Google Chrome 99 is out with 28 security fixes

[harlan4096]

Google released Google Chrome 99 Stable and Extended Stable on March 1, 2022 to the public. Both browser versions address 28 different security issues in previous versions of the web browser.



Chrome 99 is already available but the rollout will take weeks to complete. Chrome users who want to update their browser early can do so on desktop versions by selecting Menu > Help > About Google Chrome or by loading chrome://settings/help directly.

Note: if Chrome is not finding the update when you are loading the page, you may download the latest version of Chrome from Google to update it.

The official release notes reveal little about the changes in Chrome 99. While you can take a look at the log file, it is not advised to do so unless you have hours to spend.

The release notes mention 28 different security issues that are patched in Chrome 99.  The highest severity rating is high, the second-highest after critical.

Google publishes the list of externally reported issues only on the blog. None of the vulnerabilities appear to be exploited actively, as Google mentions this usually.

The company's platform status page lists 15 changes that are tracked for version 99, but the list is developer-centric.  One change, Convert adoptedStyleSheets to use ObservableArray, appears to be controversial as Apple won't implement the change in Safari at this time. Google notes that Mozilla and Microsoft will ship the implementation as well.
 

Chromium is the only shipped implementation of adoptedStyleSheets. Gecko would like to ship this feature, but has been waiting for the resolution of this issue (FrozenArray vs. ObservableArray) to ship their implementation. This should unblock Gecko [1]. The Edge team supports this change [2]. WebKit continues to be skeptical [3] of this usefulness of this feature, despite the general agreement of the rest of the web components community [4], and the support of the developer community [5][6][7]. So the interop risk is mainly that WebKit decides not to implement this feature.

The remaining changes affect:

• "paintworklet" destination for PaintWorklet
  
• Allow infinity, -infinity and NaN in CSS calc()
  
• Autofill in ShadowDOM
  
• CSS cascade layers
  
• HTMLInputElement showPicker()
  
• Handwriting Recognition API
  
• Intl Enumeration API
  
• Intl Locale Info in ECMA402
  
• New Canvas 2D API
  
• Origin Private File System extension: AccessHandle
  
• Remove font-family -webkit-standard
  
• Replace GamepadList with sequence<Gamepad?> for navigator.getGamepads() return value
  
• Unprefixed text-emphasis properties
  
• Window Controls Overlay for Installed Desktop Web Apps
  

Closing Words

Most of these changes will find their way into all other Chromium-based browsers, including Microsoft Edge, Vivaldi, Brave and Opera.

Now You: when do you update your browsers?
...

Continue Reading