← all categories

category

Privacy & Security

CSP, COOP, Document-Isolation-Policy, Local Network Access, partitioning, signature integrity, sandboxing, removals of legacy attack surface.

74 of 80 demos built, across 25 releases.

Chrome 156 (2)

  1. Local network access restrictions

    Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a ...

    chromestatus demo in v142 →

  2. Remove FencedFrame element and window.fence APIs

    Fenced frames are nested frames that embed content onto a page without the ability to share data between the fenced frame and its embedder. window.fence APIs include Fenced frames Ads reporting (FFAR) JS APIs that were...

    chromestatus demo in v155 →

Chrome 154 (1)

  1. Local Network Access restrictions for Background Fetch

    Background Fetch requests now require that the service worker's origin has the necessary Local Network Access (LNA) permission to send requests to local or loopback servers. This aligns Chromium's implementation with th...

    chromestatus demo →

Chrome 153 (4)

  1. Deprecate and Remove Protected Audience

    The Protected Audience API provides a method of interest-group advertising without third-party cookies or user tracking across sites. Following Chrome's announcement that the current approach to third-party cookies will...

    chromestatus demo in v144 →

  2. Deprecate and remove: Attribution Reporting API

    The Attribution Reporting API is a privacy-preserving web API designed to measure ad conversions without third-party cookies or user tracking across sites. Following Chrome's announcement that the current approach to th...

    chromestatus demo in v152 →

  3. Deprecate and Remove: Shared Storage API

    The Shared Storage API is a privacy-preserving web API to enable storage that is not partitioned by first-party site. Following Chrome's announcement that the current approach to third-party cookies will be maintained, ...

    chromestatus demo in v144 →

  4. XML parsing in Rust for non-XSLT scenarios

    To improve browser security and protect users against memory-related vulnerabilities, Chrome 153 updates its XML parsing engine to a memory-safe [Rust](https://rust-lang.org/) implementation for several common scenarios....

    chromestatus demo in v147 →

Chrome 152 (3)

  1. Connection Allowlists

    Connection Allowlists is a feature designed to provide explicit control over external endpoints by restricting connections initiated via the Fetch API or other web platform APIs from a document or worker. The proposed i...

    chromestatus demo →

  2. Deprecate and remove XSLT

    [XSLT v1.0](https://www.w3.org/TR/xslt-10/), which all browsers adhere to, was standardized in 1999. In the meantime, XSLT has evolved to v2.0 and v3.0, adding features, and growing apart from the old version frozen into...

    chromestatus demo →

  3. Deprecate and remove: Private Aggregation API

    The Private Aggregation API is a generic mechanism for measuring aggregate, cross-site data in a privacy preserving manner. It was originally designed for a future without third-party cookies. Following Chrome's announc...

    chromestatus demo →

Chrome 151 (1)

  1. Permission Policy Merger: "direct-sockets-private" with "local-network" and "loopback-network"

    Isolated Web App manifests now require specific "local-network" and/or "loopback-network" permission policies to enable Direct Sockets connections to local or loopback network addresses, respectively. This change replace...

    chromestatus demo →

Chrome 150 (1)

  1. Opaque origin for data: URLs

    Chrome 150 updates how Dedicated and Shared Workers handle [data: URLs](https://datatracker.ietf.org/doc/html/rfc2397). Rather than automatically inheriting the security origin of the script or page that created them, th...

    chromestatus demo →

Chrome 148 (3)

  1. Agentic Federated Login

    A set of FedCM extensions to help agentic browsers safely log users in to websites using their federated accounts.

    chromestatus demo →

  2. Connection Allowlists

    Connection Allowlists is a feature designed to provide explicit control over external endpoints by restricting connections initiated via the Fetch API or other web platform APIs from a document or worker. The proposed i...

    chromestatus demo →

  3. Deprecate and remove: non-allowlisted Event interfaces from document.createEvent()

    Remove support for creating non-allowlisted event interfaces from document.createEvent(). After this change, these will throw NOT_SUPPORTED_ERR as required by the specification. (However, events with usage above 0.01% or...

    chromestatus demo →

Chrome 147 (6)

  1. Document Policy in Dedicated Workers

    Enables document-policy in Dedicated Workers. This enables developers to use Document Policy feature, such as performance or security controls in workers, instead of being limited to the main document. By extending poli...

    chromestatus demo →

  2. Local network access restrictions

    Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a ...

    chromestatus demo →

  3. Local network access restrictions for WebSockets

    Local Network Access(LNA) restrictions are being expanded to include WebSockets. WebSockets connections to local address will now start triggering permission prompts. All of the current LNA enterprise policies will stil...

    chromestatus demo →

  4. Local network access restrictions for WebTransport

    Restricts the ability to make requests to the user's local network using WebTransport, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, ...

    chromestatus demo →

  5. Local Network Access restrictions on Service Worker WindowClient.navigate()

    Local Network Access (LNA) restrictions have been recently added in the last few months to restrict web sites from unilaterally making requests to local networks and local devices (https://chromestatus.com/feature/515272...

    chromestatus demo →

  6. Remove Inline XSLT for production of SVG

    A specially crafted XML file may contain an XSL stylesheet that transforms generic XML data into an SVG file. Example: https://gist.github.com/drott/1fc70b3c7f0ac314d1fe2e5beecc5490?short_path=1c60adf This is a specia...

    chromestatus demo →

Chrome 146 (1)

  1. Local network access restrictions

    Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a ...

    chromestatus demo →

Chrome 145 (3)

  1. Crash Reporting key-value API

    A new key-value API, tentatively `window.crashReport`, backed by a per-Document map holding data that gets appended to crash reports. See https://github.com/WICG/crash-reporting/issues/15 for initial discussion. The dat...

    chromestatus demo →

  2. Local network access restrictions

    Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a ...

    chromestatus demo →

  3. Local Network Access split permissions

    This is an enhancement to the Local Network Access(LNA) restrictions, where we split the permission required from one Local Network Access permission, into 2 separate permissions. Old permission: local-network-access ...

    chromestatus demo →

Chrome 144 (3)

  1. Externally loaded entities in XML parsing

    Chrome synchronously fetches external XML entities/DTDs and incorporates them into parsing under specific circumstances. I propose to remove this functionality. http/tests/security/contentTypeOptions/xml-external-entity...

    chromestatus demo →

  2. Local network access restrictions for WebTransport

    Restricts the ability to make requests to the user's local network using WebTransport, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, ...

    chromestatus demo →

  3. User-Agent Client Hints "ch-ua-high-entropy-values" permissions policy

    Adds support for a 'ch-ua-high-entropy-values' permissions policy that enables a top-level site to restrict which documents are able to collect high-entropy client hints via the navigator.userAgentData.getHighEntropyValu...

    chromestatus demo →

Chrome 143 (1)

  1. Deprecate and remove XSLT

    [XSLT v1.0](https://www.w3.org/TR/xslt-10/), which all browsers adhere to, was standardized in 1999. In the meantime, XSLT has evolved to v2.0 and v3.0, adding features, and growing apart from the old version frozen into...

    chromestatus demo →

Chrome 142 (3)

  1. Local network access restrictions

    Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a ...

    chromestatus demo →

  2. Local network access restrictions for WebSockets

    Local Network Access(LNA) restrictions are being expanded to include WebSockets. WebSockets connections to local address will now start triggering permission prompts. All of the current LNA enterprise policies will stil...

    chromestatus demo →

  3. Origin-keyed process isolation

    Chrome 142 introduces a shift in the process isolation policy from locking processes to a site like `https://example.com` to locking them to a specific origin, such as, `https://foo.example.com`. To further enhance secur...

    chromestatus demo →

Chrome 141 (4)

  1. Extend CSP script-src (aka script-src-v2)

    Introduces a new keywords to the script-src Content Security Policy (CSP) directive. This adds two new hash based allowlisting mechanisms: script sources based on hashes of URLs and contents of eval() and eval() like fun...

    chromestatus demo →

  2. Local network access restrictions

    Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a ...

    chromestatus demo →

  3. Permissions policy for Device Attributes API

    The new Permissions Policy enables restricting access to the Device Attributes API, which is available only for policy-installed kiosk web apps and policy-installed Isolated Web Apps, both only on managed ChromeOS device...

    chromestatus demo →

  4. Signature-based Integrity

    This feature provides web developers with a mechanism to verify the provenance of resources they depend upon, creating a technical foundation for trust in a site's dependencies. In short: servers can sign responses with ...

    chromestatus demo →

Chrome 140 (2)

  1. Crash Reporting key-value API

    A new key-value API, tentatively `window.crashReport`, backed by a per-Document map holding data that gets appended to crash reports. See https://github.com/WICG/crash-reporting/issues/15 for initial discussion. The dat...

    chromestatus demo →

  2. Permissions policy for Device Attributes API

    The new Permissions Policy enables restricting access to the Device Attributes API, which is available only for policy-installed kiosk web apps and policy-installed Isolated Web Apps, both only on managed ChromeOS device...

    chromestatus demo →

Chrome 139 (2)

  1. Crash Reporting API: Specify crash-reporting to receive only crash reports

    This feature ensures developers receive only crash reports by specifying the endpoint named `crash-reporting `. By default, crash reports are delivered to the `default` endpoint which receives many other kinds of reports...

    chromestatus demo →

  2. Fire error event instead of throwing for CSP blocked worker

    When blocked by CSP, Chromium currently throws SecurityError from constructor of Worker and SharedWorker. Spec requires CSP to be checked as part of fetch and fires error event asynchronously instead of throwing exceptio...

    chromestatus demo →

Chrome 138 (3)

  1. Crash Reporting API: is_top_level & visibility_state

    This feature adds `is_top_level` and `visibility_state` string fields to the crash reporting API body that gets sent to the default reporting endpoint for crash reports. See https://wicg.github.io/crash-reporting/#crash-...

    chromestatus demo →

  2. Integrity Policy for scripts

    Subresource-Integrity (SRI) enables developers to make sure the assets they intend to load are indeed the assets they are loading. But there's no current way for developers to be sure that all of their scripts are valida...

    chromestatus demo →

  3. Local network access restrictions

    Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a ...

    chromestatus demo →

Chrome 137 (3)

  1. Blob URL Partitioning: Fetching/Navigation

    As a continuation of Storage Partitioning, Chromium will implement partitioning of Blob URL access by Storage Key (top-level site, frame origin, and the has-cross-site-ancestor boolean), with the exception of top-level n...

    chromestatus demo →

  2. Document-Isolation-Policy

    Document-Isolation-Policy allows a document to enable crossOriginIsolation for itself, without having to deploy COOP or COEP, and regardless of the crossOriginIsolation status of the page. The policy is backed by process...

    chromestatus demo →

  3. IP Address Logging & Reporting

    Chrome Enterprise is enhancing security monitoring and incident response capabilities by collecting and reporting local and remote IP addresses & sending those IP addresses to the Security Investigation Logs (SIT). In ad...

    chromestatus demo →

Chrome 136 (4)

  1. Incorporating navigation initiator into the HTTP cache partition key

    Chrome’s HTTP cache keying scheme will be updated to include an “is-cross-site-main-frame-navigation” boolean to mitigate cross-site leak attacks involving top-level navigation. Specifically, this will prevent cross-site...

    chromestatus demo →

  2. Partitioning :visited links history

    To eliminate user browsing history leaks, anchor elements are styled as :visited only if they have been clicked from this top-level site and frame origin before. On the browser-side, this means that the VisitedLinks hash...

    chromestatus demo →

  3. Permissions Policy reports for iframes

    Introduces a new violation type called "Potential Permissions Policy violation", which will only look at Permissions Policy (including report-only policy) and the allow attribute set in iframes to detect the conflict bet...

    chromestatus demo →

  4. Protected audience: text conversion helpers

    Protected Audience bidding and scoring scripts that interface with WebAssembly need to efficiently convert string-typed data to (and from) byte arrays (e.g. to pass strings into and out of WebAssembly via the “memory” Ar...

    chromestatus demo →

Chrome 135 (3)

  1. Fenced frames - Automatic beacon cross-origin data support

    Fenced frames or URN iframes, if loaded through an API like Protected Audience or Shared Storage, can send out reporting beacons automatically if some event occurs (currently only top-level navigation beacons are support...

    chromestatus demo →

  2. Origin-keyed process isolation

    Chrome 142 introduces a shift in the process isolation policy from locking processes to a site like `https://example.com` to locking them to a specific origin, such as, `https://foo.example.com`. To further enhance secur...

    chromestatus demo →

  3. Signature-based Integrity

    This feature provides web developers with a mechanism to verify the provenance of resources they depend upon, creating a technical foundation for trust in a site's dependencies. In short: servers can sign responses with ...

    chromestatus demo →

Chrome 134 (7)

  1. Allow reading interest groups in Shared Storage Worklet

    An interestGroups() method is added to the shared storage worklet, to return the Protected Audience interest groups associated with the shared storage origin's owner, with some additional metadata. This API provides the...

    chromestatus demo →

  2. Attribution Reporting Feature: Remove Aggregatable report limit when trigger context ID is non-null

    We are landing the following change to the Attribution Reporting API focused on: * Removing aggregatable report limit when trigger context ID is non-null

    chromestatus demo →

  3. Bounce Tracking Mitigations on HTTP Cache

    Bounce tracking mitigations for the HTTP cache is an extension to existing anti-bounce-tracking behavior. It removes the requirement that a suspected tracking site must have performed storage access in order to activate ...

    chromestatus demo →

  4. Document-Policy: expect-no-linked-resources

    The expect-no-linked-resources configuration point in Document Policy allows a document to hint to the user agent to better optimize its loading sequence, such as not using the default speculative parsing behavior. Us...

    chromestatus demo →

  5. Private Aggregation API: per-context contribution limits for Shared Storage callers

    Enables Shared Storage callers to customize the number of contributions per Private Aggregation report. This feature enables Shared Storage callers to configure per-context contribution limits via a new field, `maxContr...

    chromestatus demo →

  6. Protected Audience (B&A): Support multiple sellers in navigator.getInterestGroupAdAuctionData

    Add support for navigator.getInterestGroupAdAuctionData to return the encrypted B&A request payload for multiple sellers in a single call. This allows multiple sellers sharing a single piece of on-page JavaScript to more...

    chromestatus demo →

  7. Support Web Locks API in Shared Storage

    Today, concurrent execution of shared storage worklets in scenarios like cross-site reach measurement can result in duplicate reporting, due to the potential race conditions within the "get() and set()" logic. To address...

    chromestatus demo →

Chrome 133 (2)

  1. CSP hash reporting for scripts

    Complex web application often need to keep tabs of the subresources that they download, for security purposes. In particular, upcoming industry standards and best practices (e.g. PCI-DSS v4) require that web application...

    chromestatus demo →

  2. Partitioning Storage, Service Workers, and Communication APIs

    Note: this has launched in Chrome 115 We intend to partition a number of APIs in 3rd party contexts. This effort is focused on partitioning APIs above the network stack. This includes quota-managed storage, service wo...

    chromestatus demo →

Chrome 132 (10)

  1. Attribution Reporting API Feature (Aggregatable Named Budgets)

    We are landing the following change to the Attribution Reporting API focused on: * making it easier to predefine contribution budget allocation for aggregate reports

    chromestatus demo →

  2. Attribution Reporting API Feature (Change To ar_debug Cookie Requirement)

    We are landing the following change to the Attribution Reporting API focused on: * making it easier to receive API cookie-based debug reports

    chromestatus demo →

  3. Blob URL Partitioning: Fetching/Navigation

    As a continuation of Storage Partitioning, Chromium will implement partitioning of Blob URL access by Storage Key (top-level site, frame origin, and the has-cross-site-ancestor boolean), with the exception of top-level n...

    chromestatus demo →

  4. Document-Isolation-Policy

    Document-Isolation-Policy allows a document to enable crossOriginIsolation for itself, without having to deploy COOP or COEP, and regardless of the crossOriginIsolation status of the page. The policy is backed by process...

    chromestatus demo →

  5. Fenced frames - Send "Referer" header in beacons

    Reporting beacons (for FenceEvent-built destination enum events, FenceEvent-built automatic beacon events, and macro-substituted destination URL events) will have their "Referer" header set to the initiating frame's orig...

    chromestatus demo →

  6. Ignore Strict-Transport-Security for localhost

    Strict-Transport-Security response headers can cause problems for localhost web servers because STS applies host-wide, across all ports. This causes compatibility problems for web developers testing locally as well as en...

    chromestatus demo →

  7. Partitioning :visited links history

    To eliminate user browsing history leaks, anchor elements are styled as :visited only if they have been clicked from this top-level site and frame origin before. On the browser-side, this means that the VisitedLinks hash...

    chromestatus demo →

  8. Private Aggregation API: ignoring site exceptions for debug mode

    Currently, the availability of Private Aggregation’s debug mode is tied to a caller's eligibility to set a third-party cookie (see https://chromestatus.com/feature/5148973702840320). However, an edge case was missed in t...

    chromestatus demo →

  9. Private State Token API Permissions Policy Default Allowlist Wildcard

    Access to the Private State Token API is gated by Permissions Policy features. We proposed to update the default allowlist for both `private-state-token-issuance` and `private-state-token-redemption` features from self t...

    chromestatus demo →

  10. Protected Audience Auction Nonce Hardening

    Additional bids are a feature of the Protected Audience auction that provide buyers with a way to include server-constructed contextual bids in the auction, which allows negative targeting of those bids. We've identified...

    chromestatus demo →

Chrome 131 (4)

  1. Attribution-Reporting API: Remove aggregation key identifier size limit for trigger registrations

    Currently the aggregation key identifier length limit (https://wicg.github.io/attribution-reporting-api/#max-length-per-aggregation-key-identifier) is checked in both source and trigger registrations. As this limit is...

    chromestatus demo →

  2. Exempt Speculation-Rules Header from CSP restrictions

    This is somewhat of a bug-fix, but it's a web-exposed bug fix which deserves full web platform security review, so we're using the Intent to Ship process. When we initially shipped the Speculation-Rules header, we reuse...

    chromestatus demo →

  3. noopener-allow-popups COOP value

    Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages ...

    chromestatus demo →

  4. Private Aggregation API: increase contribution limit to 100 for Protected Audience callers

    Enables Protected Audience script runners to make up to 100 contributions per Private Aggregation report, compared to the current limit of 20. Private Aggregation limits the number of histogram contributions that can be...

    chromestatus demo →

Chrome 130 (4)

  1. Attribution Reporting API Feature (Attribution Scopes)

    We are landing the following changes to the Attribution Reporting API focused on: * providing more control over the attribution filtering

    chromestatus demo →

  2. Attribution Reporting API Feature (Debug Key Privacy Improvement)

    We are landing the following changes to the Attribution Reporting API focused on: * Improving privacy for debug keys This change helps to mitigate a potential privacy gap with debug keys. Currently the API allows ...

    chromestatus demo →

  3. Improved error reporting in IndexedDB for large value read failures

    Change to reporting for certain error cases that were previously reported through a DOMException with the message "Failed to read large IndexedDB value". Chromium 132 onwards, unrecoverable failures (such as due to file...

    chromestatus demo →

  4. Protected Audience Bidding & Auction Services

    The Protected Audience API (formerly known as FLEDGE) is a Privacy Sandbox proposal to serve remarketing and custom audience use cases, designed so third parties cannot track user browsing behavior across sites. This fea...

    chromestatus demo →