypassing CORS (and other security policy checks) by using Background Fetch instead of regular Fetch.

CSS

CSS position-visibility:anchor{s}-valid Link copied!

The anchors-valid value was implemented as part of https://crbug.com/329703412 but subsequently reverted, due to spec questions about the exact definition of the value. Since that time, the value has been renamed to anchor-valid (see https://chromestatus.com/feature/5136123851571200) and also better defined to be clear that only the default anchor matters, resolving a lot of ambiguity, and making this value shippable.

CSS text-decoration-inset Link copied!

CSS text-decoration-inset controls how far underlines, overlines, and line-through decorations are inset from or extended beyond text run edges. It supports auto, length, and percentage values, including one-value and two-value syntax for setting the start and end offsets. This lets developers adjust decoration spacing and create reveal effects with native text decorations instead of background gradients or additional elements.

sampler: https://static.januschka.com/i-468928416/?asddsaasd MDN: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/text-decoration-inset

CL: https://chromium-review.googlesource.com/c/chromium/src/+/7748204

Ship anchor-visible and anchor-valid, and deprecate the plural versions Link copied!

The CSSWG resolved to rename anchors-valid --> anchor-valid [1] and anchors-visible --> anchor-visible [2]. To accomplish this, we'll rename the properties to the singular variants, and add aliases from the plural versions to the singular versions. At a later date, we will remove the plural variants. This chromestatus is only about shipping the new versions, and deprecating the old ones (but not removing them).

[1] https://github.com/w3c/csswg-drafts/issues/10201#issuecomment-4180411971 [2] https://github.com/w3c/csswg-drafts/issues/10201#issuecomment-4390233490

Miscellaneous

Graphics

Performance

DOM

Renewed HTML insertion&streaming methods Link copied!

Expose multiple HTML setting methods that provide a coherent story for dynamically inserting markup into an existing document.

  • Positional methods (before/after/append/prepend/replaceWith) that take HTML as argument, effectively replacing insertAdjacentHTML.
  • Streaming methods (stream{Append}HTML{Unsafe}) which return a WritableStream, receiving text as input and parsing HMHL.
  • Passing {runScripts} as part of SetHTMLUnsafeOptions, mimicking createContextualFragment behavior.
  • Supporting createParserOptions in trusted types, allowing trusted types to override scripting mode and sanitizer.

New origin trials

Connection Allowlists - Embedded Enforcement Link copied!

Connection Allowlists (https://chromestatus.com/feature/5175745573945344) is a feature designed to provide explicit control over external endpoints by restricting connections initiated via the Fetch API or other web platform APIs from a document or worker. This aspect of the feature extends Connection Allowlists to support embedded enforcement on iFrames and nested documents/workers. This allows the parent document to enforce restrictions on embedded content where they can choose to opt in or not load.

More details on the proposal can be found here: https://github.com/WICG/connection-allowlists