Miscellaneous

Add javascriptURLs option to SanitizerConfig and Sanitizer Link copied!

https://github.com/whatwg/html/pull/12898

Sanitizer API also sanitizes javascript:-URLs, when they are used for navigation. This was originally done as a side effect of any "safe" method that uses Sanitizer, and omittted for any "unsafe" method. The HTML standard recently regularized this and made this a developer-selectable option, instead of a side-effect of a particular method.

Behaviour when the option is not used remains the same.

Security

CORS enforcement for Background Fetch Link copied!

Starting in Chrome 157, the Background Fetch API now enforces Cross-Origin Resource Sharing (CORS). This update aligns Chromium's implementation with the intent of the Background Fetch spec. This ensures that Background Fetch requests are subject to the same security policies, such as Local Network Access checks.

This update prevents sites from bypassing CORS (and other security policy checks) by using Background Fetch instead of regular Fetch.

CSS

CSS corner shorthand properties Link copied!

Implements the CSS corner shorthand and per-corner sub-shorthands (corner-top-left, corner-top-right, corner-bottom-left, corner-bottom-right) as well as physical (corner-top, corner-bottom) and logical (corner-block-start, corner-block-end, etc.) edge shorthands. These allow setting both border-radius and corner-shape for individual corners in a single declaration. Additionally, corners is retained as a compat alias for the corner shorthand.

sampler: https://static.januschka.com/i-425897047/

CL: https://chromium-review.googlesource.com/c/chromium/src/+/7747994

CSS position-visibility:anchor{s}-valid Link copied!

The anchors-valid value was implemented as part of https://crbug.com/329703412 but subsequently reverted, due to spec questions about the exact definition of the value. Since that time, the value has been renamed to anchor-valid (see https://chromestatus.com/feature/5136123851571200) and also better defined to be clear that only the default anchor matters, resolving a lot of ambiguity, and making this value shippable.

CSS text-decoration-inset Link copied!

CSS text-decoration-inset controls how far underlines, overlines, and line-through decorations are inset from or extended beyond text run edges. It supports auto, length, and percentage values, including one-value and two-value syntax for setting the start and end offsets. This lets developers adjust decoration spacing and create reveal effects with native text decorations instead of background gradients or additional elements.

sampler: https://static.januschka.com/i-468928416/?asddsaasd MDN: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/text-decoration-inset

CL: https://chromium-review.googlesource.com/c/chromium/src/+/7748204

Ship anchor-visible and anchor-valid, and deprecate the plural versions Link copied!

The CSSWG resolved to rename anchors-valid --> anchor-valid [1] and anchors-visible --> anchor-visible [2]. To accomplish this, we'll rename the properties to the singular variants, and add aliases from the plural versions to the singular versions. At a later date, we will remove the plural variants. This chromestatus is only about shipping the new versions, and deprecating the old ones (but not removing them).

[1] https://github.com/w3c/csswg-drafts/issues/10201#issuecomment-4180411971 [2] https://github.com/w3c/csswg-drafts/issues/10201#issuecomment-4390233490

object-fit and object-position apply to SVG documents in <object> and <embed> Link copied!

SVG documents loaded through <object> or <embed> are sized and positioned inside the element's content box according to the CSS object-fit and object-position properties, the same way <img> content is.

Previously Chrome ignored both properties for embedded SVG documents and always stretched the document viewport to the whole content box.

DOM

Capability Elements Icon-only mode Link copied!

Introduces a new attribute to render Capability Elements(<camera>, <microphone> and <geolocation>) as compact icon buttons without text using a displaymode attribute. This gives developers flexible UI density for spatial layouts such as map controls and video floating trays while preserving native security guarantees and full screen reader accessibility.

This is an extension to the recently released Capability Elements https://chromestatus.com/feature/5153829504024576

Renewed HTML insertion&streaming methods Link copied!

Expose multiple HTML setting methods that provide a coherent story for dynamically inserting markup into an existing document.

  • Positional methods (before/after/append/prepend/replaceWith) that take HTML as argument, effectively replacing insertAdjacentHTML.
  • Streaming methods (stream{Append}HTML{Unsafe}) which return a WritableStream, receiving text as input and parsing HMHL.
  • Passing {runScripts} as part of SetHTMLUnsafeOptions, mimicking createContextualFragment behavior.
  • Supporting createParserOptions in trusted types, allowing trusted types to override scripting mode and sanitizer.

Graphics

Performance

New origin trials

Connection Allowlists - Embedded Enforcement Link copied!

Connection Allowlists (https://chromestatus.com/feature/5175745573945344) is a feature designed to provide explicit control over external endpoints by restricting connections initiated via the Fetch API or other web platform APIs from a document or worker. This aspect of the feature extends Connection Allowlists to support embedded enforcement on iFrames and nested documents/workers. This allows the parent document to enforce restrictions on embedded content where they can choose to opt in or not load.

More details on the proposal can be found here: https://github.com/WICG/connection-allowlists