Planning your return to office strategy? See how ChromeOS can help.

Previous release notes

Note: For information about the current Chrome version and targeted releases, see Chrome Enterprise release notes.
 

For administrators who manage Chrome browser or ChromeOS devices for a business or school.

 

 

Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

 

Open all   |   Close all

Chrome 119

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Chrome release schedule changes    
Deprecate and remove WebSQL    
Native Client support updates    
Remove Sanitizer API    
Tab groups can be saved, recalled, and synced    
Deprecate non-standard shadowroot attribute for declarative shadow DOM    
Shifting UI strings in Chrome from Clear to Delete when getting rid of data    
DevTools internal errors reported to Chrome internal crash reporting    
Skip unload events    
SharedImages for PPAPI Video Decode    
Remove Authorization header upon cross-origin redirect    
Dedicated setting for Permission Suggestions Service    
Hash-prefix real-time lookups    
Remove recommended support from multiple policies    
Standard-compliant URL host punctuation characters    
Save images to Google Photos on iOS    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
Privacy Hub    
ChromeOS Admin templates    
Using Drive offline on Chromebook Plus  
Admin console updates Security/ Privacy User productivity/ Apps Management
New policies in the Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
Default Search Engine choice screen    
Rename FirstPartySets Enterprise Policies to RelatedWebsiteSets  
Revamped Safety Check on Desktop    
Chrome Desktop responsive toolbar    
Chrome on Android will no longer support Android Nougat    
Chrome Third-Party Cookie Deprecation     
Package tracking (iOS only)    
Network Service on Windows will be sandboxed    
Display banner allowing to resume last tab from other devices    
Resume the last opened tab on any device     
Unprefix -webkit-background-clip for text and make it an alias    
Chrome user policies for iOS    
Chrome profile separation: new policies    
Migrate away from data URLs in SVGUseElement  
Password Manager: password sharing  
Permissions prompt for Web MIDI API    
IP Protection Phase 0 for Chrome    
Apps & Extensions Usage Report: Highlight extensions removed from the Chrome Web Store    
Legacy Technology Report    
Remove support for UserAgentClientHintsGREASEUpdateEnabled    
Chrome Sync ends support for Chrome 81 and earlier      
Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy    
Intent to deprecate: Mutation Events    
Extensions must be updated to leverage Manifest V3
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
Set the screensaver duration    
New controls for mouse scroll acceleration    
Enhanced Alt + click behavior    
New look for ChromeOS media player    
Enhanced notifications for pinned apps    
New ChromeOS sync options  
App disablement by Admin in MGS    

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

   

  • Chrome release schedule changes back to top

    Chrome 119 and all subsequent releases will be moved forward by one week. For example, Chrome 119 has its early stable release on October 25 instead of Nov 1. Beta releases will also be moved forward by one week starting in Chrome 119.

    For more details, see the Chrome Release Schedule.
     
    • Chrome 119 on Android, iOS, ChromeOS, Linux, Mac, Windows

   

  • Deprecate and remove WebSQL back to top

    With SQLite over WASM as its official replacement, we plan to remove WebSQL entirely. This will help keep our users secure.

    The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. Gecko never implemented this feature and WebKit deprecated this feature in 2019. The W3C encouraged those needing web databases to adopt Web Storage or Indexed Database. 

    Ever since its release, it has made it incredibly difficult to keep our users secure. SQLite was not initially designed to run malicious SQL statements, and yet with WebSQL we have to do exactly this. Having to react to a flow of stability and security issues is an unpredictable cost to the storage team. 
     
    • Chrome 115: Deprecation message added to console.
    • Chrome 117: In Chrome 117 the WebSQL Deprecation Trial starts. The trial ends in Chrome 123. During the trial period, a policy, WebSQLAccess, is needed for the feature to be available.
    • Chrome 119: Starting Chrome 119, WebSQL is no longer available. Access to the feature is available until Chrome 123 using the WebSQLAccess policy.
    • Chrome 123: on Chrome OS, LaCrOS, Linux, Mac, Windows: Starting in Chrome 123, the policy WebSQLAccess, which allows for WebSQL to be available will no longer be available.

   

  • Native Client support updates back to top

    Chrome 119 removes a temporary enterprise policy, NativeClientForceAllowed, which allowed Native Client to continue to be used.
     
    • Chrome 117 on Linux, Mac, Windows: Removes Native Client NaCl support from extensions on Windows, macOS, Linux.
    • Chrome 119 on Linux, Mac, Windows: Removes NativeClientForceAllowed policy.

   

  • Remove Sanitizer API back to top

    To prevent the current Sanitizer API from becoming entrenched, we plan to remove the current implementation. We expect to re-implement the Sanitizer API when the proposed specification stabilizes again.

    The Sanitizer API aims to build an easy-to-use, always secure, browser-maintained HTML sanitizer into the platform. We shipped an initial version of the Sanitizer API in Chrome 105, based on the then-current specification draft. However, the standards discussion has meanwhile moved on and the proposed API shape has changed substantially. 
     
    • Chrome 119 on Windows, Mac, Linux, Android 

   

  • Tab Groups can be saved, recalled, and synced back to top

    Users can now save tab groups, which allows them to close and re-open the tabs in the group, as well as sync them across devices. You can disable syncing Tab Groups using the  SyncTypesListDisabled policy.
     
    • Chrome 119 on ChromeOS, Linux, Mac, Windows

   

  • Deprecate non-standard shadowroot attribute for declarative Shadow DOM back to top

    The standards-track shadowrootmode attribute, which enables declarative Shadow DOM, was shipped in Chrome 111 (ChromeStatus). The older, non-standard shadowroot attribute is now deprecated. During the deprecation period, both attributes are functional, however the shadowroot attribute does not enable the new streaming behavior, whereas shadowrootmode allows streaming of content. There is a straightforward migration path: replace shadowroot with shadowrootmode

    The old shadowroot attribute is deprecated as of Chrome 112, and it will be removed (no longer supported) in Chrome 119. Chrome 119 goes to Stable on October 31, 2023. 
     
    • Chrome 119 on Windows, Mac, Linux, Android 

   

  • Shifting UI strings in Chrome from Clear to Delete when getting rid of data back to top

    Chrome is updating settings text to reflect delete instead of clear when referring to the destruction of data. We expect this change to improve users’ understanding of the associated effect on data. Users who intend to get rid of data should feel reassured that the data is actually deleted, not just cleared from one view but possibly accessible elsewhere. 
     
    • Chrome 119 on Android, iOS, ChromeOS, Mac, Windows: The earliest milestone that users may see these changes is 119. 

   

  • DevTools internal errors reported to Chrome internal crash reporting back to top

    To improve Chrome's stability, DevTools internal errors are now reported through Chrome's existing crash reporting pipeline. This provides visibility of the stability of Chrome DevTools. Admins can control all crash reporting, including these errors, using the MetricsReportingEnabled enterprise policy.
     
    • Chrome 119 on ChromeOS, Linux

   

  • Skip unload events back to top

    The presence of unload event listeners is a primary blocker for back/forward cache on Chromium based browsers and for Firefox on desktop platforms. On the other hand, for mobile platforms, almost all browsers prioritize the bfcache by not firing unload events in most cases. To improve the situation, we’ve been working with lots of partners and successfully reduced the use of unload event listeners over the last few years. To further accelerate this migration, we propose to have Chrome for desktop gradually skip unload events. 

    In case you need more time to migrate away from unload events, we’ll offer temporary opt-outs in the form of a Permissions-Policy API and an enterprise policy ForcePermissionPolicyUnloadDefaultEnabled, which will allow you to selectively keep the behavior unchanged.
     
    • Chrome 117 on Chrome OS, Linux, Mac, Windows: Dev Trial
    • Chrome 119 on Chrome OS, Linux, Mac, Windows: Introduces ForcePermissionPolicyUnloadDefaultEnabled policy
    • Chrome 120-131 on Chrome OS, Linux, Mac, Windows: Deprecation trial (general rollout of deprecation will be limited scope until deprecation trial is ready)

   

  • SharedImages for PPAPI Video Decode back to top

    Chrome 119 introduces a new PPAPISharedImagesForVideoDecoderAllowed policy to control the recent refactor for VideoDecoder APIs in PPAPI plugin. 
     
    • Chrome 119 on ChromeOS, LaCrOS: Introduces escape hatch policy.
    • Chrome 122 on ChromeOS, LaCrOS: Escape hatch policy and corresponding old code paths are removed.

   

  • Remove Authorization header upon cross-origin redirect back to top

    The Fetch standard has been updated to remove Authorization header on cross origin redirects. Chrome 119 implements this change to the specification. Prior to Chrome 119, when a cross origin redirect, such as from foo.test to bar.test, happened with an Authorization header, Chrome preserved the Authorization header and bar.test could receive the header. Starting Chrome 119, Chrome removes Authorization headers when cross origin redirects happen, meaning that bar.test no longer receives the Authorization header.

    • Chrome 119 on ChromeOS, Windows, Mac, Linux, Android

   

  • Dedicated setting for Permission Suggestions Service back to top

    The settings page for notification and geolocation permissions now has an additional option to explicitly enable the Permission Suggestions Service. Permission Suggestions Service is an already existing feature, but it didn’t have its dedicated setting. It was tied to standard Safe Browsing settings being enabled. Now the users can choose between four different states:
    1. Always show the notification/geolocation permission prompt
    2. Let Permission Suggestion Service quieten unwanted notification/geolocation requests (new)
    3. Always quieten notification permission requests
    4. Always block notifications/geolocation permission requests
    Admins can use the existing policies to either always allow or always block notifications or geolocation requests globally or for particular sites.  
    • Chrome 119 on Linux, Mac, Windows
     
    notification for permissions suggestions service

   

  • Hash-prefix real-time lookups back to top

    For standard Safe Browsing protection users, visited URLs now have their safety checked in real time instead of against a less frequently updated local list of unsafe URLs. This is done by sending partial hashes of the URLs to Google Safe Browsing through a proxy via Oblivious HTTP, so that the user’s IP address is not linked to the partial hashes. This change improves security while maintaining privacy for users. If needed, the feature can be disabled through the policy SafeBrowsingProxiedRealTimeChecksAllowed.
     
    • Chrome 119 on Android, iOS, Chrome OS, LaCrOS, Linux, Mac, Windows

   

  • Remove recommended support from multiple policies back to top

    Some policies can be applied as recommended, allowing administrators to set an initial value which end-users can later change. Beginning in Chrome 119, recommended support will be removed from multiple policies which end-users currently have no way of configuring.

    Any affected policies that were previously set as recommended will need to be set as mandatory to ensure they continue to take effect.
     

   

  • Standard-compliant URL host punctuation characters back to top

    Chrome 119 continues our efforts to make Chrome's handling of URL host punctuation characters standard-compliant. Here is a summary of changes in Chrome 119:
     

    Notation:

    - 'ESC': Allowed, but Chrome escapes it, which is non-compliant.

    - '-':  Allowed.

    - '0': Forbidden. URL will be invalid if the host contains a forbidden character.

    Warning:

    - SPACE and ASTERISK are still non-compliant.

    URL character map
    • Chrome 119 on Windows, Mac, Linux, Android

   

  • Save images to Google Photos on iOS back to top

    When a signed-in user long-presses on an image in Chrome, they can save it directly to Google Photos. They have the option to save it to any account logged in on the device.
     
    • Chrome 119 on iOS: Users can directly save images to Google photos
    • Chrome 120 on iOS: A policy is introduced to control this functionality
      save images iOS

   

   

  • Removed policies in Chrome browser   back to top

    Policy Description
    ChromeCleanupEnabled Enable Chrome Cleanup on Windows
    DownloadBubbleEnabled Enable download bubble UI
    ChromeCleanupReportingEnabled Control how Chrome Cleanup reports data to Google

ChromeOS updates

   

  • Privacy Hub back to top

    Users can now manage their camera and microphone settings across the operating system from one place in Settings>Security and Privacy>Privacy controls. Now it only takes one click for users to completely turn off their camera or microphone all from one place when they need extra confidence in staying on mute.
    privacy hub  

   

  • ChromeOS Admin templates back to top

    With App Launch Automation, admins can now configure groups of applications, windows and tools that can be launched automatically on startup or on-demand by users throughout their day. With App Launch Automation, you can get users up and running quickly at the start of their day, provide users with a way to easily get to an optimal starting point for new tasks, and remember the window layout each user sets up for their individual workflows for future use.

    You can turn on this feature using the #app-launch-automation flag, and then create templates in the Admin console.
      admin templates  

   

  • Using Drive offline on Chromebook Plus devices back to top

    Enterprise users on Chromebook Plus devices can now easily make all of their files in the My Drive section of Google Drive available offline. You can control this using the DriveFileSyncAvailable enterprise policy.
      Drive access files  

Admin console updates

 

   

↑ back to top  

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

  • Default Search Engine choice screen back to top 

    As early as Chrome 120, enterprise end-users might be prompted to choose their default search engine within Chrome.

    As part of our building for DMA compliance, some users will be prompted to choose their default search engine for Chrome. This prompt controls the default search engine setting, currently available at chrome://settings/search. The enterprise policies, DefaultSearchProviderEnabled and DefaultSearchProviderSearchUrl, will continue to control this setting as it does today, if it is set by the IT admin. Read more on this policy and the related atomic group.
     
    • Chrome 120 on iOS, Chrome OS, LaCrOS, Linux, Mac, Windows: 1% users will start getting the choice screen with Chrome 120. 100% by Chrome 122.
 

   

  • Rename FirstPartySets enterprise policies to RelatedWebsiteSets back to top 

    The FirstPartySetsEnabled and FirstPartySetsOverrides enterprise policies are renamed to RelatedWebsiteSetsEnabled and RelatedWebsiteSetsOverrides respectively. There is no change in the policies’ behavior. The new policies become available from Chrome 120. Administrators should use them going forward. To learn more about the rename, follow https://developer.chrome.com/blog/related-website-sets/
     
    • Chrome 120 on Android, Chrome OS, LaCrOS, Linux, Mac, Windows, Fuchsia
 

   

  • Revamped Safety Check on Desktop back to top 

    We plan to introduce a new proactive Safety Check that regularly checks the browser for safety-related issues and informs users when there's anything that needs their attention. This launch also introduces a new page with Chrome’s proactive safety-related actions and information tailored to each user, designed to make it easier for users to stay safe online.
     
    • Chrome 120 on ChromeOS, LaCrOS, Linux, Mac, Windows
    safety check  
 

   

  • Chrome Desktop responsive toolbar back to top 

    As early as Chrome 120, Chrome Desktop customers across devices and input modes (for example, Mouse or Touch) will experience a toolbar that seamlessly responds to changing window sizes, when users manually select and resize a window or use OS-specific window management tools.
     
    • Chrome 120 on ChromeOS, LaCrOS, Linux, Mac, Windows
 

   

  • Chrome on Android will no longer support Android Nougat back to top 

    The last version of Chrome that supports Android Nougat is Chrome 119, and it includes a message to affected users informing them to upgrade their operating system. 
     

    Chrome 120 will not support nor ship to users running Android Nougat.
     

    • Chrome 120 on Android: Chrome on Android no longer supports Android Nougat
 

   

  • Chrome Third-Party Cookie deprecation back to top 

    In Chrome 120 and beyond (Jan 2024), Chrome will globally disable third-party cookies for 1% of Chrome traffic as part of our Chrome-facilitated testing in collaboration with the CMA. This will allow sites to meaningfully preview what it's like to operate in a world without third-party cookies. Most enterprise users will be excluded from this experiment group automatically. But for the few that might be affected, admins will be able to use the BlockThirdPartyCookies and CookiesAllowedForUrls policies to re-enable third-party cookies and opt out their managed browsers ahead of the experiment. This will give enterprises time to make the changes required to not rely on this policy or third-party cookies. 

    We plan to provide more tooling to help identify third-party cookies use cases. Admins can set the BlockThirdPartyCookies policy to false to re-enable third-party cookies for all sites but this will prevent users from changing the corresponding setting in Chrome. Alternatively, to prevent breakage, you can set the CookiesAllowedForUrls policy to allowlist your enterprise applications to continue receiving third-party cookies.

    For more details on how to prepare, provide feedback and report potential site issues, refer to the Mode B: 1% third-party cookie deprecation blog section and the Preparing for the end of third-party cookies blog.
     
    • Chrome 120 on ChromeOS, Linux, Mac, Windows
      1% of global traffic has third-party cookies disabled. Enterprise users are excluded from this automatically where possible, and a policy is available to override the change.
 

   

  • Package tracking (iOS only) back to top 

    Users will be able to enable a new package tracking feature that results in estimated delivery dates and package status appearing in a new card on the New tab page. This feature is only supported for en-US users and only for packages fulfilled via FedEx and USPS. If needed, you will be able to turn off the feature using a new policy called ParcelTrackingEnabled
     
    • Chrome 120 on iOS: feature launches
    parcel delivery check  
 

   

  • Network Service on Windows will be sandboxed back to top 

    To improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.
     
    • Chrome 120 on Windows: Network Service sandboxed on Windows
 

   

  • Display banner allowing to resume last tab from other devices back to top 

    To help signed-in users resume tasks when they have to switch devices immediately, Chrome will offer to pick up tabs recently used on the previous device. Admins will be able to control this feature using an existing enterprise policy called SyncTypesListDisabled.
     
    • Chrome 120 on iOS: Feature launches
    display banner  

   

  • Resume the last opened tab on any device back to top 

    For the last open tab on any device within the last 24 hours with the same signed-in user profile, Chrome will offer users with a quick shortcut to resume that tab. Admins will be able to control this feature using an existing enterprise policy called SyncTypesListDisabled.
     
    • Chrome 120 on iOS: Feature launches
 

   

  • Unprefix -webkit-background-clip for text and make it an alias back to top 

    Chrome will allow the use of the unprefixed version for background-clip: text and will make -webkit-background-clip an alias for background-clip. Also, it drops support for non-suffixed keywords (content, padding and border) for better round-trip with alias.
     
    • Chrome 120 on Windows, Mac, Linux, Android
 

   

  • Chrome user policies for iOS back to top 

    Admins can apply policies and preferences across a user's devices. Settings apply whenever the user signs in to Chrome browser with their managed account on any device. This functionality already exists on Windows, Mac, Linux, ChromeOS and Android.  We are in the process of bringing this functionality to iOS.
     
    • Chrome 120 on iOS: The earliest milestone for this capability is 120. 
 

   

 

   

  • Migrate away from data URLs in SVGUseElement back to top 

    The SVG spec was recently updated to remove support for data: URLs in SVGUseElement. This improves security of the Web platform as well as compatibility between browsers as Webkit does not support data: URLs in SVGUseElement. You can read more in this blog post. 

    Assigning a data: URL in SVGUseElement can cause XSS. And this also led to a Trusted Types bypass.

    For enterprises that need additional time to migrate, the DataUrlInSvgUseEnabled policy will be available until Chrome 128 to re-enable Data URL support for SVGUseElement.
     
    • Chrome 120 on Android, ChromeOS, LaCrOS, Linux, Mac, Windows, Fuchsia: Remove support for data: URLs in SVGUseElement
 

   

  • Password Manager: password sharing back to top 

    Password Manager allows users to share their passwords with members of their Google Family Group (as configured in their Google Account). Users  can only share one password at a time. It is not possible to share passwords in bulk. The shared password cannot be updated or revoked by the sender.

    Enterprise admins can use the PasswordSharingEnabled policy to switch off the share feature for all their employees.
     
    • Chrome 120 on iOS, Chrome OS, LaCrOS, Linux, Mac, Windows, Fuchsia
 

   

  • Permissions prompt for Web MIDI API back to top 

    There have been several reported problems around Web MIDI API's drive-by access to client MIDI devices (bugs). To address this problem, the Audio WG decided to place an explicit permission on the general MIDI API access. Originally, the explicit permission was only required for the advanced MIDI usage, for example,  system exclusive (SysEx) message in Chrome, with gated access behind a permissions prompt. We plan to  expand the scope of the permission to regular MIDI API usage.

    Today the use of SysEx messages with the Web MIDI API requires an explicit user permission. With this implementation, even access to the Web MIDI API without SysEx support will require a user permission. Three new policies—DefaultMidiSetting, MidiAllowedForUrls and MidiBlockedForUrls—will be available to allow administrators to pre-configure user access to the API.
     
    • Chrome 121 on Windows, Mac, Linux, Android 
 

   

  • IP Protection Phase 0 for Chrome back to top 

    As early as Chrome 122, Chrome might route traffic for some network requests to Google-owned resources through a privacy proxy. This is an early milestone in a larger effort to protect users' identities by masking their IP address from known cross-site trackers. More information is available in this explainer on GitHub. Enterprise policies will be in place to allow admins to turn off the feature before it’s launched.
     
    • Chrome 122 on ChromeOS, Linux, Mac, Windows, Android
 

   

  • Apps & Extensions Usage report: Highlight extensions removed from the Chrome Web Store back to top 

    As early as 122, Chrome is adding new information on the Apps & Extensions Usage Report to help you identify if an extension was recently removed from the Chrome Web Store. On the App Details page, you can find the reason why an extension was removed from the Chrome Web Store. This feature will help IT administrators identify the impact of using the policy to disable unpublished extensions.
     
    • Chrome 122 on LaCrOS, Linux, Mac, Windows
 

   

  • Legacy Technology report back to top 

    As early as Chrome 122, the Legacy Technology report will be available in the Admin console and it will proactively report websites (both internal and external) that are using technology that will be deprecated e.g. SameSite cookie changes, or older security protocols like TLS 1.1/1.1. This gives admins the ability to work with developers to plan required tech migrations before the deprecation goes into effect.  If you’re interested in helping us test this feature, you can sign up for our Trusted Tester program here.
     
    • Chrome 122 on LaCrOS, Linux, Mac, Windows
 

   

  • Remove support for UserAgentClientHintsGREASEUpdateEnabled back to top 

    We plan to deprecate the UserAgentClientHintsGREASEUpdateEnabled policy since the updated GREASE algorithm has been on by default for over a year. The policy will eventually be removed. 
     
    • Chrome 122 on Android, ChromeOS, Linux, Mac, Windows: Policy is deprecated
    • Chrome 125 on Android, ChromeOS, Linux, Mac, Windows: Policy is removed
 

   

  • Chrome Sync ends support for Chrome 81 and earlier back to top 

    Chrome Sync will no longer support Chrome 81 and earlier. You need to upgrade to a more recent version of Chrome if you want to continue using Chrome Sync.
     
    • Chrome 123 on Android, iOS, Chrome OS, Linux, Mac, Windows: The change will be implemented.
 

   

  • Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy back to top 
    In Chrome 79, we introduced the LegacySameSiteCookieBehaviorEnabledForDomainList policy to revert the SameSite behavior of cookies to legacy behavior on the specified domains. The LegacySameSiteCookieBehaviorEnabledForDomainList policy’s lifetime has been extended and will be removed on the milestone listed below.
     
    • Chrome 127 on Android, ChromeOS, Linux, Mac, Windows: Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy

   

  • Intent to deprecate: Mutation Events back to top 

    Synchronous Mutation Events, including DOMSubtreeModified, DOMNodeInserted, DOMNodeRemoved, DOMNodeRemovedFromDocument, DOMNodeInsertedIntoDocument, and DOMCharacterDataModified, negatively affect page performance, and also significantly increase the complexity of adding new features to the Web. These APIs were deprecated from the spec in 2011, and were replaced (in 2012) by the much better-behaved Mutation Observer API. Usage of the obsolete Mutation Events must be removed or migrated to Mutation Observer.
     
    • Chrome 127 on Android, ChromeOS, Linux, Mac, Windows: Mutation Events will stop functioning in Chrome 127, around July 30, 2024.

   

  • Extensions must be updated to leverage Manifest V3 back to top 

    Extensions must be updated to leverage Manifest V3. Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. As mentioned earlier in our blog post , the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed. During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3. An Enterprise policy ExtensionManifestV2Availability is available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management. Read more on the Manifest timeline, including: 
     
    • Chrome 98 on ChromeOS, LaCrOS, Linux, Mac, Windows: Chrome Web Store stops accepting new Manifest V2 extensions with visibility set to "Public" or "Unlisted". The ability to change Manifest V2 extensions from "Private" to "Public" or "Unlisted" is removed.
    • Chrome 103 on ChromeOS, LaCrOS, Linux, Mac, Windows: Chrome Web Store stops accepting new Manifest V2 extensions with visibility set to "Private".
    • Chrome 110 on ChromeOS, LaCrOS, Linux, Mac, Windows: Enterprise policy ExtensionManifestV2Availability is available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions.
    • Future milestone on ChromeOS, LaCrOS, Linux, Mac, Windows: Remove ExtensionManifestV2Availability policy.

↑ back to top  

Upcoming ChromeOS changes

   

  • Set the screensaver duration back to top

    As early as ChromeOS 120, you will be able to set the duration for screensaver while charging. Users can now choose how long their screensaver runs while their device is charging (not on battery). You can control this using a new enterprise policy. The default setting is Forever, and can be reduced using drop-down options.

   

  • New controls for mouse scroll acceleration back to top

    ChromeOS 120 will add new controls to let users disable mouse scroll acceleration and adjust the speed of the scrolling.

   

  • Enhanced Alt + click behavior back to top

    In ChromeOS 120, you will be able to configure right-click behavior using the keyboard and touchpad. You can also configure settings for actions such as Home, End, and Page Up, in the Customize keyboard keys subpage. 
    alt click enhancements
     
    alt click enhancements

   

  • New look for ChromeOS media player back to top

    As early as ChromeOS 121, the media player will have bigger buttons and colors to match your wallpaper. The media player will appear when you are playing any video or audio (like Spotify or YouTube) in Quick Settings. You will be able to click the pin icon to move the media player to the shelf. In addition to controlling media that is being cast, you will be able to start casting web media to any speakers or screens on your local network.    
    new media design

   

  • Enhanced notifications for pinned apps back to top

    As early as ChromeOS 121, you will be able to visually separate pinned notifications from other notifications. We will change the visual specs, buttons, and notification text to fit within fixed size bubbles. This significantly differentiates the visual look of pinned notifications from typical notifications to reflect their significant difference in purpose (notifying the user of an ongoing process rather than an instantaneous event).

   

  • New ChromeOS sync options back to top

    ChromeOS will soon deliver an updated device setup experience that lets users customize sync settings for apps, settings, wi-fi networks, and wallpaper.

   

  • App disablement by Admin in MGS back to top

    Up until now, Managed Guest Sessions (MGS) include a set of applications (Explore, Gallery, and Terminal apps) that are available to the user. With the SystemFeaturesDisableList policy, Admins will soon be able to disable these apps, blocking and hiding them from users across your enterprise.

↑ back to top  

Chrome 118

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Remove ForceMajorVersionToMinorPositionInUserAgent policy    
Remotely disable malicious off-store extensions    
Remove RendererCodeIntegrityEnabled policy    
Support for passkeys in iCloud Keychain on macOS  
Hash-prefix real-time lookups    
Updates to the red Safe Browsing interstitials  
Form controls support vertical writing mode    
Block all cookies set via JavaScript that contain control characters    
Clearer Safe Browsing protection level settings text and images    
WebUSB in Extension Service Workers    
Include chrome.tabs API calls in extension telemetry reports    
Remove non-standard appearance keywords    
Enrollment for Privacy Sandbox     
Discounts shown on product pages and on Quests on the New Tab Page    
Encrypted archive deep scanning for Enhanced Safe Browsing users    
Flag for enabling the chrome://policy/test page    
TLS Encrypted Client Hello (ECH)    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
Password recovery    
Tabbed PWAs    
Printer setup assistance    
Imprivata integration v4  
Touch text editing redesign    
Admin console updates Security/ Privacy User productivity/ Apps Management
New policies in the Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
Chrome release schedule changes    
Deprecate and remove WebSQL    
Native Client support updates    
Migrate away from data URLs in SVG <use> element  
Network Service on Windows will be sandboxed    
Display banner allowing to resume last tab from other devices    
Remove Sanitizer API    
Tab groups can be saved, recalled, and synced    
Chrome profile separation: new policies    
Private Network Access restrictions for automotive    
Deprecate non-standard shadowroot attribute for declarative shadow DOM    
Remove support for UserAgentClientHintsGREASEUpdateEnabled    
Default Search Engine choice screen    
Shifting UI strings in Chrome from Clear to Delete when getting rid of data    
DevTools internal errors will be reported to Chrome internal crash reporting    
SharedImages for PPAPI Video Decode    
Private Aggregation API bundled enhancements  
Remove Authorization header upon cross-origin redirect    
Revamped Safety Check on Desktop    
Permissions prompt for Web MIDI API    
Desktop Responsive Toolbar    
Chrome on Android will no longer support Android Nougat    
Chrome Third-Party Cookie Deprecation (3PCD)    
IP Protection Phase 0 for Chrome    
Apps & Extensions Usage Report: Highlight extensions removed from the Chrome Web Store    
Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy    
Intent to deprecate: Mutation Events    
Extensions must be updated to leverage Manifest V3
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
Privacy Hub    
ChromeOS Admin templates    
Upcoming Admin console changes Security/ Privacy User productivity/ Apps Management
URL-keyed anonymized data collection in Kiosk mode    

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

   

  • Remove ForceMajorVersionToMinorPositionInUserAgent policy back to top

    Chrome 118 removes the ForceMajorVersionToMinorPositionInUserAgent policy. This policy was introduced in Chrome 99 to control whether the User-Agent string major version would be frozen at 99, in case of User-Agent string parsing bugs when the version changed to 100. Fortunately, we did not need to deploy this feature and only encountered a few minor 3-digit version parsing issues that have all since been fixed. Given that, we can now remove this policy. If you have any feedback about this policy removal, or are aware of intranet functionality that depends on the policy, comment on this bug. 

   

  • Remotely disable malicious off-store extensions back to top

    When Enhanced Safe Browsing is enabled, where users have a malicious off-store extension installed,  the extension is disabled when the decision is entered on the Safe Browsing servers via either manually or by an automated detection system.
    • Chrome 118 on ChromeOS, Linux, Mac, Windows: Feature launches

   

  • Remove RendererCodeIntegrityEnabled policy back to top

    The Renderer Code Integrity security feature is no longer controlled by the RendererCodeIntegrityEnabled policy; it is now switched on by default. We recommend that you verify any potential incompatibilities with third party software by no longer using the policy in advance of this release. To report any issues you encounter, submit a bug here.
    • Chrome 118 on Windows: This policy is deprecated and will no longer take effect

   

  • Support for passkeys in iCloud Keychain on macOS back to top

    Chrome on macOS ≥ 13.5 now supports creating and using passkeys from iCloud Keychain. When signing in using WebAuthn, passkeys from iCloud Keychain are listed as options once the user has granted Chrome the needed permission. If permission has not been granted, a generic iCloud Keychain option appears that prompts for permission before showing iCloud Keychain passkeys. If permission is denied, the iCloud Keychain can still be used, but it has to be manually selected each time. 

    When a site asks to create a platform passkey, Chrome might default to creating the passkey in iCloud Keychain based on whether iCloud Drive is in use and whether WebAuthn credentials from the current profile have been recently used. This can be controlled with a setting on chrome://password-manager/settings, and with the enterprise policy CreatePasskeysInICloudKeychain.
    • Chrome 118 on Mac: Chrome 118 supports iCloud Keychain. Whether Chrome defaults to creating platform passkeys in iCloud Keychain can be altered by Chrome Variations during the lifetime of 118.

   

  • Hash-prefix real-time lookups back to top

    For standard Safe Browsing protection users, visited URLs now have their safety checked in real time, instead of less frequently using an updated local list of unsafe URLs. This is done by sending partial hashes of the URLs to Google Safe Browsing through a proxy via Oblivious HTTP, so that the user’s IP address is not linked to the partial hashes. This change improves security while maintaining privacy for users. If needed, you can control this feature using the SafeBrowsingProxiedRealTimeChecksAllowed policy.
    • Chrome 118 on iOS, ChromeOS, LaCrOS, Linux, Mac, Windows

   

  • Updates to the red Safe Browsing interstitials back to top

    In Chrome 118, users see minor updates to the red Safe Browsing interstitials. The main body text now includes an explicit recommendation from Chrome and site ID is specified in the details section instead of the main body. The danger icon replaces the previous warning icon, and styling is now consistent with the latest product standards. These changes improve user comprehension of warnings.
    • Chrome 118 on Android, iOS, ChromeOS, LaCrOS, Linux, Mac, Windows
    red safe browsing

   

  • Form controls support vertical writing mode back to top

    The CSS property writing-mode should be enabled for form controls elements as it allows lines of text to be laid out horizontally or vertically and it sets the direction in which blocks progress. 

    With this feature, we are allowing the form control elements select, meter, progress, button, textarea and input to have vertical-rl or vertical-lr writing mode. As needed for Web compatibility, we now begin to slowly roll out the change for a number of form controls in 118, and we will continue in future milestones.

    You can control this feature with the following command line flags:

    --enable-features= FormControlsVerticalWritingModeSupport
    --enable-features= FormControlsVerticalWritingModeTextSupport
    • Chrome 118 on Windows, Mac, Linux, Android 

   

  • Block all cookies set via JavaScript that contain control characters back to top

    Updates how control characters in cookies set via JavaScript are handled. Specifically, all control characters cause the entire cookie to be rejected (previously a NULL character, a carriage return character, or a line feed character in a cookie line caused it to be truncated instead of rejected entirely, which could have enabled malicious behavior in certain circumstances). This behavior aligns Chrome with the behavior indicated by the latest drafts of RFC6265bis

    You can control this feature  using the --disable-features=BlockTruncatedCookies or the BlockTruncatedCookies enterprise policy, which will be available for several milestones in case this change causes any breakage.
    • Chrome 118 on Windows, Mac, Linux, Android 

   

  • Clearer Safe Browsing protection level settings text and images back to top

    In Chrome 118, some users see new text describing the Safe Browsing protection level on both the Security Settings page and the Privacy Guide. The update clarifies the Enhanced Protection level by adding a table and linking to a help center article where users can learn more. The new table helps users understand the trade-offs when selecting that option versus choosing the other options. The descriptions for Standard Protection, No Protection and the password compromise warnings toggle have been simplified to make the options clearer. The Safe Browsing protection level is an existing feature, still controlled by the SafeBrowsingProtectionLevel policy.
    • Chrome 118: Some users see the updated text and images on the Chrome Security Settings page and on the Privacy Guide.
      clearer safe browsing

   

  • WebUSB in Extension Service Workers back to top

    Web developers can use the WebUSB API when responding to extension events by exposing WebUSB API to Service Workers registered by browser extensions. This API is not yet exposed to Service Workers registered by sites but the implementation experience gained by supporting the API for extensions will be valuable for such a future project.
    • Chrome 118 on Windows, Mac, Linux, ChromeOS 

   

  • Include chrome.tabs API calls in extension telemetry reports back to top

    When you switch on Enhanced Safe Browsing, Chrome now collects telemetry information about chrome.tabs API calls made by extensions. This information is analyzed on Google servers and further improves the detection of malicious and policy violating extensions. It also allows better protection for all Chrome extension users. You can turn off this functionality along with the extension telemetry feature by setting SafeBrowsingProtectionLevel to any value other than 2, which turns off Enhanced Safe Browsing.
    • Chrome 118 on ChromeOS, Linux, Mac, Windows: Feature launches

   

  • Remove non-standard appearance keywords back to top

    Since only standard appearance keywords should be supported, Chrome 118 removes appearance (and -webkit-appearance) keywords, including: 
     

    * inner-spin-button 

    * media-slider

    * media-sliderthumb 

    * media-volume-slider 

    * media-volume-sliderthumb 

    * push-button 

    * searchfield-cancel-button 

    * slider-horizontal 

    * sliderthumb-horizontal 

    * sliderthumb-vertical 

    * square-button 


    Note that value slider-vertical will not be removed as part of this patch; it is used for allowing <input type=range> vertical. It will be removed once feature FormControlsVerticalWritingModeSupport is enabled in Stable. 

    Previously, if using any of the above keywords, a console warning appeared, but the keyword was  recognized as a valid value. With the feature enabled, the appearance property will be ignored and set to the empty string. As needed for Web compatibility, we will progressively remove the appearance keywords based on their counter usages on Chrome Status Metrics. 

    For Chrome 118, we start with the following keywords, currently at page load usage below 0.001%: 
     

    * media-slider at 0.000361 

    * media-sliderthumb at 0.000187% 

    * media-volume-slider at 0.000143% 

    * media-volume-sliderthumb at 0.000109% 

    * sliderthumb-horizontal at 0.000182% 

    * sliderthumb-vertical at 0.000014%

    • Chrome 118 on Windows, Mac, Linux, Android  

   

  • Enrollment for Privacy Sandbox  back to top

    As the Privacy Sandbox relevance and measurement APIs start ramping up for general availability, we want to make sure these technologies are used as intended and with transparency. The APIs include Attribution Reporting, the Protected Audience API, Topics, Private Aggregation and Shared Storage. Privacy Sandbox is introducing a new Developer Enrollment process for Privacy Sandbox relevance and measurement APIs. Chrome will fetch the enrolled-sites list from the enrollment server (via component updater) and use it to gate access to the Privacy Sandbox APIs.
    • Chrome 118 on Windows, Mac, Linux, Android

   

  • Discounts shown on product pages and on Quests on the New tab page back to top

    Starting in Chrome 118, users sometimes see discounts, shown as annotations on page visits, in the Quests cards shown on the New tab page. Clicking through on the discount shows the relevant information on the product page. Quests as a whole are controlled by the NTPCardsVisible policy. Users also sometimes see discounts directly on the product page, available through an icon in the Omnibox.
    • Chrome 118 on ChromeOS, LaCrOS, Linux, Mac, Windows

   

  • Encrypted archive deep scanning for Enhanced Safe Browsing users back to top

    Google Chrome offers deep scanning of some suspicious downloads to users who have opted in to Enhanced Safe Browsing. This sends the file content to Safe Browsing for a real-time evaluation of the file's safety. Starting in Chrome 118, deep scans of encrypted archives, for example, ZIP and RAR files, prompt the user to provide the archive password along with the file content. This is necessary for Safe Browsing to provide a useful verdict about the contents of the archive. Enterprises who do not want to see this prompt can prevent users from enabling Enhanced Safe Browsing with the SafeBrowsingProtectionLevel policy. Starting in Chrome 119, enterprises who want to switch off file deep scans while still enabling Enhanced Safe Browsing can do so with the SafeBrowsingDeepScanningEnabled policy.
    • Chrome 118 on ChromeOS, LaCrOS, Linux, Mac, Windows

   

  • Flag for enabling the chrome://policy/test page back to top

    The #enable-policy-test-page flag allows admins and developers to use the chrome://policy/test page to more easily test policies on the Beta, Dev, Canary channels. 
    • Chrome 118 on Android, iOS, ChromeOS, Linux, Mac, Windows

   

  • TLS Encrypted Client Hello (ECH) back to top

    The TLS Encrypted ClientHello (ECH) extension allows clients to encrypt ClientHello messages, which are normally sent in cleartext, under a server’s public key. This allows websites to opt-in to avoid leaking sensitive fields, like the server name, to the network by hosting a special HTTPS RR DNS record. (Earlier iterations of this extension were called Encrypted Server Name Indication, or ESNI.) If your organization’s infrastructure relies on the ability to inspect SNI, for example, filtering, logging, and so on, you should test it. You can enable the new behavior by navigating to chrome://flags and enabling the #encrypted-client-hello flag. If you notice any incompatibilities, you can use the EncryptedClientHelloEnabled enterprise policy to disable support for ECH.
    • Chrome 118 on Chrome OS, Linux, Mac, Windows: Rolled out to 100% of users

   

   

  • Removed policies in Chrome browser   back to top
    Policy Description
    ForceMajorVersionToMinorPositionInUserAgent Freeze User-Agent string major version at 99
    RendererCodeIntegrityEnabled Enable Renderer Code Integrity

ChromeOS updates

   

  • Password recovery back to top

    ChromeOS users who have forgotten their password can now recover their account along with all associated local data. Gone are the days where all local data is lost when a password has been forgotten! You can control this feature with the RecoveryFactorBehavior policy.
     

   

  • Tabbed PWAs back to top

    Developers can now choose to display their Progressive Web App (PWA) in tabbed mode, allowing users to manage and navigate multiple documents within a single window using a familiar tab strip. Developers should also specify a home tab where appropriate, which provides a consistent place for users to access documents and settings.
     

   

  • Printer setup assistance back to top

    To simplify a user's printing journey, ChromeOS provides more in context help when it comes to using their printer: an easier way to save printers, new set up instructions and help content, printer status directly integrated on the settings page. Moreover, we now also provide users an easy route to manage their printer when they face issues with it while trying to print.
     

   

  • Imprivata integration v4 back to top

    For caregivers, Imprivata OneSign compatibility with Google ChromeOS devices and the Chrome browser means fast, secure access, and better cost efficiency. This fourth version of Imprivata integration,  Imprivata v4, adds deployment, stability, and workflow improvements. It improves support for assigned devices by allowing for Imprivata sign-in to ChromeOS user sessions. In addition, ChromeOS 118 now supports all 12 languages of Imprivata and SPINE workflows.

   

  • Touch text editing redesign back to top

    Improved text editing interaction with user's fingers on the touchscreen, including a much more intuitive gesture system, usability improvements around gesture intentions and text legibility, a brand new magnifier that automatically shows cursor position with precision.

Admin console updates

 

   

↑ back to top  

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

  • Chrome release schedule changes back to top 

    Chrome 119 and all subsequent releases will be shifted forward by one week. For example, Chrome 119 will have its early stable release on October 25 instead of Nov 1. Beta releases will also be shifted forward by one week starting in Chrome 119.
    • Chrome 119 on Android, iOS, ChromeOS, Linux, Mac, Windows
 

   

  • Deprecate and remove WebSQL back to top 

    The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. Gecko never implemented this feature and WebKit deprecated this feature in 2019. The W3C encouraged those needing web databases to adopt Web Storage or Indexed Database. 
     

    Ever since its release, it has made it incredibly difficult to keep our users secure. SQLite was not initially designed to run malicious SQL statements, and yet with WebsQL we have to do exactly this. Having to react to a flow of stability and security issues is an unpredictable cost to the storage team. With SQLite over WASM as its official replacement, we want to remove WebSQL entirely.

    • Chrome 115: Deprecation message added to console.
    • Chrome 117: In Chrome 117, the WebSQL Deprecation Trial starts. The trial ends in Chrome 123. During the trial period, a policy, WebSQLAccess, is needed for the feature to be available.
    • Chrome 119: Starting with Chrome 119, WebSQL is no longer available. Access to the feature is available until Chrome 123 using the WebSQLAccess policy.
 

   

  • Native Client support updates back to top 

    Native Client NaCl support was removed from extensions on Windows, macOS, and Linux. A temporary enterprise policy is available, NativeClientForceAllowed, which allows Native Client to continue to be used.
    • Chrome 117 on Linux, Mac, Windows: Removal of Native Client NaCl support from extensions on Windows, macOS, Linux.
    • Chrome 119 on Linux, Mac, Windows: Removal of NativeClientForceAllowed policy
 

   

  • Migrate away from data URLs in SVG <use> element back to top 

    The SVG spec was recently updated to remove support for data: URLs in SVG <use> element. This improves security of the Web platform as well as compatibility between browsers as Webkit does not support data: URLs in SVG <use> element. You can read more in this blog post. 
     

    For enterprises that need additional time to migrate, the DataUrlInSvgUseEnabled policy will be available until Chrome 128 to re-enable Data URL support for SVG <use> element.

    • Chrome 119 on Android, ChromeOS, LaCrOS, Linux, Mac, Windows, Fuchsia: Remove support for data: URLs in SVG <use> element
 

   

  • Network Service on Windows will be sandboxed back to top 

    To improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.
    • Chrome 119 on Windows: Network Service sandboxed on Windows
 

   

  • Display banner allowing to resume last tab from other devices back to top 

    Help signed in users resume tasks when they have to switch devices immediately by offering to pick up tabs recently used on the previous device. Admins can control this feature via the existing enterprise policy called SyncTypesListDisabled.
    • Chrome 119 on iOS: Feature launches
    display banner

   

  • Remove Sanitizer API back to top 

    The Sanitizer API aims to build an easy-to-use, always secure, browser-maintained HTML sanitizer into the platform. We shipped an initial version of the Sanitizer API in Chrome 105, based on the then-current specification draft. However, the standards discussion has meanwhile moved on and the proposed API shape has changed substantially. To prevent the current API from becoming entrenched, we plan to remove the current implementation. We expect to re-implement the Sanitizer API when the proposed specification stabilizes again. 
    • Chrome 119 on Windows, Mac, Linux, Android 

   

  • Tab Groups can be saved, recalled, and synced back to top 

    Users will be able to save tab groups, which will allow them to close and re-open the tabs in the group, as well as sync them across devices. You can disable syncing Tab Groups using the  SyncTypesListDisabled policy.
    • Chrome 119 on ChromeOS, Linux, Mac, Windows

   

  • Chrome profile separation: new policies back to top 

    Three new policies will be created to help enterprises configure enterprise profiles: ProfileSeparationSettings, ProfileSeparationDataMigrationSettings, ProfileSeparationSecondaryDomainAllowlist. These policies will be simpler to use and will replace ManagedAccountsSigninRestriction and EnterpriseProfileCreationKeepBrowsingData.
    • Chrome 119 on Linux, Mac, Windows: New profile separation policies available: ProfileSeparationSettings, ProfileSeparationDataMigrationSettings, ProfileSeparationSecondaryDomainAllowlist.

   

  • Private Network Access restrictions for automotive back to top 

    This ships Private Network Access restrictions to Android Automotive (if BuildInfo::is_automotive), including:  Private Network Access preflight requests for subresources and Private Network Access for Workers. Note that the two above features were shipped in warning only mode, but these features will enforce the restriction, that is, failing the main request if restrictions are not satisfied.
    • Chrome 119 on Android 

   

  • Deprecate non-standard shadowroot attribute for declarative shadow DOM back to top 

    The standards-track shadowrootmode attribute, which enables declarative Shadow DOM, was shipped in Chrome 111 (ChromeStatus). The older, non-standard shadowroot attribute is now deprecated. During the deprecation period, both attributes are functional, however the shadowroot attribute does not enable the new streaming behavior, whereas shadowrootmode allows streaming of content. There is a straightforward migration path: replace shadowroot with shadowrootmode

    The old shadowroot attribute is deprecated as of Chrome 112, and it will be removed (no longer supported) in Chrome 119, which goes to Stable on November 1, 2023. 

    • Chrome 119 on Windows, Mac, Linux, Android 

   

  • Remove support for UserAgentClientHintsGREASEUpdateEnabled back to top 

    Deprecate the UserAgentClientHintsGREASEUpdateEnabled policy since the updated GREASE algorithm has been on by default for over a year and then eventually remove it. 
    • Chrome 119 on Android, ChromeOS, Linux, Mac, Windows: Policy is deprecated
    • Chrome 122 on Android, ChromeOS, Linux, Mac, Windows: Policy is removed

   

  • Default Search Engine choice screen back to top 

    As early as Chrome 119, enterprise end-users may be prompted to choose their default search engine within Chrome.

    As part of our building for DMA compliance, some users will be prompted to choose their default search engine for Chrome. This prompt controls the default search engine setting, currently available at chrome://settings/search. The enterprise policies, DefaultSearchProviderEnabled and DefaultSearchProviderSearchUrl, will continue to control this setting as it does today, if it is set by the IT admin. Read more on this policy and the related atomic group.
    • Chrome 119 on iOS, ChromeOS, LaCrOS, Linux, Mac, Windows: 1% users will start getting the choice screen with Chrome 119. 100% by Chrome 122

   

  • Shifting UI strings in Chrome from Clear to Delete when getting rid of data back to top 

    Chrome is updating settings text to reflect delete instead of clear when referring to the destruction of data. We expect the change will improve user comprehension. Users who intend to get rid of data should feel reassured that the data is actually deleted and not just cleared from one view but accessible elsewhere. 
    • Chrome 119 on Android, iOS, ChromeOS, Mac, Windows: The earliest milestone that users may see these changes is 119. 

   

  • DevTools internal errors will be reported to Chrome internal crash reporting back to top 

    To improve Chrome's stability, DevTools internal errors will be reported through Chrome's existing crash reporting pipeline. This will provide visibility into the stability of the Chrome DevTools. Admins can control all crash reporting, including these errors, using the MetricsReportingEnabled enterprise policy.
    • Chrome 119 on ChromeOS, Linux, Mac, Windows

   

  • SharedImages for PPAPI Video Decode back to top 

    The PPAPISharedImagesForVideoDecoderAllowed policy controls the recent refactor for VideoDecoder APIs in PPAPI plugin. The migration only affects internal implementation details and should not change any behavior. However, this policy can be used in case any PPAPI applications do not work as expected.

    When the policy is left unset or set to Enabled, the browser will decide which implementation is used.

    When the policy is set to Disabled, Chrome will use the old implementation until the policy expires.

     

    NOTE: Only newly-started renderer processes will reflect changes to this policy while the browser is running.

    • Chrome 119 on ChromeOS, LaCrOS: Escape hatch policy introduced.
    • Chrome 122 on ChromeOS, LaCrOS: Escape hatch policy and corresponding old code paths are removed.

   

  • Private Aggregation API bundled enhancements back to top 

    We're planning a few bundled changes to Private Aggregation:
     

    - Null report fixes: Currently reports with no contributions are inadvertently dropped. This change ensures that, when a context ID is specified, a null report is sent even if budget is denied. Separately, it fixes a bug causing budget to always be denied for null reports.

    - Debug mode eligibility changes: Currently, debug mode is always available. This change only allows debug mode for callers that are allowed access to third-party cookies, silently dropping the debug mode otherwise. Note that this will allow debug mode to automatically sunset when third-party cookies are deprecated.

    - Padding report payloads: To avoid the payload size being dependent on the number of contributions, we will pad it with 'null' contributions to a fixed length. Note that this change will also affect Attribution Reporting reports.

    - Reducing delay: When a context ID is specified, we remove the randomized 10-60 minute delay, which is superfluous as a report is always sent in this case. Instead, we just wait until the Shared Storage operation timeout.

    • Chrome 119 on Windows, Mac, Linux, Android

   

  • Remove Authorization header upon cross-origin redirect back to top 

    The Fetch standard has been updated to remove Authorization header on cross origin redirects. Chrome should follow the spec change.
    • Chrome 119 on Windows, Mac, Linux, Android

   

  • Revamped Safety Check on Desktop back to top 

    We plan to introduce a new proactive Safety Check that regularly checks the browser for safety related issues and informs users when there's anything that needs their attention. Our Safety Check launch also introduces a new page with Chrome’s proactive safety-related actions and information tailored to each user, designed to make it easier for users to stay safe online.
    • Chrome 120 on ChromeOS, LaCrOS, Linux, Mac, Windows
      safety check  

   

  • Permissions prompt for Web MIDI API back to top 

    This feature gates the Web MIDI API access behind a permissions prompt. Today, the use of SysEx messages with the Web MIDI API requires an explicit user permission. With this implementation, even access to the Web MIDI API without SysEx support will require a user permission. Three new policies—DefaultMidiSetting, MidiAllowedForUrls and MidiBlockedForUrls—will be available to allow administrators to pre-configure user access to the API.
    • Chrome 120 on Windows, Mac, Linux, Android 

   

  • Desktop Responsive Toolbar back to top 

    As early as Chrome 120, Chrome Desktop customers across form factors and input modalities (e.g. Mouse, Touch) will experience a toolbar that seamlessly responds to changing window sizes albeit by manually selecting and dragging a window smaller/larger or using operating system specific window management tools.
    • Chrome 120 on ChromeOS, LaCrOS, Linux, Mac, Windows

   

  • Chrome on Android will no longer support Android Nougat back to top 

    The last version of Chrome that will support Android Nougat will be Chrome 119, and it includes a message to affected users informing them to upgrade their operating system. Chrome 120 will not support nor ship to users running Android Nougat.
    • Chrome 120 on Android: Chrome on Android no longer supports Android Nougat

   

  • Chrome Third-Party Cookie Deprecation (3PCD) back to top 

    In Chrome 120 and beyond (Jan 2024), Chrome will globally disable third-party cookies for 1% of Chrome traffic as part of our Chrome-facilitated testing in collaboration with the CMA, to allow sites to meaningfully preview what it's like to operate in a world without third-party cookies (3PCs). Most enterprise end users will be excluded from this experiment group automatically. But for the few that may be affected, enterprise admins will be able to utilize an enterprise policy to opt out their managed browsers ahead of the experiment and give enterprises time to make necessary changes to not rely on this policy or third party cookies. 
    We plan to provide more details about this policy and provide more tooling to help identify 3PC use cases. In the meantime, refer to the Mode B: 1% third-party cookie deprecation blog section for more details on how to prepare, provide feedback and report potential site issues.
    • Chrome 120 on ChromeOS, Linux, Mac, Windows
      1% of global traffic has third party cookies disabled. Enterprise users are excluded from this automatically where possible, and a policy is available to override the change.

   

  • IP Protection Phase 0 for Chrome back to top 

    As early as Chrome 122, Chrome may route traffic for some network requests to Google-owned resources through a privacy proxy. This is an early milestone in a larger effort to protect users' identities by masking their IP address from known cross-site trackers. More information (including enterprise policies) can be found in the explainer.  Enterprise policies will be in place to allow admins to disable the feature before it’s launched.
    • Chrome 122 on ChromeOS, Linux, Mac, Windows, Android

   

  • Apps & Extensions Usage Report: Highlight extensions removed from the Chrome Web Store back to top 

    Chrome is adding new information on the Apps & Extensions Usage Report to help you identify if an extension was recently removed from the Chrome Web Store. On the App Details page, you can find the reason why an extension was removed from the Chrome Web Store. This feature will help IT administrators identify the impact of using the policy to disable unpublished extensions.
    • Chrome 122 on LaCrOS, Linux, Mac, Windows

   

  • Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy back to top 
    In Chrome 79, we introduced the LegacySameSiteCookieBehaviorEnabledForDomainList policy to revert the SameSite behavior of cookies to legacy behavior on the specified domains. The LegacySameSiteCookieBehaviorEnabledForDomainList policy’s lifetime has been extended and will be removed on the milestone listed below.
    • Chrome 127 on Android, ChromeOS, Linux, Mac, Windows: Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy

   

  • Intent to deprecate: Mutation Events back to top 
    Synchronous Mutation Events, including DOMSubtreeModified, DOMNodeInserted, DOMNodeRemoved, DOMNodeRemovedFromDocument, DOMNodeInsertedIntoDocument, and DOMCharacterDataModified, negatively affect page performance, and also significantly increase the complexity of adding new features to the Web. These APIs were deprecated from the spec in 2011, and were replaced (in 2012) by the much better-behaved Mutation Observer API. Usage of the obsolete Mutation Events must be removed or migrated to Mutation Observer.
    • Chrome 127 on Android, ChromeOS, Linux, Mac, Windows: Mutation Events will stop functioning in Chrome 127, around July 30, 2024.

   

  • Extensions must be updated to leverage Manifest V3 back to top 

    Extensions must be updated to leverage Manifest V3. Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. As mentioned earlier in our blog post , the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed. During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3. An Enterprise policy ExtensionManifestV2Availability is available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management. Read more on the Manifest timeline, including: 
    • Chrome 98 on ChromeOS, LaCrOS, Linux, Mac, Windows: Chrome Web Store stops accepting new Manifest V2 extensions with visibility set to "Public" or "Unlisted". The ability to change Manifest V2 extensions from "Private" to "Public" or "Unlisted" is removed.
    • Chrome 103 on ChromeOS, LaCrOS, Linux, Mac, Windows: Chrome Web Store stops accepting new Manifest V2 extensions with visibility set to "Private".
    • Chrome 110 on ChromeOS, LaCrOS, Linux, Mac, Windows: Enterprise policy ExtensionManifestV2Availability is available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions.

    Future milestone on ChromeOS, LaCrOS, Linux, Mac, Windows: Remove ExtensionManifestV2Availability policy.

↑ back to top  

Upcoming ChromeOS changes

   

  • Privacy Hub back to top

    Later this year, users will be able to manage their camera and microphone settings across the operating system from one place in Settings. This way it only takes one click for users to completely turn off their camera or microphone all from one place when they need extra confidence in staying on mute.  
    privacy hub

   

  • ChromeOS Admin templates back to top

    App Launch Automation can be configured by Administrators in the Admin console to contain groups of applications, windows and tools that can be launched automatically on startup or on-demand by users throughout their day. With App Launch Automation, you can: get users up and running quickly at the start of their day, provide users with a way to easily get to an optimal starting point for new tasks, and remember the window layout each user sets up for their individual workflows for future use.
      admin templates

↑ back to top  

Upcoming Admin console changes

   

  • URL-keyed anonymized data collection in Kiosk mode back to top

    The policy for URL-keyed anonymized data collection, UrlKeyedAnonymizedDataCollectionEnabled, will soon be supported in the Admin console. This policy will be enforced starting October 1st and will remain disabled until then.

↑ back to top  

Chrome 117

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Skip unload events    
Chrome no longer supports macOS 10.13 and macOS 10.14    
Update to lock icon    
Network service is sandboxed on Linux and ChromeOS    
TLS Encrypted Client Hello (ECH)    
User surveys related to SafeBrowsing warnings    
Simplified onboarding experience    
Warnings on insecure downloads    
Service Worker static routing API    
Chrome browser integration with Symantec Endpoint DLP    
Require X.509 key usage extension for RSA certificates chaining to local roots    
Simplified sign-in and sync experience    
Updates to Clear Browsing Data on Android    
Allow users to review and optionally remove potentially unsafe extensions    
New Chrome Desktop visual refresh in Chrome 117    
Native Client support updates    
Deprecate and remove WebSQL    
Revamp permission usage or lockage indicators    
Price tracking    
Price insights on Chrome desktop    
Auth on entry to Password Manager on iOS    
Improved download warnings    
Storage Access API with prompts    
Chrome on Android trackpad support    
Port overflow check in URL setters    
Deprecate TLS SHA-1 server signatures    
URL standard-compatible IPv4 embedded IPv6 host parser    
Form-filler accessibility mode    
Clear client hints via Clear-Site-Data header    
Remove WebRTC getStats datachannelIdentifier -1    
Remove WebRTC getStats encoderImplementation/decoderImplementation unknown    
Unship callback-based legacy getStats() in WebRTC    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
ChromeOS battery state sounds    
Avoid content control escapes on the login or lock screen    
Emoji Picker with GIF support    
ChromeOS gets a makeover    
ChromeOS Personalization App    
Color correction settings on ChromeOS    
Tabbed PWAs on ChromeOS    
System answer cards in Launcher search    
Nudge managed users towards enrolling non-ZTE devices  
Replacing the Bluetooth stack on ChromeOS    
Time-lapse recording    
Enhanced options in clipboard history    
ChromeVox dialog changes    
Steam enabled on all capable devices    
Up Next Calendar view with Join video call integration    
Adaptive Charging     
Admin console updates Security/ Privacy User productivity/ Apps Management
Printing reports now available in Chrome Management Reports API    
New policies in the Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
Chrome will introduce a chrome://policy/test page    
Network Service on Windows will be sandboxed     
Remove ForceMajorVersionToMinorPositionInUserAgent policy    
Remotely disable malicious off-store extensions    
Remove RendererCodeIntegrityEnabled policy    
Support for passkeys in iCloud Keychain on macOS  
Hash-prefix real-time lookups    
Red interstitial facelift  
Form controls support vertical writing mode    
Block all cookies set via JavaScript that contain control characters    
Clearer Safe Browsing protection level settings text and images    
WebUSB in Extension Service Workers    
Include chrome.tabs API calls in extension telemetry reports    
Remove non-standard appearance keywords    
Chrome release schedule changes    
Permissions prompt for Web MIDI API    
Migrate away from data URLs in SVG <use> element  
Chrome Browser Cloud Management: Crash report    
IP protection Phase 0 for Chrome    
Display banner to allow resume last tab from other devices    
Remove Sanitizer API    
Tab groups can be saved, recalled, and synced    
Chrome profile separation: new policies    
Chrome on Android will no longer support Android Nougat    
Replace dangling markup in target name to _blank    
Private Network Access restrictions for automotive    
Deprecate non-standard shadowroot attribute for declarative shadow DOM    
Chrome Third-Party Cookie Deprecation (3PCD)    
Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy     
Intent to deprecate: Mutation events    
Extensions must be updated to leverage Manifest V3
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
Privacy Hub    
ChromeOS Admin templates    
Upcoming Admin console changes Security/ Privacy User productivity/ Apps Management
URL-keyed anonymized data collection in Kiosk mode    

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

   

  • Skip unload events back to top 

    The presence of unload event listeners is a primary blocker for back/forward cache on Chromium based browsers and for Firefox on desktop platforms. On the other hand, for mobile platforms, almost all browsers prioritize the bfcache by not firing unload events in most cases. To improve the situation, we’ve been working with lots of partners and successfully reduced the use of unload event listeners over the last few years. To further accelerate this migration, we propose to have Chrome for desktop gradually skip unload events. In case you need more time to migrate away from unload events, we’ll offer temporary opt-outs in the form of an API and a group policy, which will allow you to selectively keep the behavior unchanged.
    • Chrome 117 on Chrome OS, Linux, Mac, Windows: Dev Trial.
 

   

  • Chrome no longer supports macOS 10.13 and macOS 10.14 back to top 

    Chrome will no longer support macOS 10.13 and macOS 10.14, which are already outside of their support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security. If run on macOS 10.13 or 10.14, Chrome continues to show an infobar that reminds users that Chrome 117 will no longer support macOS 10.13 and macOS 10.14.
    • Chrome 117 on Mac: Chrome no longer supports macOS 10.13 and macOS 10.14.
 

   

  • Update to lock icon back to top 

    We plan to replace the lock icon with a variant of the tune icon, which is commonly used to indicate controls and settings. Replacing the lock icon with a neutral indicator prevents the misunderstanding that the lock icon is associated with the trustworthiness of a page, and emphasizes that security should be the default state in Chrome. Our research has also shown that many users never understood that clicking the lock icon showed important information and controls. We think the new icon helps make permission controls and additional security information more accessible, while avoiding the misunderstandings that plague the lock icon. 
    The new icon is scheduled to launch as part of a general design refresh for desktop platforms. Chrome will continue to alert users when their connection is not secure. You can enable the tune icon pre-release in Chrome for Desktop if you enable Chrome Refresh 2023 at chrome://flags#chrome-refresh-2023, but keep in mind this flag enables work that is still actively in-progress and under development, and does not represent a final product. 

    We will also replace the icon on Android. On iOS, the lock icon is not tappable, so we will be removing the icon. You can read more in this blog post.
    • Chrome 117 on Linux, Mac, Windows: The new icon is scheduled to launch in Chrome 117.
      New lock icon

   

  • Network service is sandboxed on Linux and ChromeOS back to top 

    The network service is sandboxed on Linux and ChromeOS to improve security. On Linux, it's possible that third party software (likely data loss prevention or antivirus software) is injecting code into Chrome's processes and will be blocked by this change. This may result in Chrome crashing for your users. 
    If this happens, you should work with the vendor of the third party software to stop it from injecting code into Chrome's processes. In the meantime, you will be able to use the NetworkServiceSandboxEnabled policy to defer the sandboxing. This is a temporary measure intended to help enterprises surprised by the change; the policy will be removed in a future version of Chrome.
    • Chrome 117 on Chrome OS, Linux: The network service sandboxed on Linux and ChromeOS to improve security.

   

  • TLS Encrypted Client Hello (ECH) back to top 

    The TLS Encrypted ClientHello (ECH) extension enables clients to encrypt ClientHello messages, which are normally sent in cleartext, under a server’s public key. This allows websites to opt-in to avoid leaking sensitive fields, like the server name, to the network by hosting a special HTTPS RR DNS record. (Earlier iterations of this extension were called Encrypted Server Name Indication, or ESNI.) If your organization’s infrastructure relies on the ability to inspect SNI, for example, filtering, logging, and so on, you should test it. You can enable the new behavior by navigating to chrome://flags and enabling the #encrypted-client-hello flag. On Windows and Linux, you also need to enable Secure DNS for the flag to have an effect.
    If you notice any incompatibilities, you can use the EncryptedClientHelloEnabled enterprise policy to disable support for ECH.
    • Chrome 117 on Chrome OS, Linux, Mac, Windows

   

  • User surveys related to SafeBrowsing warnings back to top 

    After a user adheres to or bypasses a SafeBrowsing warning, Chrome may ask them about their satisfaction with the experience. You can control this with the SafeBrowsingSurveysEnabled policy.
    • Chrome 117 on Chrome OS, Linux, Mac, Windows

   

  • Simplified onboarding experience back to top 

    Some users may see a simplified onboarding experience with a more intuitive way to sign into Chrome. Enterprise policies like BrowserSignin, SyncDisabled, EnableSyncConsent, RestrictSigninToPattern and SyncTypesListDisabled will continue to be available as before to control whether the user can sign into Chrome and turn on sync. The PromotionalTabsEnabled policy can be used to skip the onboarding altogether. DefaultBrowserSettingEnabled is respected in the same way as before.
    • Chrome 117 on Linux, Mac, Windows

   

  • Warnings on insecure downloads back to top 

    Chrome will begin showing warnings on some downloads if those files were downloaded over an insecure (i.e. not HTTPS) connection. These warnings do not prevent downloading and can be bypassed by the user. Enterprises can test their downloads by enabling warnings via chrome://flags/#insecure-download-warnings. Enterprises can also disable warnings for sites that can not deliver files securely by adding the downloading site to InsecureContentAllowedForUrls.
    • Chrome 117 on Android, Chrome OS, LaCrOS, Linux, Mac, Windows, Fuchsia: Chrome shows warnings on some downloads.
      Insecure downloads
     

   

  • Service Worker static routing API back to top 

    Chrome releases the Service Worker static routing API; it enables developers to optimize how Service Workers are loaded. Specifically, it allows developers to configure the routing, and allows them to offload simple things ServiceWorkers do. If the condition matches, the navigation happens without starting ServiceWorkers or executing JavaScript, which allows web pages to avoid performance penalties due to ServiceWorker interceptions.
    • Chrome 116 on Android, Chrome OS, Linux, Mac, Windows: Origin Trial for Service Worker static routing API.
    • Chrome 117 on Android, Chrome OS, Linux, Mac, Windows: Release of the Service Worker static routing API.

   

  • Chrome browser integration with Symantec Endpoint DLP back to top 

    This feature provides a secure native integration that transfers content (file or text) between Chrome and Broadcom’s Symantec DLP agent without the need for deploying an extension. When a CBCM or CDM managed user performs an action that sends data via Chrome, Symantec Endpoint DLP can monitor for data exfiltration and apply allow/block controls based on customer's DLP policies.
    • Chrome 117 on Windows

   

  • Require X.509 key usage extension for RSA certificates chaining to local roots back to top 

    X.509 certificates used for HTTPS should contain a key usage extension that declares how the key in a certificate may be used. Such instructions ensure certificates are not used in an unintended context, which protects against a class of cross-protocol attacks on HTTPS and other protocols. For this to work, HTTPS clients must check that server certificates match the connection's TLS parameters, specifically that the key usage flag for “digitalSignature” and possibly “keyEncipherment” (depending on TLS ciphers in use) are asserted when using RSA. 
    Chrome 117 will begin enforcing that the key usage extension is set properly on RSA certificates chaining to local roots. Key usage is already required for ECDSA certificates, and for publicly trusted certificates. Enterprises can test and temporarily disable key usage enforcement using the RSAKeyUsageForLocalAnchorsEnabled policy (available in Chrome 116).
    • Chrome 116 on Android, Chrome OS, Linux, Mac, Windows: The RSAKeyUsageForLocalAnchorsEnabled policy is added.
    • Chrome 117 on Android, Chrome OS, Linux, Mac, Windows: Chrome begins enforcing that the key usage extension is set properly on RSA certificates chaining to local roots. Key usage is already required for ECDSA certificates, and for publicly trusted certificates.

   

  • Simplified sign-in and sync experience back to top 

    Chrome launches a simplified and consolidated version of sign-in and sync in Chrome. Chrome sync will no longer be shown as a separate feature in settings or elsewhere. Instead, users can sign in to Chrome to use and save information like passwords, bookmarks and more in their Google Account, subject to the relevant enterprise policies.  As before, the functionality previously part of Chrome sync that saves and accesses Chrome data in the Google Account can be turned off fully (via SyncDisabled) or partially (via SyncTypesListDisabled). Sign-in to Chrome can be required or disabled via BrowserSignin as before. 
    Note that the changes do not affect users’ ability to sign in to Google services on the web (like Gmail) without signing in to Chrome, their ability to stay signed out of Chrome, or their ability to control what information is synced with their Google Account.
    • Chrome 117 on iOS: Simplified sign-in and sync experience launches on iOS.
     



     

   

  • Updates to Clear browsing data on Android back to top 

    Chrome enhances the browser data deletion controls by making it easier and quicker for users to complete their ‘Clear browsing data’ journeys, while maintaining the granular controls for advanced data deletion needs.
    • Chrome 117 on Android

   

  • Allow users to review and optionally remove potentially unsafe extensions back to top 

    A new review panel will be added in chrome://extensions, which appears whenever there are potentially unsafe extensions that need the user's attention, such as extensions that are malware, policy violating or are no longer available in the Chrome Web Store. The user can choose to remove or keep these extensions. 
    There is also a count of risky extensions needing review that is presented in the Chrome Privacy & Security settings page. As an administrator, you can preemptively control the availability of potentially unsafe extensions using the ExtensionUnpublishedAvailability policy.
    • Chrome 117 on Chrome OS, Linux, Mac, Windows

   

  • New Chrome Desktop visual refresh in Chrome 117 back to top 

    With Google’s design platform moving to Google Material 3, we have an opportunity to modernize our desktop browser across OS’s, leveraging updated UI elements or styling, enhancing personalization through a new dynamic color system, and improving accessibility. The first wave of UI updates will roll out in Chrome 117. 
    The three dot Chrome menu will also be refreshed, providing a foundation to scale personalization and customization experiences in Chrome by enabling customers proximate access to tools and actions.. The menu will be updated in phases starting in Chrome 117.
    • Chrome 117 on Linux, Mac, Windows: Rollout starts for all users.

   

  • Native Client support updates back to top 

    We will remove Native Client NaCl support from extensions on Windows, macOS, Linux. An enterprise policy will be available, NativeClientForceAllowed, which will allow Native Client to continue to be used.
    • Chrome 117 on Linux, Mac, Windows: Removal of Native Client NaCl support from extensions on Windows, macOS, Linux.
    • Chrome 119 on Linux, Mac, Windows: Removal of NativeClientForceAllowed policy.

   

  • Deprecate and remove WebSQL back to top 

    The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. Gecko never implemented this feature and WebKit deprecated this feature in 2019. The W3C encouraged those needing web databases to adopt Web Storage or Indexed Database. Ever since its release, it has made it incredibly difficult to keep our users secure. SQLite was not initially designed to run malicious SQL statements, and yet with WebsQL we have to do exactly this. Having to react to a flow of stability and security issues is an unpredictable cost to the storage team. With SQLite over WASM as its official replacement, we want to remove WebSQL entirely.
    • Chrome 115: Deprecation message added to console.
    • Chrome 117: In Chrome 117 the WebSQL Deprecation Trial starts. The trial ends in Chrome 123. During the trial period, a policy, WebSQLAccess, is needed for the feature to be available.
    • Chrome 119: Starting Chrome 119, WebSQL is no longer available. Access to the feature is available until Chrome 123 using the WebSQLAccess policy.

   

  • Revamp permission usage or blockage indicators back to top 

    In-use activity indicators are visual cues that let users know that an origin is actively using a permission-gated feature. They can be used to indicate things like whether geolocation is accessed, or video and audio are being captured. Chrome is changing the life cycle of the activity indicators, updating how long they appear in the address bar.
    • Chrome 117 on Chrome OS, Linux, Mac, Windows

   

  • Price tracking back to top 

    Starting in Chrome 117, when users bookmark a price-trackable product, price tracking will be enabled by default when available. Users will be able to disable price tracking per item, and administrators can disable the feature entirely with the ShoppingListEnabled policy.
    • Chrome 117 on Chrome OS, Linux, Mac, Windows

   

  • Price insights on Chrome desktop back to top 

    Some users will see a chip in the address bar which enables them to see price information about a product they're shopping for.
    • Chrome 117 on Chrome OS, Linux, Mac, Windows

   

  • Auth on entry to Password Manager on iOS back to top 

    To improve security, re-auth is now required when entering Google Password Manager on Chrome on iOS. Previously, re-auth was required only when viewing password details or notes. The device unlock method will be offered, i.e. FaceID, TouchID, or Passcode. If a Passcode is not set-up, the user will be prompted to do so.
    • Chrome 117 on iOS: Re-auth required anytime when entering Google Password Manager on Chrome on iOS.

   

  • Improved download warnings back to top 

    To help reduce cookie theft and other consequences of downloading malware, we’re cleaning up desktop download warning strings and patterns to be clear and consistent.
    • Chrome 117 on LaCrOS, Linux, Mac, Windows: Strings, icons, and colors, as well as warning messages for some downloads, will be updated.
     

   

  • Storage Access API with prompts back to top 

    Allow frames to request access to third-party cookies through the Storage Access API (SAA) when third-party cookies are blocked.
    • Chrome 117 on Chrome OS, LaCrOS, Linux, Mac, Windows: Support the Storage Access API by implementing all the behaviors listed in the specification, i.e. with user prompts, and additionally having its own user-agent-specific behaviors.

   

  • Chrome on Android trackpad support back to top 

    Chrome on Android now has advanced keyboard and trackpad or mouse support, similar to desktop Chrome.
    • Chrome 117 on Android: Enabled shortcuts for web content edit, cursor movements and media. 

   

  • Port overflow check in URL setters back to top 

    The port value is now checked when setting url.port. All the values that overflow the 16-bit numeric limit are no longer valid. For instance the following script behaves differently after the change: ``` u = new URL("http://test.com"); u.port = 65536; console.log(u.port); ``` Before the change, the output is 65536. After the change, the output will be 80.
    • Chrome 117 on Windows, Mac, Linux, Android

   

  • Deprecate TLS SHA-1 server signatures back to top 

    Chrome is removing support for signature algorithms using SHA-1 for server signatures during the TLS handshake. This does not affect SHA-1 support in server certificates, which was already removed, or in client certificates, which continues to be supported. SHA-1 can be temporarily re-enabled via the temporary InsecureHashesInTLSHandshakesEnabled enterprise policy. This policy will be removed in Chrome 123.
    • Chrome 117 on Windows, Mac, Linux, Android
     

   

  • URL standard-compatible IPv4 embedded IPv6 host parser back to top 

    The behavior of parsing IPv4 embedded IPv6 host parser will be updated to strictly follow the web URL standard: https://url.spec.whatwg.org/#concept-ipv6-parser The introduced restrictions on the IPv6 address are: * The embedded IPv4 address shall always consist of 4 parts. Addresses with less than 4 parts like http://[::1.2] will be no longer valid. The feature is a part of the URL interop 2023.
    • Chrome 117 on Windows, Mac, Linux, Android

   

  • Form-Filler Accessibility Mode back to top 

    This feature improves performance by providing a subset of the full accessibility API to form-filler apps.
    • Chrome 117 on Android: A subset of the full accessibility API is provided to form-filler apps.

   

  • Clear client hints via Clear-Site-Data header back to top 

    Websites will now be able to clear the client hints cache using `Clear-Site-Data: “clientHints”`. Client hints will also now be cleared when cookies, cache, or * are targeted by the same header. This is because if the user clears cookies in the UI client hints are already cleared as well, the client hints cache is a cache, and to be consistent with wildcard targets respectively.
    • Chrome 117 on Windows, Mac, Linux, Android

   

  • Remove WebRTC getStats datachannelIdentifier -1 back to top 

    The WebRTC getStats API exposes a dataChannelIdentifier property. It will no longer provide the value "-1" in cases where statistics are queried before the datachannel connection is established. Instead, the dictionary member will be omitted. This follows the general pattern not to return meaningless information described in this article.
    • Chrome 117 on Windows, Mac, Linux, Android
     

   

  • Remove WebRTC getStats encoderImplementation or decoderImplementation unknownback to top 

    The WebRTC getStats API exposes the encoder and decoder implementation names for outbound and inbound video: https://w3c.github.io/webrtc-stats/#dom-rtcoutboundrtpstreamstats-encoderimplementation 
    It will no longer provide the value unknown in cases where statistics are queried before a video frame was encoded or decoded. Instead, the dictionary member will be omitted. This follows the general pattern not to return meaningless information described in this article. 
    • Chrome 117 on Windows, Mac, Linux, Android

   

  • Unship callback-based legacy getStats() for WebRTC back to top 

    RTCPeerConnection has two versions of getStats(), one that is spec-compliant returning the report via resolving a promise, and one that is non-standard returning a very different report via a callback as the first argument. The callback-based one will soon be removed. Removal target: Chrome 117. A deprecation trial is available Chrome 113- Chrome 121 for apps that need more time. In the Chrome 114+ the method will throw an exception in Canary/Beta unless using the trial.
    • Chrome 117 on Windows, Mac, Linux, Android

   

   

  • Removed policies in Chrome browser   back to top

    Policy

    Description

    DeviceTargetVersionSelector

    Allow devices to select a specific target version of Google ChromeOS they will update to

ChromeOS updates

   

  • ChromeOS battery state sounds back to top

    In Chrome 117, audible sounds now indicate battery status. Users can turn on and off these sounds and Admins can control them using the DeviceLowBatterySoundEnabled policy.

    When the device is not plugged in, you hear warning sounds if:

    • Battery level goes down to 15 minutes of charge time left, and another one when there is 5 minutes left.

    When the device is plugged in, you hear an information beep when:

    • Battery level - 0-15% (low) 
    • Battery level - 16-79% (med) 
    • Battery level - 80-100% (high)

    In the case where the device is connected to a low power charger, you’ll hear warnings when the battery goes down to 10%, then again at 5%.

     

   

  • Avoid content control escapes on the login or lock screen back to top

    Administrators can now control and limit the available content on end-users login and lock screens when identity federation is used with a third party identity provider (using SAML or OIDC). This is achieved by introducing two new policies to block or allow external URLs on login and lock screens, DeviceAuthenticationURLAllowlist and DeviceAuthenticationURLBlocklist. As a result, you can prevent content control escapes.
     

   

  • Emoji Picker with GIF support back to top

    The emoji picker now supports GIFs. Search and find the perfect GIF to express yourself. 

    For managed devices, this feature is switched off by default.

   

  • ChromeOS gets a makeover back to top

    Thanks to Google Material 3, Google’s new design platform, ChromeOS 117 brings with it:
    • A new set of themes which dynamically update to reflect your wallpaper and style.
    • A new look for almost all system surfaces with updated text, menus, icons or elements.

    You can control the new look using the ChromeOS Personalization App.

     

   

  • ChromeOS Personalization App back to top

    With this launch, your ChromeOS now has accent colors that match your wallpapers, creating a unique theme for your device. The accent colors also adapt to the light and dark modes.
     

   

  • Color correction settings on ChromeOS back to top

    ChromeOS now has built-in color correction settings that make it easier for users to see colors on their screens. In ChromeOS Accessibility settings, under Display and Magnification, you can enable color filters for protanopia, deuteranopia or tritanopia, or to view the display in grayscale. Users can use a slider to customize the filters' intensity to meet their needs.
     

   

  • System answer cards in Launcher search back to top

    When users search for the status of their OS version, battery, RAM, storage, or CPU, in Launcher, they can now see that information previewed in the search results. 

     

   

  • Nudge managed users towards enrolling non-ZTE devices back to top

    This feature enables administrators to demand managed users to enroll their non-zero touch devices by introducing a new user policy, UserEnrollmentNudging, which can be configured to require enrollment of the given user. If the policy is enabled and the managed user misses the enrollment step and performs first sign in on the device, a pop-up is shown suggesting to either switch to enrollment flow or use another email for sign-in, essentially preventing the managed user from signing in without enrollment. 
     

   

  • Replacing the Bluetooth stack on ChromeOS back to top

    Starting in ChromeOS 117, and gradually applying to all ChromeOS devices, this Bluetooth software change brings the Android Bluetooth stack, Fluoride, to ChromeOS. The transition happens seamlessly on login, preserving existing paired devices, and should work with Bluetooth devices today with no interruptions. If you experience issues, please file feedback and, if necessary, disable the new stack via chrome://flags/#bluetooth-use-floss.
     

   

  • Time-lapse recording back to top

    The built-in Camera App now supports Time-Lapse recording. To use the feature, open the Camera App, select Video, then Time-Lapse. Recording can continue for as long as there is available storage space. Camera app determines the right speed for the time-lapse video based on duration recorded, to ensure your video always looks great.
     

     

   

  • Enhanced options in clipboard history back to top

    Enhancements to Clipboard History menu including introducing new entry points, ways to discover the feature and simplifying feature comprehension making it easier to discover and use. You can now see more detail for items in your clipboard history and can access clipboard history items nested directly in context menus. For users discovering Clipboard History for the first time, we are also introducing educational information to help with understanding this feature.
     

   

  • ChromeVox dialog changes back to top

    We’ve made some changes to the initial out-of-the-box experience (OOBE) dialog that explains what ChromeVox is, who might benefit from activating ChromeVox and requires pressing space instead of offering an on-screen button. With this update, we hope to reduce the number of users who inadvertently activate ChromeVox.
     

   

  • Up Next Calendar view with Join video call integration back to top

    See your upcoming events directly from the calendar view and join any digital meetings directly with the new Join button.
     

   

  • Adaptive Charging back to top

    Adaptive Charging is a new ChromeOS power management feature. Devices with Adaptive Charging enabled via Settings charge to 80% and then complete charging to 100% based on an ML model’s prediction for when the user will unplug their device. Reducing the time a device spends at 100% charge helps preserve the battery's health and ability to hold a charge over the lifetime of the device. 
     

Admin console updates

 

   

  • Printing reports now available in Chrome Management Reports API   back to top

    Chrome 117 includes additional endpoints to Chrome Management Reports API that allow access to printing reports. The new endpoints provide per-user and per-printer summary printing reports, as well as a listing of all print jobs submitted to managed printers. The data provided by the new endpoints corresponds to the data in the Print Usage page of the Admin console. This update exposes the same data in the third-party Reports API.

 

   

↑ back to top  

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

  • Chrome will introduce a chrome://policy/test page  back to top

    chrome://policy/test will allow customers to test out policies on the Beta, Dev, Canary channels. If there is enough customer demand, we will consider bringing this functionality to the Stable channel.
    • Chrome 118 on Android, iOS, Chrome OS, Linux, Mac, Windows
     

   

  • Network Service on Windows will be sandboxed  back to top

    To improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.
    • Chrome 118 on Windows: Network Service sandboxed on Windows
     

   

  • Remove ForceMajorVersionToMinorPositionInUserAgent policy  back to top

    Chrome plans to remove the ForceMajorVersionToMinorPositionInUserAgent policy. This policy was introduced in Chrome 99 to control whether the User-Agent string major version would be frozen at 99, in case of User-Agent string parsing bugs when the version changed to 100. Fortunately, we did not need to deploy this feature and only encountered a few minor 3-digit version parsing issues that have all since been fixed. Given that, we intend to remove this policy. If you have any feedback about this policy removal, or are aware of intranet breakage that depends on the policy, please comment on this bug.   

   

  • Remotely disable malicious off-store extensions  back to top

    When Enhanced Safe Browsing is enabled, users found to have a malicious off-store extension installed will have it disabled when the decision is entered on the Safe Browsing servers via either manually or by an automated detection system.
    • Chrome 118 on Chrome OS, Linux, Mac, Windows: Feature launches
     

   

  • Remove RendererCodeIntegrityEnabled policy  back to top

    The RendererCodeIntegrityEnabled policy will be removed. We recommend that you verify any potential incompatibilities with third party software by no longer applying the policy in advance of this release. You can report any issues you encounter by submitting a bug here.
    • Chrome 118 on Windows: This policy is deprecated and will no longer take effect
     

   

  • Support for passkeys in iCloud Keychain on macOS  back to top

    Chrome on macOS ≥ 13.5 will gain support for creating and using passkeys from iCloud Keychain. When signing in using WebAuthn, passkeys from iCloud Keychain will be listed as options once the user has granted Chrome the needed permission. If permission has not been granted then a generic "iCloud Keychain" option will appear that will prompt for permission before showing iCloud Keychain passkeys. If permission is denied then iCloud Keychain can still be used, but will have to be manually selected each time. When a site asks to create a platform passkey, Chrome might default to creating the passkey in iCloud Keychain based on whether iCloud Drive is in use and whether WebAuthn credentials from the current profile have been recently used. This can be controlled with a setting on chrome://password-manager/settings, and with the enterprise policy CreatePasskeysInICloudKeychain.
    • Chrome 118 on Mac: The ability to use iCloud Keychain will be enabled in Chrome 118. Whether Chrome defaults to creating platform passkeys in iCloud Keychain may be altered by Finch during the lifetime of 118.
     

   

  • Hash-prefix real-time lookups  back to top

    For standard Safe Browsing protection users, visited URLs now have their safety checked in real time instead of against a less frequently updated local list of unsafe URLs. This is done by sending partial hashes of the URLs to Google Safe Browsing through a proxy via Oblivious HTTP, so that the user’s IP address is not linked to the partial hashes. This change improves security while maintaining privacy for users. If needed, the feature can be disabled through the policy SafeBrowsingProxiedRealTimeChecksAllowed.
    • Chrome 118 on iOS, Chrome OS, LaCrOS, Linux, Mac, Windows: This will start with a 1% rollout and then proceed to 100% of users.
     

   

  • Red interstitial facelift  back to top

    In Chrome 118, users will see minor updates to the red Safe Browsing interstitials. The main body text will include an explicit recommendation from Chrome and site ID will be specified in the details section instead of the main body. The warning icon will be replaced by the danger icon and styling will be updated to be consistent with the latest product standards. These changes will improve user comprehension of warnings.
    • Chrome 118 on Android, iOS, Chrome OS, LaCrOS, Linux, Mac, Windows
     

   

  • Form Controls support vertical writing mode  back to top

    CSS property writing-mode should be enabled for form controls elements as it will allow lines of text to be laid out horizontally or vertically and it sets the direction in which blocks progress. With this feature, we are allowing the form control elements select, meter, progress, button, textarea and input to have vertical-rl or vertical-lr writing mode. As needed for Web compatibility, we will slowly rollout the change for a number of form controls in 118 and continue in future milestones.
    • Chrome 118 on Windows, Mac, Linux, Android 
     

   

  • Block all cookies set via JavaScript that contain control characters  back to top

    Updates how control characters in cookies set via JavaScript are handled. Specifically, all control characters cause the entire cookie to be rejected (previously a NULL character, a carriage return character, or a line feed character in a cookie line caused it to be truncated instead of rejected entirely, which could have enabled malicious behavior in certain circumstances). This behavior aligns Chrome with the behavior indicated by the latest drafts of RFC6265bis. This change can be disabled using the `--disable-features=BlockTruncatedCookies` or the BlockTruncatedCookies enterprise policy, which will exist for several milestones in case this change causes any breakage.
    • Chrome 118 on Windows, Mac, Linux, Android 
     

   

  • Clearer Safe Browsing protection level settings text and images  back to top

    In Chrome 118, some users will see new text describing the Safe Browsing protection level on both the Security Settings page and the Privacy Guide. The update clarifies the Enhanced Protection level by adding a table and linking to a help center article where users can learn more. The new table helps users understand the trade-offs when selecting that option versus choosing the other options. The descriptions for Standard Protection, No Protection and the password compromise warnings toggle have been simplified to make the options clearer. The Safe Browsing protection level is an existing setting and continues to be controlled by the SafeBrowsingProtectionLevel policy value.
    • Chrome 118: Some users will see the updated text and images on the Chrome Security Settings page and on the Privacy Guide.
     

   

  • WebUSB in Extension Service Workers  back to top

    Allows web developers to use WebUSB API when responding to extension events by exposing WebUSB API to Service Workers registered by browser extensions. This API will not yet be exposed to Service Workers registered by sites but the implementation experience gained by supporting the API for extensions will be valuable for such a future project.
    • Chrome 118 on Windows, Mac, Linux 
     
 

   

  • IP Protection Phase 0 for Chrome  back to top

    As early as Chrome 118, Chrome may route traffic for some network requests to Google-owned resources through a privacy proxy. This is an early milestone in a larger effort to protect users' identities by masking their IP address from known cross-site trackers. More information (including enterprise policies) will be provided in the near future.
     

   

  • Include chrome.tabs API calls in extension telemetry reports  back to top

    When you enable Enhanced Safe Browsing, Chrome will now collect telemetry information about chrome.tabs API calls made by extensions. This information is analyzed on Google servers and further improves the detection of malicious and policy violating extensions. It will also allow better protection for all Chrome extension users. This functionality along with the entire extension telemetry feature can be turned off by setting SafeBrowsingProtectionLevel to any value other than 2 (ie. disable Enhanced Safe Browsing).
    • Chrome 118 on Chrome OS, Linux, Mac, Windows: Feature launches
     

   

  • Remove non-standard appearance keywords  back to top

    Since only standard appearance keywords should be supported, we are removing the appearance (and -webkit-appearance) keywords that shouldn't be supported anymore: 

    * inner-spin-button 

    * media-slider

    * media-sliderthumb 

    * media-volume-slider 

    * media-volume-sliderthumb 

    * push-button * searchfield-cancel-button 

    * slider-horizontal * sliderthumb-horizontal 

    * sliderthumb-vertical 

    * square-button 

    Note that value slider-vertical will not be removed as part of this patch; it is used for allowing <input type=range> vertical. It will be removed once feature FormControlsVerticalWritingModeSupport is enabled in Stable. 

    Previously, if using any of the above keywords, a console warning will be shown, but the keyword will be recognized as a valid value. With the feature enabled, the appearance property will be ignored and set to the empty string. As needed for Web compatibility, we will progressively remove the appearance keywords based on their counter usages on Chrome Status Metrics. For release 118, we will start with the following keywords, currently at page load usage below 0.001%: 

    * media-slider at 0.000361 

    * media-sliderthumb at 0.000187% 

    * media-volume-slider at 0.000143% 

    * media-volume-sliderthumb at 0.000109% 

    * sliderthumb-horizontal at 0.000182% 

    * sliderthumb-vertical at 0.000014%

    • Chrome 118 on Windows, Mac, Linux, Android 
     

   

  • Chrome release schedule changes  back to top

    Chrome 119 and all subsequent releases will be shifted forward by one week. For example, Chrome 119 will have its early stable release on October 25 instead of Nov 1. Beta releases will also be shifted forward by one week starting in Chrome 119.
    • Chrome 119 on Android, iOS, Chrome OS, Linux, Mac, Windows
     

   

  • Permissions Prompt for Web MIDI API  back to top

    This feature gates the Web MIDI API access behind a permissions prompt. Today the use of SysEx messages with the Web MIDI API requires an explicit user permission. With this implementation, even access to the Web MIDI API without SysEx support will require a user permission. Three new policies—DefaultMidiSetting, MidiAllowedForUrls and MidiBlockedForUrls—will be available to allow administrators to pre-configure user access to the API.
    • Chrome 119 on Windows, Mac, Linux, Android 
     

   

  • Migrate away from data URLs in SVG <use> element  back to top

    The SVG spec was recently updated to remove support for data: URLs in SVG <use> element. This improves security of the Web platform as well as compatibility between browsers as Webkit does not support data: URLs in SVG <use> element. You can read more in this blog post. 

    For enterprises that need additional time to migrate, the DataUrlInSvgUseEnabled policy will be available temporarily to re-enable Data URL support for SVG <use> element.

    • Chrome 119 on Android, Chrome OS, LaCrOS, Linux, Mac, Windows, Fuchsia: Remove support for data: URLs in SVG <use> element
     

   

  • Chrome Browser Cloud Management: Crash report  back to top

    The Crash Report is a new Chrome Browser Cloud Management report in the Admin console where IT admins can find a chart to easily visualize the number of crash events over time, based on the versions of Chrome that are running.
    • Chrome 119 on Android, iOS, Linux, Mac, Windows: Crash Report launched in Chrome Browser Cloud Management
     

   

  • Display banner to allow resume last tab from other devices  back to top

    Help signed in users resume tasks when they have to switch devices during an immediate transition by offering to pick up tabs recently used on the previous device. Admins can control this feature via the existing enterprise policy called SyncTypesListDisabled.
    • Chrome 119 on iOS: Feature launches

     

   

  • Remove Sanitizer API  back to top

    The Sanitizer API aims to build an easy-to-use, always secure, browser-maintained HTML sanitizer into the platform. It is a cross-browser standardization effort starting in Q2/2020. We shipped an initial version of the Sanitizer API in Chrome 105, based on the then-current specification draft. However, the discussion has meanwhile moved on and the proposed API shape has changed substantially. In order to prevent the current API from becoming entrenched we would like to remove the current implementation. 

    We expect to re-implement the Sanitizer API when the proposed specification stabilizes again. 

    • Use counters: The Sanitizer API is currently used on 0.000000492% of page visits. 
    • Old vs new API: * Old explainer, API as implemented in "MVP" since Chrome 105: https://github.com/WICG/sanitizer-api/blob/e72b56b361a31b722b4e14491a83e2d25943ba58/explainer.md * 
    • New explainer (still in progress): https://github.com/WICG/sanitizer-api/blob/main/explainer.md
    • Chrome 119 on Windows, Mac, Linux, Android 
     

   

  • Tab Groups can be saved, recalled, and synced  back to top

    Users will be able to save tab groups, which will allow them to close and re-open the tabs in the group, as well as sync them across devices.
    • Chrome 119 on Chrome OS, Linux, Mac, Windows
     

   

  • Chrome profile separation: new policies  back to top

    Three new policies will be created to help enterprises configure enterprise profiles: ProfileSeparationSettings, ProfileSeparationDataMigrationSettings, ProfileSeparationSecondaryDomainAllowlist. These policies will basically be replacements for ManagedAccountsSigninRestriction, EnterpriseProfileCreationKeepBrowsingData.
    • Chrome 119 on Linux, Mac, Windows: New profile separation policies available: ProfileSeparationSettings, ProfileSeparationDataMigrationSettings, ProfileSeparationSecondaryDomainAllowlist.
     

   

  • Replace dangling markup in target name to `_blank`  back to top

    This change replaces the navigable target name (which is usually set by target attribute) to `_blank`, if it contains a dangling markup (i.e. `\n` and `<`). Which fixes a bypass in the dangling markup injection mitigation.
    • Chrome 119 on Windows, Mac, Linux, Android 
     

   

  • Private Network Access restrictions for automotive  back to top

    This ships Private Network Access restrictions to Android Automotive (if BuildInfo::is_automotive), including: - Private Network Access preflight requests for subresources and Private Network Access for Workers. See Note that the two above features were shipped in warning only mode, but this features will enforce the restriction, i.e. failing the main request if restrictions are not satisfied.
    • Chrome 5 on Windows, Mac, Linux 
    • Chrome 119 on Android 
     

   

  • Deprecate non-standard `shadowroot` attribute for declarative shadow DOM  back to top

    The standards-track `shadowrootmode` attribute, which enables declarative Shadow DOM, was shipped in Chrome 111 [1]. The older, non-standard `shadowroot` attribute is now deprecated. During the deprecation period, both attributes are functional, however the `shadowroot` attribute does not enable the new streaming behavior, whereas `shadowrootmode` allows streaming of content. There is a straightforward migration path: replace `shadowroot` with `shadowrootmode`. The old `shadowroot` attribute is deprecated as of Chrome Chrome 112, and it will be removed (no longer supported) in Chrome 119, which goes to Stable on November 1, 2023. [1] https://chromestatus.com/feature/5161240576393216
    • Chrome 119 on Windows, Mac, Linux, Android 
     

   

  • Chrome on Android will no longer support Android Nougat  back to top

    The last version of Chrome that will support Android Nougat will be Chrome 119, and it includes a message to affected users informing them to upgrade their operating system. Chrome 120 will not support nor ship to users running Android Nougat.
    • Chrome 120 on Android: Chrome on Android no longer supports Android Nougat
     

   

  • Chrome Third-Party Cookie Deprecation (3PCD)  back to top

    In Chrome 120 and beyond (Jan 2024), Chrome will globally disable third-party cookies for 1% of Chrome traffic as part of our Chrome-facilitated testing in collaboration with the CMA, to allow sites to meaningfully preview what it's like to operate in a world without third-party cookies (3PCs). Most enterprise end users will be excluded from this experiment group automatically. But for the few that may be affected, enterprise admins will be able to utilize an enterprise policy to opt out their managed browsers ahead of the experiment and give enterprises time to make necessary changes to not rely on this policy or third party cookies. We plan to provide more details about this policy and provide more tooling to help identify 3PC use cases. In the meantime, refer to the 'Mode B: 1% third-party cookie deprecation' blog section for more details on how to prepare, provide feedback and report potential site issues.
    • Chrome 120 on Chrome OS, Linux, Mac, Windows
      1% of global traffic has third party cookies disabled. Enterprise users are excluded from this automatically where possible, and a policy is available to override the change.
     

   

   

  • Intent to deprecate: Mutation events  back to top

    Synchronous Mutation Events, including DOMSubtreeModified, DOMNodeInserted, DOMNodeRemoved, DOMNodeRemovedFromDocument, DOMNodeInsertedIntoDocument, and DOMCharacterDataModified, negatively affect page performance, and also significantly increase the complexity of adding new features to the Web. These APIs were deprecated from the spec in 2011, and were replaced (in 2012) by the much better-behaved Mutation Observer API. Usage of the obsolete Mutation Events must be removed or migrated to Mutation Observer.
    • Chrome 127 on Android, Chrome OS, Linux, Mac, Windows: Mutation Events will stop functioning in Chrome 127, around July 30, 2024.
     

   

  • Extensions must be updated to leverage Manifest V3  back to top

    Extensions must be updated to leverage Manifest V3 back to top Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. As mentioned earlier in our blog post (https://developer.chrome.com/blog/more-mv2-transition/) the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed. During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3. An Enterprise policy ExtensionManifestV2Availability is available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management. For more information on the Manifest timeline: https://developer.chrome.com/docs/extensions/migrating/mv2-sunset/
    • Chrome 98 on Chrome OS, LaCrOS, Linux, Mac, Windows: Chrome Web Store stops accepting new Manifest V2 extensions with visibility set to "Public" or "Unlisted". The ability to change Manifest V2 extensions from "Private" to "Public" or "Unlisted" is removed.
    • Chrome 103 on Chrome OS, LaCrOS, Linux, Mac, Windows: Chrome Web Store stops accepting new Manifest V2 extensions with visibility set to "Private".
    • Chrome 110 on Chrome OS, LaCrOS, Linux, Mac, Windows: Enterprise policy ExtensionManifestV2Availability is available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions.

    Future milestone on Chrome OS, LaCrOS, Linux, Mac, Windows: Removal of ExtensionManifestV2Availability policy.

↑ back to top  

Upcoming ChromeOS changes

   

  • Privacy Hub back to top

    Later this year, users will be able to manage their camera and microphone settings across the operating system from one place in Settings. This way it only takes one click for users to completely turn off their camera or microphone all from one place when they need extra confidence in staying on mute.
     

     

   

  • ChromeOS Admin templates back to top

    App Launch Automation can be configured by Administrators in the Admin console to contain groups of applications, windows and tools that can be launched automatically on startup or on-demand by users throughout their day. With App Launch Automation, you can: get users up and running quickly at the start of their day, provide users with a way to easily get to an optimal starting point for new tasks, and remember the window layout each user sets up for their individual workflows for future use.
     

↑ back to top  

Upcoming Admin console changes

   

  • URL-keyed anonymized data collection in Kiosk mode back to top

    The policy for URL-keyed anonymized data collection, UrlKeyedAnonymizedDataCollectionEnabled, will soon be supported in the Admin console. This policy will be enforced starting October 1st and will remain disabled until then.

↑ back to top  

Chrome 116

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Enterprises can sign up for security fix notifications    
Chrome increases release velocity with security improvements planned for each week    
Share Sheet migration    
Google Search side panel    
X25519Kyber768 key encapsulation for TLS    
Improving performance: Memory Saver and Energy Saver modes  

Anti-phishing telemetry expansion    
Enabling BFCache for pages that set Cache-Control: no-store    
Idle Timeout policies on Desktop    
OS-native Passkey changes on Windows 11    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
Data processor mode on ChromeOS (including Chrome browser running on managed ChromeOS)     
Removal of permissive Chrome Apps webview behaviors    
ChromeOS OCR in PDFs for screen reader users    
Move ChromeVox settings pages to ChromeOS settings    
Customizing input peripherals per device settings    
Managing Android App permissions    
ChromeOS Kerberos integration enhancements    
Commercial launch of screensaver    
Enhanced autocorrect features    
Additional input method support for Linux apps    
URL-keyed anonymized data collection in Kiosk mode    
Admin console updates Security/ Privacy User productivity/ Apps Management
New policies in the Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
Extensions Review panel     
Native Client Support updates    
Updates to Clear Browsing Data on Android    
Skip unload events    
Require X.509 key usage extension for RSA certificates chaining to local roots    
Network service will be sandboxed on Linux and ChromeOS    
Bounce Tracking mitigations    
Restricting the use of --load-extension    
Service Worker static routing API    
Enable access to WebUSB API from extension service workers    
Simplified sign-in and sync experience    
IP Protection Phase 0 for Chrome    
Web MIDI permission prompt    
Network service will be sandboxed on Windows    
Removal of the RendererCodeIntegrityEnabled policy    
Chrome 117 will no longer support macOS 10.13 and macOS 10.14    
New Chrome Desktop visual refresh in Chrome 117    
Update to the lock icon    
Storage Access API with Prompts    
Extensions must be updated to leverage Manifest V3
Removal ForceMajorVersionToMinorPositionInUserAgent policy    
Chrome release schedule changes    
Chrome 119 to phase out support for Web SQL    
Migrate away from data URLs in SVG <use> element  
Chrome profile separation  
Removal LegacySameSiteCookieBehaviorEnabledForDomainList policy     
Intent to deprecate: Mutation Events    
Warnings on insecure downloads    
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
ChromeOS battery state sounds    

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Please allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

   

  • Enterprises can sign up for security fix notifications back to top 

    Using this sign-up form, you can opt in to receive email notifications whenever there's a Chrome release that contains high or critical security fixes, including zero-day fixes. Chrome uses a fast release cycle to keep you ahead of bad actors, and so you can expect such a release approximately every week. By default, Chrome applies updates automatically when they're made available, so no action is required from admins who keep Chrome's default update behavior. You can read more about Chrome updates strategies for enterprises here.

   

  • Chrome increases release velocity with security improvements planned for each week back to top 

    In Chrome 115 and previous releases, Chrome maintained a four-week release cycle with a minor release halfway between each major release containing security improvements and minor bug fixes. Major releases continue to be planned for approximately every four weeks, but starting in Chrome 116, minor releases are now planned every week. This allows us to deliver security improvements even faster. If you have auto-updates turned on (the default behavior of Chrome, and our recommendation), then no action is required. Chrome might still release some unplanned updates in response to critical fixes, zero-day fixes, or other unforeseen circumstances. If you want to be notified of the security fixes contained in each release of Chrome, you can sign up for notifications here. Read more about Chrome Security and why we're making this change in our blog post

   

  • Share Sheet migration back to top 
     

    Shared sheet migration  

    Chrome is migrating Share functionality from its custom share sheet to the Android system share sheet for Android U+ users. In this migration, we’ve deprecated some functionality such as stylized cards for shared highlights and a redundant button for short (non full-page) screenshots. On Pre-U Android, Chrome still shows the custom share sheet and users can navigate to the system share sheet using the More (...) button.

   

  • Google Search side panel back to top 

    Chrome is introducing the Search side panel, a new contextual side panel experience that allows users to delve into the content of the page they're currently viewing. The new side panel gives users new tools to get more context about the page they're viewing. We launched the Search side panel to some users in Chrome 115 and subsequently plan to roll out to all users in Chrome 116. You can control access to the Search side panel using the GoogleSearchSidePanelEnabled policy. 

   

  • X25519Kyber768 key encapsulation for TLS back to top 

    As early as Chrome 116, Chrome introduces a post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard. This is exposed as a new TLS cipher suite. TLS automatically negotiates supported ciphers, so this change should be transparent to server operators. However, some TLS middleboxes might be unprepared for the size of a Kyber key encapsulation, or a new TLS ClientHello cipher code point, leading to dropped or hanging connections. This can be resolved by updating your middlebox, or disabling the key encapsulation mechanism via the temporary PostQuantumKeyAgreementEnabled enterprise policy. However, long term, post-quantum secure ciphers will be required in TLS and the enterprise policy will be removed. This cipher will be used for both TLS and QUIC connections.

↑ back to top  

   

  • Improving performance: Memory Saver and Energy Saver modes back to top 

    In Chrome 108, we introduced features designed to improve the performance of Chrome and extend battery life under the following enterprise policies: TabDiscardingExceptions, BatterySaverModeAvailability and HighEfficiencyModeEnabled. In Chrome 116, we expand the capabilities of the Memory Saver feature to help users further understand and use tab discarding to their benefit.

    Users with Memory Saver enabled (policy HighEfficiencyModeEnabled) now have increased visibility of discarded tabs in the tab strip and more insight into memory usage of active and inactive tabs. 

    Additionally, this release makes the management of exceptions (policy TabDiscardingExceptions) more intuitive for users who have access to manage their own exceptions:

    1. In settings, users can add exceptions based on currently open tabs (in addition to manual entry which exists today)

    2. In the page action chip of a discarded tab, users can opt the site out from future discarding.

   

  • Anti-phishing telemetry expansion back to top 

    In this feature, we log user-interaction data to Chrome servers and to Safe Browsing servers, which will fill knowledge gaps about how users interact with Safe Browsing phishing warnings and phishing pages. This additional telemetry will help inform where we should concentrate our efforts to improve phishing protection because it will allow us to understand the user better. Admins can opt out by using the Enterprise policies MetricsReportingEnabled and SafeBrowsingProtectionLevel.

   

  • Enabling BFCache for pages that set Cache-Control: no-store back to top 

    Documents with a Cache-Control: no-store header (CCNS) are blocked from entering BFCache. Chrome 116 will start BFCaching these documents, except for the ones with sensitive information (Github). 

    The AllowBackForwardCacheForCacheControlNoStorePageEnabled policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header might not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible.

    If the policy is enabled or unset, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered, for example, when there is HTTP-only cookie change to the site.

    If the policy is disabled, the page with Cache-Control: no-store header will not be stored in back/forward cache.

↑ back to top  

   

  • Idle Timeout policies on Desktop back to top

    In Chrome 116, admins can now enforce taking an action, for example, closing the browser, clearing cookies or moving to the profile picker, after Chrome has been idle for some amount of time. You can use the IdleTimeout policy to set a timeout period and the IdleTimeoutActions policy to specify actions on timeout.

   

  • OS-native Passkey changes on Windows 11 back to top 

    An update to Windows 11 later in 2023 adds support for cross-device passkeys flows in Windows webauthn.dll v6. Chrome 116 recognizes this version of Windows and stops offering its own cross-device support in Chrome UI, deferring to Windows instead. This results in users seeing a different UI, as shown below. This can be tested with Chrome 116 running on Windows Insider Dev Build 23486 or later.

    Win11 passkey  

   

 

   

  • Removed policies in Chrome browser   back to top
     
    Policy Description
    EventPathEnabled Re-enable the Event.path API 

↑ back to top  

ChromeOS updates

   

  • Data processor mode on ChromeOS (including Chrome browser running on managed ChromeOS) back to top

    In ChromeOS 116, ChromeOS is releasing a data processor mode for a suite of ChromeOS features and services called Essential Services, switching Google’s role from that of a data controller over personal data, to primarily that of a data processor. Features and services for which Google remains solely a data controller are called “Optional Services”. IT admins who manage ChromeOS devices used by managed Dutch Education accounts will see these new terms and features available to select from August 18, 2023.

    These are the new tools available in data processor mode for ChromeOS:
    • Data processor mode landing page in the Admin console
    • The ability to turn-on/off individual Optional Services
    • Tools to assist customers with Data Subject Access Requests (DSARs)
    • A tool to assist customers with data subject deletion requests

   

  • Removal of permissive Chrome Apps webview behaviors back to top

    As early as Chrome 116, Chrome Apps webview usage have the following restrictions:
    • Using the webview NewWindow event to attach to a webview element in another App window causes the window reference returned by the window.open call in the originating webview to be invalidated.

    A temporary enterprise policy ChromeAppsWebViewPermissiveBehaviorAllowed is available to give enterprises time to address possible breakage related to these changes. To test whether this change is the cause of any breakage, without needing to set the enterprise policy, you can restore the previous behavior from Chrome 112 and earlier by navigating to chrome://flags and disabling chrome://flags/#enable-webview-tag-mparch-behavior.

    This change was originally scheduled for Chrome 113, but was postponed. Previous release notes mentioned a change to the handling of SSL errors within webviews, but this is no longer part of this change.

   

  • ChromeOS OCR in PDFs for screen reader users back to top

    Through Optical Character Recognition (OCR), users can convert images to text, so that they can access and read them.

    OCR pdf  

   

  • ChromeVox settings move to ChromeOS setting back to top

    In Chrome 116, you now access the existing settings for ChromeVox under the ChromeOS Accessibility settings pages.

    chromevox  

   

  • Customizing input peripherals per device settings back to top

    Users can now manage settings for their input peripherals, such as their mouse and keyboard, at the device level and apply different values for different devices. This provides more control over the peripheral experience on ChromeOS.

   

  • Managing Android App permissions back to top

    In Chrome 116, users have a better view of what data Android apps can access by reviewing allowed app permissions on the Apps page in ChromeOS Settings. Now, users can see a detailed view of the data an Android app can access on the Apps page in Settings, and they can easily manage those permissions. 

↑ back to top  

   

  • ChromeOS Kerberos integration enhancements back to top

    Starting with M116, we streamline the end user configuration flows for ChromeOS Kerberos customers. Many users use Kerberos on ChromeOS  to access corporate resources. The new UI enhancements guide users through the configuration of their Kerberos accounts in a guided flow, similar to Password Manager. For details, see this help center article.

   

  • Commercial launch of screensaver back to top

    With M116, ChromeOS represents your organization even better. The commercial launch of screensaver for the login screen or MGS lock screen allows admins to customize the appearance of idle devices. Newly added admin settings include the abilities to turn on/off the screensaver, to provide a list of screensaver images, and to customize idle times.

   

  • Enhanced autocorrect features back to top

    We've enhanced Autocorrect in ChromeOS! Autocorrect is now enabled by default for English in compatible apps, automatically fixing typos, spelling, and other errors. In addition to the new Autocorrect for physical keyboards, this update also enhances the performance of the virtual keyboard's Autocorrect and other Assistive features.

    Autocorrect  

   

  • Additional input method support for Linux apps back to top

    Linux on ChromeOS now supports complex input methods, such as Japanese and Korean. This means that you can now use the same input methods that you're already using in Chrome to type in your Linux applications. Not all applications are supported yet, but support for additional applications is coming soon.

   

  • URL-keyed anonymized data collection in Kiosk mode back to top

    The policy for URL-keyed anonymized data collection is now supported in Kiosk mode. This policy will be added to the Admin console in a future release.

↑ back to top  

Admin console updates

   

↑ back to top  

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

  • Extensions Review panel  back to top

    A new review panel will be added in chrome://extensions, which will appear whenever there are potentially unsafe extensions that need the user's attention. The initial launch will highlight extensions that are malware, policy violating or are no longer available in the Chrome Web Store. The user can choose to remove or keep these extensions.

    There will also be a count of risky extensions needing review that is presented in the Chrome Privacy & Security settings page.

    The ExtensionsUnpublishedAvailability policy will disable extensions that have been unpublished by the developer or violate Chrome Web Store policy. Note that these extensions might also appear in the Extensions Module's review panel but only if they are not installed by policy. The user can choose to remove or keep them. 

   

  • Native Client Support updates  back to top

    As early as Chrome 117, we will remove Native Client NaCl support from extensions on Windows, macOS, Linux. An enterprise policy will be available, NativeClientForceAllowed, which will allow Native Client to continue to be used until Chrome 119. 

   

  • Updates to Clear Browsing Data on Android  back to top

    We’re making it easier to find and use the browsing data deletion tools that Chrome offers. 

    We’re adding more entry points to Clear Browsing Data, including on the main Chrome menu. We’re also introducing a new quick deletion affordance to enable users to quickly delete their recent history. We’ll maintain and further enhance the more granular ‘Advanced’ Clear Browsing Data page on Privacy Settings.

    Clear browsing data  

   

  • Skip unload events  back to top

    The presence of unload event listeners is a primary blocker for back/forward cache on Chromium based browsers and for Firefox on desktop platforms. On the other hand, for mobile platforms, almost all browsers prioritize the bfcache by not firing unload events in most cases. To improve the situation, we’ve been working with lots of partners and successfully reduced the use of unload event listeners over the last few years. 

    As early as Chrome 117, to further accelerate this migration, we propose to have Chrome for desktop gradually skip unload events. In case you need more time to migrate away from unload events, we’ll offer temporary opt-outs in the form of an API and a group policy which will allow you to selectively keep the behavior unchanged. 

   

  • Require X.509 key usage extension for RSA certificates chaining to local roots  back to top

    X.509 certificates used for HTTPS should contain a key usage extension that declares how the key in a certificate may be used. Such instructions ensure certificates are not used in an unintended context, which protects against a class of cross-protocol attacks on HTTPS and other protocols. For this to work, HTTPS clients must check that server certificates match the connection's TLS parameters, specifically that the key usage flag for “digitalSignature” and possibly “keyEncipherment” (depending on TLS ciphers in use) are asserted when using RSA.

    Chrome 117 will begin enforcing that the key usage extension is set properly on RSA certificates chaining to local roots. Key usage is already required for ECDSA certificates, and for publicly trusted certificates. Enterprises can test and temporarily disable key usage enforcement using the RSAKeyUsageForLocalAnchorsEnabled policy (available in Chrome 116). 

   

  • Network service will be sandboxed on Linux and ChromeOS  back to top

    As early as Chrome 117, the network service will be sandboxed on Linux and ChromeOS to improve security. On Linux, it's possible that third party software (likely data loss prevention or antivirus software) is injecting code into Chrome's processes and will be blocked by this change. This may result in Chrome crashing for your users.

    If this happens, you should work with the vendor of the third party software to stop it from  injecting code into Chrome's processes. In the meantime, you will be able to use the NetworkServiceSandboxEnabled policy to defer the sandboxing. This is a temporary measure intended to help enterprises surprised by the change; the policy will be removed in a future version of Chrome.

   

  • Bounce Tracking mitigations  back to top

    As early as Chrome 116, Chrome will launch bounce tracking mitigations. Bounce tracking mitigations will only take effect when the policy is set to true (Block 3rd party cookies). You can use the BlockThirdPartyCookies policy to control this feature. Alternatively, if 3rd party cookies are blocked by default you can exempt specific sites by using the CookiesAllowedForUrls policy.

   

  • Restricting the use of --load-extension  back to top

    The --load-extension command-line switch provides a very low bar for cookie theft malware to load malicious extensions without an installation prompt. Chrome will gradually phase out this switch to reduce this attack vector for malware. Starting in Chrome 116, --load-extension will be ignored for users that have enabled Enhanced Safe Browsing.

   

  • Service Worker static routing API  back to top

    Chrome 116 will release the Service Worker static routing API; it enables developers to optimize how Service Workers are loaded. Specifically, it allows developers to configure the routing, and allows them to offload simple things ServiceWorkers do. If the condition matches, the navigation happens without starting ServiceWorkers or executing JavaScript, which allows web pages to avoid performance penalties due to ServiceWorker interceptions.

   

  • Enable access to WebUSB API from extension service workers  back to top

    As early as Chrome 117, we will enable access to WebUSB API from extension service workers as a migration path for Manifest V2 extensions that currently access the API from a background page.

    WebUSB policies can also be applied to extension origins to control this behavior. See DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls, and WebUsbAllowDevicesForUrls for more details.

   

  • Simplified sign-in and sync experience  back to top

    Starting in Chrome 117, some users may experience a simplified and consolidated version of sign-in and sync in Chrome. Chrome sync will no longer be shown as a separate feature in settings or elsewhere. Instead, users can sign in to Chrome to use and save information like passwords, bookmarks and more in their Google Account, subject to the relevant enterprise policies.

    As before, the functionality previously part of Chrome sync that saves and accesses Chrome data in the Google Account can be turned off fully (via SyncDisabled) or partially (via SyncTypesListDisabled). Sign-in to Chrome can be required or disabled via BrowserSignin as before.

    Note that the changes do not affect users’ ability to sign in to Google services on the web (like Gmail) without signing in to Chrome, their ability to stay signed out of Chrome, or their ability to control what information is synced with their Google Account.

    Settings  

   

  • IP Protection Phase 0 for Chrome  back to top

    Beginning in Chrome 118, Chrome may route traffic for some network requests to Google-owned resources through a privacy proxy. This is an early milestone in a larger effort to protect users' identities by masking their IP address from known cross-site trackers. More information (including enterprise policies) will be provided in the near future.

   

  • Web MIDI permission prompt  back to top

    Starting in Chrome 118, the Web MIDI API access will be gated behind a permissions prompt. Currently, the use of SysEx messages with the Web MIDI API requires explicit user permission. With the planned implementation, even access to the Web MIDI API without SysEx support will require user permission. Both permissions will be requested in a bundled permissions prompt.

    Three new policies DefaultMidiSetting, MidiAllowedForUrls and MidiBlockedForUrls will be available to allow administrators to pre-configure user access to the API.

   

  • Network Service on Windows will be sandboxed on Windows  back to top

    As early as Chrome 118, to improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.

   

  • Removal of the RendererCodeIntegrityEnabled policy  back to top

    As early as Chrome 117, the RendererCodeIntegrityEnabled policy will be removed. We recommend that you verify any potential incompatibilities with third party software by no longer applying the policy in advance of this release. You can report any issues you encounter by submitting a bug here.

   

  • Chrome 117 will no longer support macOS 10.13 and macOS 10.14  back to top

    Chrome 117 will no longer support macOS 10.13 and macOS 10.14, which are already outside of their support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security. If run on macOS 10.13 or 10.14, Chrome continues to show an infobar that reminds users that Chrome 117 will no longer support macOS 10.13 and macOS 10.14.

   

  • New Chrome Desktop visual refresh in Chrome 117  back to top

    With Google’s design platform moving to Google Material 3, we have an opportunity to modernize our desktop browser across OS’s, leveraging updated UI elements or styling, enhancing personalization through a new dynamic color system, and improving accessibility. The first wave of UI updates will roll out in Chrome 117.

    Refresh  

    The three dot Chrome menu will also be refreshed, providing a foundation to scale personalization and customization experiences in Chrome by enabling customers proximate access to tools and actions. The menu will be updated in phases starting in Chrome 117.

    Refresh  

   

  • Update to the lock icon  back to top

    We plan to replace the lock icon with a variant of the tune icon, which is commonly used to indicate controls and settings. Replacing the lock icon with a neutral indicator prevents the misunderstanding that the lock icon is associated with the trustworthiness of a page, and emphasizes that security should be the default state in Chrome. Our research has also shown that many users never understood that clicking the lock icon showed important information and controls. We think the new icon helps make permission controls and additional security information more accessible, while avoiding the misunderstandings that plague the lock icon.

    The new icon is scheduled to launch in Chrome 117 as part of a general design refresh for desktop platforms. Chrome will continue to alert users when their connection is not secure. You can see the new tune icon now in Chrome Canary for Desktop if you enable Chrome Refresh 2023 at chrome://flags#chrome-refresh-2023, but keep in mind this flag enables work that is still actively in-progress and under development, and does not represent a final product.

    We will also replace the icon on Android. On iOS, the lock icon is not tappable, so we will be removing the icon.

    You can read more in this blog post.

    PDF sig tools  

   

  • Storage Access API with Prompts  back to top

    The Storage Access API provides a means for authenticated cross-site embeds to check their blocking status and request access to storage if they are blocked. Targeting Chrome 117 for Desktop, we will support the Storage Access API by implementing all the behaviors listed in the specification, i.e. with user prompts, and additionally having its own user-agent-specific behaviors.

   

  • Extensions must be updated to leverage Manifest V3  back to top

    Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. 

    As mentioned earlier in our blog post, More details on the transition to Manifest V3, the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed.

    During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3.

    Starting with Chrome 110, an Enterprise policy ExtensionManifestV2Availability has been available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions until at least January 2024. 

    You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management.

    For more details, refer to the Manifest V2 support timeline.

   

  • Removal ForceMajorVersionToMinorPositionInUserAgent policy  back to top

    Chrome 118 plans to remove the ForceMajorVersionToMinorPositionInUserAgent policy. This policy was introduced in Chrome 99 to control whether the User-Agent string major version would be frozen at 99, in case of User-Agent string parsing bugs when the version changed to 100. Fortunately, we did not need to deploy this feature and only encountered a few minor 3-digit version parsing issues that have all since been fixed. Given that, we intend to remove this policy.

    If you have any feedback about this policy removal, or are aware of intranet breakage that depends on the policy, please comment on this bug. 

   

  • Chrome release schedule changes  back to top

    Chrome 119 and all subsequent releases will be shifted forward by one week. For example, Chrome 119 will have its early stable release on October 25 instead of Nov 1. Beta releases will also be shifted forward by one week starting in Chrome 119.  

   

  • Chrome 119 to phase out support for Web SQL  back to top

    Starting in Chrome 119, to improve user data security, Chrome will remove support for Web SQL. The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. As of today, Chrome is the only major browser with support for Web SQL. The W3C encouraged those needing web databases to adopt Indexed Database or SQLite WASM.
     

    The timeline for the deprecation will be:

    • Chrome 115 - Deprecation message added
    • Chrome 117 - 123 - Deprecation trial
    • Chrome 119 - Ship removal


    More details about the deprecation and removal can be found on the Chromestatus page.

    An enterprise policy WebSQLAccess is available until Chrome 123 to enable Web SQL to be available.

   

  • Migrate away from data URLs in SVG <use> element  back to top

    The SVG spec was recently updated to remove support for data: URLs in SVG <use> element. This improves security of the Web platform as well as compatibility between browsers as Webkit does not support data: URLs in SVG <use> element. We expect to remove support for data: URLs in SVG <use> element in Chrome 119, scheduled to ship in November 2023. You can read more in this blog post. For enterprises that need additional time to migrate, the DataUrlInSvgUseEnabled policy will be available temporarily to re-enable Data URL support for SVG <use> element.

   

  • Chrome profile separation  back to top

    As early as Chrome 119, three new policies will be created to help enterprises configure enterprise profiles: ProfileSeparationSettings, ProfileSeparationDataMigrationSettings, ProfileSeparationSecondaryDomainAllowlist.

   

   

  • Intent to deprecate: Mutation Events  back to top

    Synchronous Mutation Events, including `DOMSubtreeModified`, `DOMNodeInserted`, `DOMNodeRemoved`, `DOMNodeRemovedFromDocument`, `DOMNodeInsertedIntoDocument`, and `DOMCharacterDataModified`, negatively affect page performance, and also significantly increase the complexity of adding new features to the Web. These APIs were deprecated from the spec in 2011, and were replaced (in 2012) by the much better-behaved Mutation Observer API. Usage of the obsolete Mutation Events must be removed or migrated to Mutation Observer. Mutation Events will stop functioning in Chrome 127, around July 30, 2024.

   

  • Warnings on insecure downloads  back to top

    Chrome will begin showing warnings on some downloads if those files were downloaded over an insecure connection, that is, not HTTPS. These warnings do not prevent downloading and can be bypassed by the user. Enterprises can test their downloads by enabling warnings via chrome://flags/#insecure-download-warnings. Enterprises can also disable warnings for sites that can not deliver files securely by adding the download site to InsecureContentAllowedForUrls.

↑ back to top  

Upcoming ChromeOS changes

   

  • ChromeOS battery state sounds back to top

    As early as Chrome 117, we will add audible sounds to indicate battery status. Users will be able to turn on and off these sounds and Admins will be able to control them through policies.

    When the device is not plugged in, you will hear warning sounds if:
    • Battery level goes down to 15 minutes of charge time left, and another one when there is 5 minutes left.

    When the device is plugged in, you will hear an information beep when:
    • Battery level - 0-15% (low) 
    • Battery level - 16-79% (med) 
    • Battery level - 80-100% (high)

    In the case where the device is connected to a low power charger, you’ll hear warnings when the battery goes down to 10%, then again at 5%.

↑ back to top  

Chrome 115

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Google Search side panel    
Secure DNS auto-upgrade for some Quad9Secure DNS users    
HTTP requests upgraded to HTTPS    
Support for Encrypted Client Hello (ECH)    
Disable extensions unpublished from Chrome Web Store    
Updates to initial_preferences    
Bookmarks and reading list improvements on iOS    
Update for secure DNS queries on Cox ISP servers    
Reading mode    
Removal of SHA1 in server signatures in TLS    
Policy Sync dependency handling    
Skia renderer for PDF rendering  
One Time Permissions desktop    
Privacy Sandbox Developer enrollment form    
Update on BrowsingDataLifetime policy    
Set Up Chrome module for iOS    
Carousel on the new tab page    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
App Streaming on ChromeOS    
Floating windows on ChromeOS    
Pause cast for cast moderator    
Enhanced signature options for PDF toolkit    
Passpoint: Seamless, secure connection to Wi-Fi networks    
Expand Language Packs to Text-to-Speech    
New keyboard Shortcut app    
Admin console updates Security/ Privacy User productivity/ Apps Management
New Chrome Browser Cloud Management card    
ChromeOS Settings page redesign    
Chrome Setup Guides    
Printing reports now available in Chrome Management Reports API    
New policies in the Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
X25519Kyber768 key encapsulation for TLS    
Improving performance: Memory Saver and Energy Saver modes    
Anti-phishing telemetry expansion    
Network Service on Windows will be sandboxed     
Enabling BFCache for pages that set Cache-Control: no-store    
Idle Timeout policies    
Windows 11 changes affecting Chrome in ~September    
Native Client Support updates    
Skip unload events    
Extensions Review panel     
Require X.509 key usage extension for RSA certificates chaining to local roots      
Bounce Tracking mitigations  
Restricting the use of --load-extension    
Service Worker static routing API    
Enable access to WebUSB API from extension service workers    
Simplified sign-in and sync experience    
Web MIDI permission prompt    
Removal of the RendererCodeIntegrityEnabled policy    
Chrome 117 will no longer support macOS 10.13 and macOS 10.14  
New Chrome Desktop refresh and Chrome menu in Chrome 117    
Update for lock icon  
Extensions must be updated to leverage Manifest V3  
Removal ForceMajorVersionToMinorPositionInUserAgent policy    
Chrome 119 to phase out support for Web SQL    
Removal LegacySameSiteCookieBehaviorEnabledForDomainList policy     
Intent to deprecate: Mutation Events    
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
ChromeOS battery state sounds    
Removal of permissive Chrome Apps webview behaviors    

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Please allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

   

  • Google Search side panel   back to top 

    In Chrome 115, Google introduces the Search side panel, a new contextual side panel experience that allows users to delve into the content of the page they're currently viewing. The new side panel features a search box that allows text-based and visual queries, questions related to the page, and links to more details about the current site. We launch the Search side panel to some users in Chrome 115 and subsequently plan to roll out to all users in Chrome 116. You can control access to the Search side panel using the GoogleSearchSidePanelEnabled policy. 

   

  • Secure DNS auto-upgrade for some Quad9Secure DNS users  back to top
     
    Starting in Chrome 115, for a small subset of Chrome users, secure DNS queries are used instead of insecure DNS queries to perform host name resolution using Quad9 Secure (9.9.9.9) DNS servers. This change affects behavior for a given client under the following conditions only:
    • The client is running on a system that has been configured to use the Quad9 Secure (9.9.9.9) DNS servers.
    • The DnsOverHttpsMode enterprise policy is set to “Automatic” (the default value is “Off”).
    • The ChromeVariations policy is set to enable all variations.
    • The client is randomly selected to be part of the 1% of clients where this behavior is enabled. 

   

  • HTTP requests upgraded to HTTPS   back to top
     

    As early as Chrome 115, some users might see HTTP requests automatically upgraded to HTTPs. Any page that can't load via HTTPS is automatically reverted back to HTTP. For standard server configurations, this shouldn't have any visible effect, but it improves your users' security.

    Some server configurations might cause issues, for example, if different content is served via HTTP and HTTPS. Users can bypass the automatic upgrading by explicitly navigating to an http:// URL in the Omnibox, or by changing the Insecure Content site setting to enabled, accessible via Page Info and chrome://settings/content. You can control this behavior with the HttpsUpgradesEnabled policy, and allowlist specific sites with the HttpAllowlist policy.

    In the long term, you should ensure that your organization's servers support HTTPS and serve the same content on both HTTP and HTTPS. If you don't intend to support HTTPS (for example, on an intranet behind a firewall), servers shouldn't respond to port 443, and firewalls should close the connection rather than leave it hanging. You can test HTTPS upgrading in your environment by enabling chrome://flags#https-upgrades. If you come across any issues, you can report them to us.

    Starting in Chrome 115, Chrome automatically enables HTTPS-First Mode based on the user's browsing history. It automatically enables the HTTPS-First Mode interstitial on sites that regularly load over HTTPS. Sites that regularly use plaintext HTTP are unaffected. In practice, this change protects users from downgrade attacks, but is invisible to users. 

   

 
  • Support for Encrypted Client Hello (ECH)   back to top

    Chrome 115 starts rolling out support for ECH on sites that opt in, as a continuation of our network-related efforts to improve our users’ privacy and safety on the web, for example, Secure DNS. This change was originally planned for Chrome 107, but had to be postponed. 

    If your organization’s infrastructure relies on the ability to inspect SNI, for example, filtering, logging, and so on, you should test it. You can enable the new behavior by navigating to chrome://flags and enabling the #encrypted-client-hello flag.

    On Windows and Linux, you also need to enable Secure DNS for the flag to have an effect.

    If you notice any incompatibilities, you can use the EncryptedClientHelloEnabled enterprise policy to disable support for ECH. 

↑ back to top  

   

 
  • Disable extensions unpublished from Chrome Web Store  back to top

    In Chrome 115, we release the Enterprise policy ExtensionUnpublishedAvailability to allow you to disable extensions that have been unpublished from the Chrome Web Store. 

   

  • Updates to initial_preferences   back to top
     

    We’ve removed the following fields from the initial_preferences sample file:

    • Removed from example because they're no longer valid:
      • sync_promo.show_on_first_run_allowed
      • suppress_first_run_bubble
      • suppress_first_run_Default_browser_prompt
    • Removed from example because they can be controlled by a recommended policy:
      • homepage
      • homepage_is_newtabpage
      • show_home_button
      • session
      • bookmark_bar
      • import_* except for import_bookmarks_from_file
      • make_chrome_default_*
    • Removed from example because they're not applicable to enterprise usage, or only applicable for user-level install:
      • ping_delay
      • do_not_launch_chrome
      • do_no_register_for_update_launch 

   

  • Bookmarks and reading list improvements on iOS   back to top

    On Chrome 115 on iOS, some users who sign in to Chrome from bookmark manager or reading list surfaces can now use and save bookmarks and reading list items in their Google Account. Relevant enterprise policies, such as BrowserSignin, SyncDisabled, SyncTypesListDisabled, EditBookmarksEnabled and ManagedBookmarks continue to work as before, to configure whether users can use and save items in their Google Account. 

   

  • Update for secure DNS queries on Cox ISP servers   back to top
     

    For clients running on systems that use the Cox ISP DNS servers, if the DnsOverHttpsMode policy is set to Automatic, Chrome uses secure DNS queries instead of insecure DNS queries, starting in Chrome 115 (and in earlier versions, starting on May 16, 2023, if the ChromeVariations policy is set to enable all variations). 

   

  • Reading mode   back to top

    As more content is read online, Chrome 115 adds a new feature to help improve the online reading experience. Introducing reading mode, a new feature on Chrome browser, which enhances the reading experience on the web for everyone. Reading mode reduces distracting elements through a resizable and customizable reader view in the Chrome browser side panel, enabling readers to focus on the primary content. Users can also customize the font, text size, spacing, theme or background color, and more, making for a more cohesive, intuitive, and comfortable reading experience.

    read mode  

↑ back to top  

   

  • Removal of SHA1 in server signatures in TLS   back to top
     

    Chrome 115 removes support for signature algorithms using SHA-1 for server signatures during the TLS handshake. SHA1, which has known collisions, has been deprecated by the IETF, and should be avoided, where possible.

    This does not affect SHA-1 support in server certificates, which was already removed. SHA-1 in client certificates continues to be supported. Enterprises that rely on SHA1 signature schemes in TLS can use the InsecureHashesInTLSHandshakesEnabled policy to continue to accept SHA1 in server signatures.

     

   

  • Policy Sync dependency handling   back to top

    Currently, we require admins to set SyncDisabled for any data-deletion policy (BrowsingDataLifetime, ClearBrowsingDataOnExitList). In Chrome 115, we automatically disable sync for the respective data types and no longer require admins to additionally set the SyncDisabled policy. We will gradually roll out this feature behind a flag. You can enable this behavior at chrome://flags#data-retention-policies-disable-sync-types-needed

   

  • Skia renderer for PDF rendering   back to top

    Chrome 115 adds a new enterprise policy, PdfUseSkiaRendererEnabled, to override user choice on whether to enable Skia renderer. When Skia renderer is enabled, it switches the PDF render device from AGG (Anti-Grain Geometry) to Skia. Skia renderer provides enhanced technical support and uses different algorithms for drawing graphics. Any resulting visual differences are expected to be very minor. 

   

  • One Time Permissions desktop   back to top

    When users are prompted for a permission they can currently select Allow or Deny, both options are stored permanently. This feature adds an Allow this time option for geolocation, camera and microphone permissions. This fine-tunes the permission granted to a newly introduced session, which we believe more accurately represents a one-time permission session, without affecting any common scenarios. In Chrome 115, we start slowly rolling out this feature to a subset of users. 

   

  • Privacy Sandbox Developer enrollment form   back to top

    To access the Privacy Sandbox relevance and measurement APIs on Chrome and Android, developers need to enroll with the Privacy Sandbox. The developer enrollment process verifies companies before they can use the APIs, as an additional layer of protection for user privacy. As part of this enrollment process, we require developers to agree to restrictions around the usage of these services to prevent re-identification of users across sites. 

   

  • Update on BrowsingDataLifetime policy   back to top

    We have updated the documentation for BrowsingDataLifetime to state that download_history and hosted_app_data are not supported on Android. 

↑ back to top  

   

  • Set Up Chrome module for iOS   back to top

    On iOS, some new users in Chrome 115 see the new Set Up Chrome module. This module provides options, in the center of the new tab page, to allow new users to view and complete items that help them set up and get the most out of Chrome, on their own time. The items listed in the module are optional, and the module displays temporarily for up to a few weeks after installing the app. At this time, this is only available for iOS.

    Set up Chrome  


    Set up Chrome  

   

  • Carousel on the Google New tab page   back to top
     

    A new carousel on the Google New tab page allows users to swipe between certain modules. This is a limited-availability feature for some new users. The carousel can display in two ways: 

    • With the Most Visited Sites and Shortcuts module, or 
    • With the Shortcuts module.


    For example, a user might see Most Visited Sites but can swipe to see Shortcuts.
    New tab carousel  

   

 

   

  • Removed policies in Chrome browser   back to top
     
    Policy Description
    ForceEnablePepperVideoDecoderDevAPI Enable support for the PPB_VideoDecoder(Dev) API.
    PPAPISharedImagesSwapChainAllowed Allow modern buffer allocation for Graphics3D APIs PPAPI plugin.
    UseMojoVideoDecoderForPepperAllowed Allow Pepper to use a new decoder for hardware accelerated video decoding.

ChromeOS updates

   

  • App Streaming on ChromeOS   back to top
     

    As early as ChromeOS 115, App Streaming enhances the Phone Hub experience, by allowing users to see and interact with streamed apps running on their Pixel phone. When a user receives a mirrored conversation notification from their Pixel phone, a simple tap on that notification kicks off an app stream directly to the user's ChromeOS desktop. This is part of a Google-wide ambient computing effort.
      

↑ back to top  

 

   

  • Floating windows on ChromeOS   back to top

    In Chrome 115, a new Window layout menu in ChromeOS helps to accelerate common actions like split-screening two windows. In addition, we're adding a new window state, Float, which allows users to set a window as always-on-top.

    Floating windows  

   

  • Pause cast for cast moderator   back to top

    While using cast moderator, sometimes users need a quick way to pause what they are casting. In ChromeOS 115, with Pause cast, you can now pause what you cast to the shared screen on a still image, while you do something else on your computer. 

    In ChromeOS Quick Settings or from Chrome browser Cast menu, select Pause to display the last casted screen on the cast receiver. While paused, other actions you perform on your computer are NOT cast to the cast receiver. When cast is resumed, your computer starts mirroring to the cast receiver again.

    Pause cast  

   

  • Enhanced signature options for PDF toolkit   back to top

    In ChromeOS 115, the Gallery PDF toolkit makes it easier for users to sign their documents, allowing for the creation of a free-hand signature that is saved in the app for subsequent use. Gallery is the ChromeOS media multi-tool that provides users with fast, consistent, and discoverable ways to view, tweak, and route various media types.

    PDF sig tools  

   

  • Passpoint: Seamless, secure connection to Wi-Fi networks   back to top

    Passpoint streamlines Wi-Fi access and eliminates the need for users to find and authenticate a network each time they visit.  Once a user accesses the Wi-Fi network offered at a location, the Passpoint-enabled client device will automatically connect upon subsequent visits. Wi-Fi Passpoint is now supported on ChromeOS through supported Android applications. Wi-Fi Passpoint is a set of Wi-Fi mechanisms defined by the Wi-Fi Alliance that facilitate and automate the provisioning and configuration of secure Wi-Fi networks while also minimizing user intervention. Once provisioned, whenever a compatible and secured Wi-Fi network is in range, ChromeOS can automatically connect to it without the need for user interaction.
 
  •  Expand Language Packs to Text-to-Speech
     

    Some Google Text-to-Speech voices that were previously preinstalled are now downloaded over the network when they are needed. This frees up some space on the ChromeOS device.

 
  •  New keyboard Shortcut app
     

    The new Shortcut App offers a new navigation and taxonomy, easier in-app search functionalities and a refreshed shortcut visualization.

↑ back to top  

Admin console updates

   

  • New Chrome Browser Cloud Management card   back to top

    Chrome 115 launches a new Chrome Browser Cloud Management card on the homepage of the Google Admin console. You can now easily access and find popular Chrome browser management tasks, directly on the homepage.

    CBCM card

   

  • Chrome Settings page redesign   back to top

    We’ve heard your feedback, and we’re excited to share that all admins now see a redesigned experience across Users & browsers, Device, and Managed guest session settings pages to make it easier to manage policies. Look out for:

    Settings redesign  
     
    • A more scannable, read-only table to view setting configurations across your organization.
    • Dedicated policy views for admins to focus on individual settings.
    • Updated policy descriptions that pull directly from live Help Center content; no more toggling between windows to learn more about a policy. This includes supported-on information for platform and version for all policies.

   

  • Chrome Setup Guides   back to top
     

    The Chrome Setup Guides section now includes new, interactive content to help with performing common ChromeOS journeys in the Admin console. These new journeys include:

    • Creating test organizational units
    • Adding users for testing
    • Turning on ChromeOS reporting
    • Enrolling a test device
    • Setting device policies
    • Setting user policies
    • Installing apps and extensions
    • Adding a Wi-Fi network


    Chrome setup guides  


    To access the new Chrome Setup Guides:
    • Log in to the Admin console.
    • On the left, select Devices>Chrome>Setup Guides.

       

   

  • Printing reports now available in Chrome Management Reports API   back to top

    We have added additional endpoints to Chrome Management Reports API that allow access to printing reports. The new endpoints provide per-user and per-printer summary printing reports, as well as a listing of all print jobs submitted to managed printers. The data provided by the new endpoints corresponds to the data in the Print Usage page of the Admin console. This update exposes the same data in the third-party Reports API. 

   

  • New policies in the Admin console   back to top
     
    Policy Name Pages Supported on Category/Field
    Enable AutoFill for addresses User & Browser Settings M88 User experience > Address form Autofill
    Enable AutoFill for credit cards User & Browser Settings M88 User experience > Credit card form Autofill

↑ back to top  

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

  • X25519Kyber768 key encapsulation for TLS  back to top

    As early as Chrome 116, Chrome will introduce a post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard. This will be exposed as a new TLS cipher suite. TLS automatically negotiates supported ciphers, so this change should be transparent to server operators. However, some TLS middleboxes might be unprepared for the size of a Kyber key encapsulation, or a new TLS ClientHello cipher code point, leading to dropped or hanging connections. This can be resolved by updating your middlebox, or disabling the key encapsulation mechanism via the temporary PostQuantumKeyAgreementEnabled enterprise policy. However, long term, post-quantum secure ciphers will be required in TLS and the enterprise policy will be removed.

   

  • Improving performance: Memory Saver and Energy Saver modes   back to top
     

    In Chrome 108, we introduced features designed to improve the performance of Chrome and extend battery life under the following enterprise policies: TabDiscardingExceptions, BatterySaverModeAvailability and HighEfficiencyModeEnabled. In Chrome 116, we will expand the capabilities of the Memory Saver feature to help users further understand and use tab discarding to their benefit.

    Users with Memory Saver enabled (policy HighEfficiencyModeEnabled) will have increased visibility of discarded tabs in the tab strip and more insight into memory usage of active and inactive tabs. 

    Additionally, this release will make the management of exceptions (policy TabDiscardingExceptions) more intuitive for users who have access to manage their own exceptions:

    1. In settings, users will be able to add exceptions based on currently open tabs (in addition to manual entry which exists today)
    2. In the page action chip of a discarded tab, users will have the option to opt the site out from future discarding.
     

   

  • Anti-phishing telemetry expansion   back to top

    In this feature, we log user-interaction data to Chrome servers and to Safe Browsing servers, which will fill knowledge gaps about how users interact with Safe Browsing phishing warnings and phishy pages. This additional telemetry will help inform where we should concentrate our efforts to improve phishing protection because it will allow us to understand the user better. Admins can opt out by using the Enterprise policies MetricsReportingEnabled and SafeBrowsingProtectionLevel.

   

  • Network Service on Windows will be sandboxed   back to top

    As early as Chrome 116, to improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter. 

   

  • Enabling BFCache for pages that set Cache-Control: no-store   back to top
     

    Documents with a Cache-Control: no-store header (CCNS) are blocked from entering BFCache. Chrome 116 will start BFCaching these documents, except for the ones with sensitive information (Github). 

    The AllowBackForwardCacheForCacheControlNoStorePageEnabled policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header might not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible.

    If the policy is enabled or unset, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered, for example, when there is HTTP-only cookie change to the site.

    If the policy is disabled, the page with Cache-Control: no-store header will not be stored in back/forward cache.

   

  • Idle Timeout policies   back to top

    In Chrome 116, admins will be able to enforce taking an action, for example closing the browser, or moving to the profile picker, after Chrome has been idle for some amount of time. You will be able to  use the IdleTimeout policy to set a timeout period and the IdleTimeoutActions policy to specify actions on timeout.
     

   

  • Windows 11 changes affecting Chrome in ~September   back to top

    An update to Windows 11 later in 2023 will add support for cross-device passkeys flows in Windows webauthn.dll v6. Chrome 116 will recognize this version of Windows and stop offering its own cross-device support in Chrome UI, deferring to Windows instead. This will result in users seeing a different UI, as shown below. This can be tested with Chrome 116 running on Windows Insider Dev Build 23486 or later.

    Before:

    Win 11 update  
     

    After:

    Win 11 update

↑ back to top  

   

  • Native Client Support updates   back to top

    As early as Chrome 117, we will remove Native Client NaCl support from extensions on Windows, macOS, Linux. An enterprise policy will be available, NativeClientForceAllowed, which will allow Native Client to continue to be used until Chrome 119. 

   

  • Skip unload events   back to top

    The presence of unload event listeners is a primary blocker for back/forward cache on Chromium based browsers and for Firefox on desktop platforms. On the other hand, for mobile platforms, almost all browsers prioritize the bfcache by not firing unload events in most cases. To improve the situation, we’ve been working with lots of partners and successfully reduced the use of unload event listeners over the last few years. 

    As early as Chrome 117, to further accelerate this migration, we propose to have Chrome for desktop gradually skip unload events. In case you need more time to migrate away from unload events, we’ll offer temporary opt-outs in the form of an API and a group policy which will allow you to selectively keep the behavior unchanged. 

   

  • Extensions Review panel   back to top

    A new review panel will be added in chrome://extensions which will appear whenever there are potentially unsafe extensions that need the user's attention. The initial launch will highlight extensions that are malware, policy violating or are no longer available in the Chrome Web Store. The user can choose to remove or keep these extensions.

    There will also be a count of risky extensions needing review that is presented in the Chrome Privacy & Security settings page.

    The ExtensionsUnpublishedAvailability policy will disable extensions that have been unpublished by the developer or violate Chrome Web Store policy. Note that these extensions might also appear in the Extensions Module's review panel but only if they are not installed by policy. The user can choose to remove or keep them. 

   

  • Require X.509 key usage extension for RSA certificates chaining to local roots   back to top

    X.509 certificates used for HTTPS should contain a key usage extension that declares how the key in a certificate may be used. Such instructions ensure certificates are not used in an unintended context, which protects against a class of cross-protocol attacks on HTTPS and other protocols. For this to work, HTTPS clients must check that server certificates match the connection's TLS parameters, specifically that the key usage flag for “digitalSignature” and possibly “keyEncipherment” (depending on TLS ciphers in use) are asserted when using RSA.

    Chrome 117 will begin enforcing that the key usage extension is set properly on RSA certificates chaining to local roots. Key usage is already required for ECDSA certificates, and for publicly trusted certificates. Enterprises can test and temporarily disable key usage enforcement using the RSAKeyUsageForLocalAnchorsEnabled policy (available in Chrome 116). 

   

  • Bounce Tracking mitigations  back to top

    As early as Chrome 116, Chrome will launch bounce tracking mitigations. Bounce tracking mitigations will only take effect when the policy is set to true (Block 3rd party cookies). You can use the BlockThirdPartyCookies policy to control this feature. Alternatively, if 3rd party cookies are blocked by default you can exempt specific sites by using the CookiesAllowedForUrls policy. 

   

  • Restricting the use of --load-extension   back to top

    The --load-extension command-line switch provides a very low bar for cookie theft malware to load malicious extensions without an installation prompt. Chrome will gradually phase out this switch to reduce this attack vector for malware. Starting in Chrome 116, --load-extension will be ignored for users that have enabled Enhanced Safe Browsing. 

↑ back to top  

   

  • Service Worker static routing API   back to top

    Chrome 116 will release the Service Worker static routing API; it enables developers to optimize how Service Workers are loaded. Specifically, it allows developers to configure the routing, and allows them to offload simple things ServiceWorkers do. If the condition matches, the navigation happens without starting ServiceWorkers or executing JavaScript, which allows web pages to avoid performance penalties due to ServiceWorker interceptions. 

   

  • Enable access to WebUSB API from extension service workers   back to top

    As early as Chrome 117, we will enable access to WebUSB API from extension service workers as a migration path for Manifest V2 extensions that currently access the API from a background page.

    WebUSB policies can also be applied to extension origins to control this behavior. See DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls, and WebUsbAllowDevicesForUrls for more details. 

   

  • Simplified sign-in and sync experience  back to top

    Starting in Chrome 117, some users may experience a simplified and consolidated version of sign-in and sync in Chrome. Chrome Sync will no longer be shown as a separate feature in settings or elsewhere. Instead, users can sign in to Chrome to use and save information like passwords, bookmarks and more in their Google Account, subject to the relevant enterprise policies.

    As before, the functionality previously part of Chrome Sync that saves and accesses Chrome data in the Google Account can be turned off fully (via SyncDisabled) or partially (via SyncTypesListDisabled). Sign-in to Chrome can be required or disabled via BrowserSignin as before.

    Note that the changes do not affect users’ ability to sign in to Google services on the web (like Gmail) without signing in to Chrome, their ability to stay signed out of Chrome, or their ability to control what information is synced with their Google Account.


    Signin  

   

  • Web MIDI permission prompt   back to top
     

    Starting in Chrome 117, the Web MIDI API access will be gated behind a permissions prompt. Currently, the use of SysEx messages with the Web MIDI API requires explicit user permission. With the planned implementation, even access to the Web MIDI API without SysEx support will require user permission. Both permissions will be requested in a bundled permissions prompt.

    Three new policies DefaultMidiSetting, MidiAllowedForUrls and MidiBlockedForUrls will be available to allow administrators to pre-configure user access to the API.

   

  • Removal of the RendererCodeIntegrityEnabled policy   back to top

    As early as Chrome 117, the RendererCodeIntegrityEnabled policy will be removed. We recommend that you verify any potential incompatibilities with third party software by no longer applying the policy in advance of this release. You can report any issues you encounter by submitting a bug here.

   

  • Chrome 117 will no longer support macOS 10.13 and macOS 10.14   back to top

    Chrome 117 will no longer support macOS 10.13 and macOS 10.14, which are already outside of their support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security. If run on macOS 10.13 or 10.14, Chrome continues to show an infobar that reminds users that Chrome 117 will no longer support macOS 10.13 and macOS 10.14. 

   

  • New Chrome Desktop refresh and Chrome menu in Chrome 117   back to top

    With Google’s design platform moving to Google Material 3, we have an opportunity to modernize our desktop browser across OS’s, leveraging updated UI elements or styling, enhancing personalization through a new dynamic color system, and improving accessibility. The first wave of UI updates will roll out in Chrome 117. 

    New chrome desktop  

    The three dot Chrome menu will also be refreshed, providing a foundation to scale desktop Chrome UI, communications, and personalization. The menu will be updated in phases starting in Chrome 117 with the Desktop Refresh.

    New chrome desktop  

   

  • Update for lock icon   back to top

    We plan to replace the lock icon with a variant of the tune icon, which is commonly used to indicate controls and settings. Replacing the lock icon with a neutral indicator prevents the misunderstanding that the lock icon is associated with the trustworthiness of a page, and emphasizes that security should be the default state in Chrome. Our research has also shown that many users never understood that clicking the lock icon showed important information and controls. We think the new icon helps make permission controls and additional security information more accessible, while avoiding the misunderstandings that plague the lock icon.

    The new icon is scheduled to launch in Chrome 117 as part of a general design refresh for desktop platforms. Chrome will continue to alert users when their connection is not secure. You can see the new tune icon now in Chrome Canary if you enable Chrome Refresh 2023 at chrome://flags#chrome-refresh-2023, but keep in mind this flag enables work that is still actively in-progress and under development, and does not represent a final product.

    On iOS, the lock icon is not tappable, so we will be removing the icon.

    You can read more in this blog post.

    PDF sig tools  

   

  • Extensions must be updated to leverage Manifest V3   back to top

    Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. 

    As mentioned earlier in our blog post, More details on the transition to Manifest V3, the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed.

    During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3.

    Starting with Chrome 110, an Enterprise policy ExtensionManifestV2Availability has been available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions until at least January 2024. 

    You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management.

    For more details, refer to the Manifest V2 support timeline

↑ back to top  

   

  • Removal ForceMajorVersionToMinorPositionInUserAgent policy   back to top
     

    Chrome 118 plans to remove the ForceMajorVersionToMinorPositionInUserAgent policy. This policy was introduced in Chrome 99 to control whether the User-Agent string major version would be frozen at 99, in case of User-Agent string parsing bugs when the version changed to 100. Fortunately, we did not need to deploy this feature and only encountered a few minor 3-digit version parsing issues that have all since been fixed. Given that, we intend to remove this policy.


    If you have any feedback about this policy removal, or are aware of intranet breakage that depends on the policy, please comment on this bug.

   

  • Chrome 119 to phase out support for Web SQL   back to top
     

    Starting in Chrome 119, to improve user data security, Chrome will remove support for Web SQL. The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. As of today, Chrome is the only major browser with support for Web SQL. The W3C encouraged those needing web databases to adopt Indexed Database or SQLite WASM.

     

    The timeline for the deprecation will be:

    • Chrome 115 - Add deprecation message
    • Chrome 118 - 123 - Deprecation trial
    • Chrome 119 - Ship removal
     

    More details about the deprecation and removal can be found on the Chromestatus page.

    An enterprise policy WebSQLAccess is available until Chrome 123 to enable Web SQL to be available. 

   

   

  • Intent to deprecate: Mutation Events   back to top

    Synchronous Mutation Events, including `DOMSubtreeModified`, `DOMNodeInserted`, `DOMNodeRemoved`, `DOMNodeRemovedFromDocument`, `DOMNodeInsertedIntoDocument`, and `DOMCharacterDataModified`, negatively affect page performance, and also significantly increase the complexity of adding new features to the Web. These APIs were deprecated from the spec in 2011, and were replaced (in 2012) by the much better-behaved Mutation Observer API. Usage of the obsolete Mutation Events must be removed or migrated to Mutation Observer. Mutation Events will stop functioning in Chrome 127, around July 30, 2024.
     

Upcoming ChromeOS changes

   

  • Removal of permissive Chrome Apps webview behaviors  back to top

    As early as Chrome 116, Chrome Apps webview usage have the following restrictions:
    • SSL errors within webview show an error page that does not provide the user the option to unsafely proceed.
    • The use of the webview NewWindow event to attach to a webview element in another App window causes the window reference returned by the window.open call in the originating webview to be invalidated.

    A temporary enterprise policy ChromeAppsWebViewPermissiveBehaviorAllowed will be available to give enterprises time to address possible breakage related to these changes. To test whether this change is the cause of any breakage, without needing to set the enterprise policy, the previous behavior from Chrome 112 and earlier can also be restored by navigating to chrome://flags and disabling chrome://flags/#enable-webview-tag-mparch-behavior.

    This change was originally scheduled for Chrome 113, but was postponed.

   

  • ChromeOS battery state sounds   back to top
     

    As early as Chrome 117, we will add audible sounds to indicate battery status. Users will be able to turn on and off these sounds and Admins will be able to control them through policies.

    When the device is not plugged in, you will hear warning sounds if:

    • Battery level goes down to 15 minutes of charge time left, and another one when there is 5 minutes left.
     

    When the device is plugged in, you will hear an information beep when:

    • Battery level - 0-15% (low) 
    • Battery level - 16-79% (med) 
    • Battery level -80-100% (high)
     

    In the case where the device is connected to a low power charger, you’ll hear warnings when the battery goes down to 10%, then again at 5%.



      

↑ back to top  

Chrome 114

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Chrome Root Store updates    
Support for Private State Tokens    
Inactive Tabs in Chrome app on iPhone and iPad    
Lock profile cookie files on disk    
Rebranding and updates to Google Password Manager     
Improved Check passwords on iOS      
Saving and retrieving notes in Password Manager now easier    
Password manager policy disables password import    
Updates to Bookmarks on Desktop    
Unpacking nested archives for download protection    
Separate storage of settings synced to account    
Side Panel API    
Pick up where you left off on Android    
Chrome Enterprise profiles signout    
Update chip on desktop    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
Cursive pre-installed for Enterprise and Education accounts    
Passpoint: Seamless, secure connection to Wi-Fi networks   
Mandatory extensions for Incognito navigation    
Audio controls visibility    
ChromeVox earcons    
Admin console updates Security/ Privacy User productivity/ Apps Management
Chrome Browser Cloud Management (CBCM) subscription    
New policies in Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
HTTP requests upgraded to HTTPS in Chrome 115    
Chrome policy: disable extensions unpublished from Chrome Web Store (CWS)    
Skip unload events    
master_preferences->initial_preferences migration    
Release cycle changes    
Bookmarks and Reading List improvements on iOS    
Update for Secure DNS / Cox ISP users    
Reading mode    
Anti-phishing telemetry expansion    
Deprecating the use of SHA1 in server signatures in TLS    
Policy Sync dependency handling    
Web MIDI permission prompt    
X25519Kyber768 key encapsulation for TLS    
Network Service on Windows will be sandboxed     
Restricting the use of --load-extension    
Enable access to WebUSB API from extension service workers in Chrome 116    
Removal of the RendererCodeIntegrityEnabled policy    
Chrome 117 will no longer support macOS 10.13 and macOS 10.14  
New Chrome Desktop refresh and Chrome menu in Chrome 117    
Update for lock icon    
Extensions must be updated to leverage Manifest V3  
Chrome 119 to phase out support for Web SQL    
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
App Streaming on Chrome OS    
Google Photos Shared Albums    
Removal of permissive Chrome Apps webview behaviors    
Upcoming Admin console changes Security/ Privacy User productivity/ Apps Management
New Chrome Browser Cloud Management card    

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Please allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

   

  • Chrome Root Store updates   back to top 

    As early as Chrome 114, to improve user security and provide a consistent experience across different platforms, Chrome switches to its own default root store and built-in certificate verifier on: 
    • Android
    • Linux 
    • ChromeOS 

    The ChromeRootStoreEnabled policy allows selective disabling of the Chrome Root Store in favor of the platform root store. You can set this policy to Disabled to force the use of the platform root store, otherwise it is enabled by default. The policy will be made available on Android, Linux, and ChromeOS until Chrome 120. 

    The Chrome Root Store is already enabled by default on: 
    • Windows 
    • MacOS

    The ChromeRootStoreEnabled policy has been removed from Windows and Mac in Chrome 113. Support for trusted leaf certificates and the Windows Trusted People store was added for Chrome 111. Support for name constraints on local trust anchors was added back in Chrome 112. 

    Chrome continues to use custom local roots installed to the operating system’s trust store. See our article about the Chrome Root Program for more information. We do not anticipate any changes to how enterprises currently manage their fleet and trusted enterprise CAs, such as through group policy, macOS Keychain Access, or system management tools like Puppet.  

   

  • Support for Private State Tokens   back to top

    Chrome 114 makes the Private State Tokens API available for use by websites. Private State Tokens enable trust in a user's authenticity to be conveyed from one context to another, to help sites combat fraud and distinguish bots from real humans—without the exchange of user identifying information. Availability of Private State Tokens is controlled using a new setting in Chrome settings called Auto-verify. Read more in this developer blog post.

   

  • Inactive Tabs in Chrome app on iPhone and iPad   back to top

    In Chrome 114, old tabs are now grouped under a new Inactive Tabs section in the Tab grid view. Chrome users can access the inactive tabs section to view all old tabs or close them using the new bulk tab functionality. Alternatively, users can simply click to bring back an inactive tab.

    inactive tabs  

   

  • Lock profile cookie files on disk   back to top


    To help protect Chrome users against malware attempting to steal cookie information, Chrome 114 on Windows holds an exclusive lock on the profile cookie files on disk. To ensure this behavior does not interfere with any sanctioned software on your system, you can run Chrome with the -enable-features=LockProfileCookieDatabase command-line flag on the Dev or Beta channel of Chrome 114.

     

↑ back to top  

   

  • Rebranding and updates in Google Password Manager   back to top

    In Chrome 114, the password manager is rebranded as Google Password Manager.

    Google Password Manager offers more functionality and is easier to access using the three dot menu. The upgraded Google Password Manager:
    • groups similar passwords together
    • has an improved checkup flow 
    • and you can add the password manager shortcut to your desktop.


    rebrand password manager  

    rebrand password manager  

   

  • Improved Check passwords on iOS   back to top

    The Check passwords feature of Password Manager on iOS includes a list of passwords flagged by Google as unsafe. On other platforms, these are further categorized as: compromised, weak, or reused. Chrome 114 now introduces these granular categories on iOS.  

   

  • Saving and retrieving notes in Password Manager now easier   back to top

    Chrome 114 revamps the password management user journey, triggered from the key icon in the omnibox. It replaces the current list of passwords with a new list that allows navigating to the password details view. In the password details view, users can copy the username or password, unmask the password and edit the stored note.

    password notes  

   

  • Password manager policy disables password import   back to top

    We recently fixed an issue that previously allowed users to import passwords even though the Password Manager was disabled by Enterprise policy. Users can no longer import passwords when the PasswordManagerEnabled policy is set to false.
      

   

  • Updates to Bookmarks on Desktop   back to top

    Starting in Chrome 114, some users see an updated experience of the Bookmarks side panel, including features such as filtering, sorting, and editing.

     bookmarks  

     bookmarks  

↑ back to top  

   

  • Unpacking nested archives for download protection   back to top

    Starting in Chrome 114, users with Safe Browsing set to Standard or Enhanced protection now begin recursively unpacking downloads of nested archives. This extends the long-standing protections Chrome offers against malware and unwanted software, and specifically combats techniques abused by distributors of cookie theft malware. The SafeBrowsingProtectionLevel policy allows you to enable or disable Safe Browsing, including this feature.
     

   

  • Separate storage of settings synced to account   back to top

    For Chrome users on iOS and Android who have Sync enabled, settings synced to their Google account are now kept separate from the local Chrome settings, which were set when Sync was off. This allows for strictly less data sharing than previously: local settings don’t get automatically uploaded when turning on Sync, and no settings from the account are left behind on the device when Sync is turned off. This feature is still disabled by default and you can enable it using the flag chrome://flags#enable-preferences-account-storage.

    As an admin, you can control who can save and sync data related to managed Google accounts.There are two existing policies to disable Sync functionality, which continue to apply:
     
    • SyncDisabled: Disables the entire Chrome Sync infrastructure, including settings.
    • SyncTypesListDisabled: Disables specified individual Sync data types. The existing value preferences covers settings.

   

  • Side Panel API   back to top

    Manifest V3 extensions can now add their own side panel to Chrome’s built-in side panel UI. See the SidePanel API Chrome developers article for usage and examples.

   

  • Pick up where you left off on Android   back to top

    Chrome on iOS now lets new users re-open multiple tabs that were recently active and open on their Android device. This means that they can easily resume journeys on their new iOS instance of Chrome.

     Pick up  

   

  • Chrome Enterprise profiles signout   back to top

    A bug has been fixed where managed profiles became unmanaged and triggered the profile separation dialog all over again for a previously managed profile. This fix ensures that managed profiles do not inadvertently get signed out from Chrome.
     

   

  • Update chip on desktop   back to top

    In Chrome 114, we are experimenting with new strings in the Update chip on desktop. We have refreshed the update strings in the three-dots menu to encourage users to apply updates (and restart) quicker.

     update chip text  

↑ back to top  

   

  • New and updated policies in Chrome browser   back to top
     
    Policy Description
    ChromeRootStoreEnabled

    Determines whether the Chrome Root Store and built-in certificate verifier will be used to verify server certificates.

    Now available on Mac, Linux and ChromeOS.

    InsecureHashesInTLSHandshakesEnabled Insecure Hashes in TLS Handshakes Enabled
      

   

  • Removed policies in Chrome browser   back to top
     
    Policy Description
    CECPQ2Enabled CECPQ2 post-quantum key-agreement enabled for TLS
    ChromeAppsEnabled Extend support for Chrome Apps on Microsoft Windows, macOS, and Linux
      

ChromeOS updates

   

  • Cursive pre-installed for Enterprise and Education accounts   back to top

    Cursive, a stylus-first notes app, is now available for Chromebook. It will be pre-installed for all Enterprise and Education accounts on stylus-enabled Chromebooks. If you want to block access to the app, you can prevent Chromebooks in your enterprise from accessing cursive.apps.chrome.
      

   

  • Passpoint: Seamless, secure connection to Wi-Fi networks  back to top

    Starting as early as ChromeOS 114, Passpoint will streamline Wi-Fi access and eliminate the need for users to find and authenticate a network each time they visit. Once a user accesses the Wi-Fi network offered at a location, the Passpoint-enabled client device will automatically connect upon subsequent visits.

   

  • Mandatory extensions for Incognito navigation  back to top

    In Chrome OS 114, Extensions allow admins to enforce security features and customizations in their OU but they cannot be enforced in Incognito mode without user consent. This can be a problem as users can bypass extension-set features, for example, proxies by using Incognito mode for navigation.

    The MandatoryExtensionsForIncognitoNavigation policy allows you to configure a list of extensions that users need to explicitly allow to run in Incognito, to use Incognito mode for navigation.

↑ back to top  

 

   

  • Audio controls visibility   back to top

    Settings on ChromeOS now have a more native OS settings experience housed in the Settings app, available through App Launcher or the cog icon in the Quick Settings menu. In ChromeOS 114, users can now find all sound controls in the ChromeOS Settings app.
     audio controls  

   

  • ChromeVox earcons   back to top

    ChromeVox is the built-in screen reader on Chromebooks. In ChromeOS 114, an audio indicator (an earcon) now plays when a user with ChromeVox enabled uses the ChromeVox keyboard shortcut to toggle selection on or off.

Admin console updates

   

  • Chrome Browser Cloud Management (CBCM) subscription   back to top

    In Chrome 114, the Chrome Browser Cloud Management subscription is automatically added to all organizations previously using CBCM without the subscription. This change does not add any new cost to your existing account and you don’t need to do anything. There is no action required on your end (learn more).

↑ back to top  

   

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

  • HTTP requests upgraded to HTTPS in Chrome 115  back to top

    As early as Chrome 115, some users may see HTTP requests automatically upgraded to HTTPs. Any page that can't load via HTTPS is automatically reverted back to HTTP. For standard server configurations, this shouldn't have any visible effect, but improves your users' security.

    Some server configurations may cause issues, for example if different content is served via HTTP and HTTPS. Users can disable automatic upgrading for a specific site by changing the Insecure Content site setting to enabled, accessible via Page Info or chrome://settings/content. You can control this behavior with the HttpsUpgradesEnabled policy, and allowlist specific sites with the HttpAllowlist policy.

    In the long term, you should ensure that your organization's servers support HTTPS and serve the same content on both HTTP and HTTPS. If you don't intend to support HTTPS (e.g. on an internal intranet behind a firewall), servers shouldn't respond to port 443, and firewalls should close the connection rather than leave it hanging. You can test HTTPS upgrading in your environment by enabling chrome://flags#https-upgrades. Please report any issues you encounter.

   

  • Chrome policy: disable extensions unpublished from Chrome Web Store (CWS)   back to top

    As early as Chrome 115, we will release the Enterprise policy ExtensionUnpublishedAvailability to disable extensions that have been unpublished from the Chrome Web Store.

   

  • Skip unload events   back to top

    The presence of unload event listeners is a primary blocker for back/forward cache on Chromium based browsers and for Firefox on desktop platforms. On the other hand, for mobile platforms, almost all browsers prioritize the bfcache by not firing unload events in most cases. To improve the situation, we’ve been working with lots of partners and successfully reduced the use of unload event listeners over the last few years. To further accelerate this migration, we propose to have Chrome for desktop gradually skip unload events, as early as Chrome 115. In case you need more time to migrate away from unload events, we’ll offer temporary opt-outs in the form of an API and a group policy which will allow you to selectively keep the behavior unchanged.

   

  • master_preferences to initial_preferences migration   back to top

    As part of Chrome's ongoing transition to use more inclusive naming, the example in the Enterprise bundle has been renamed from master_preferences to initial_prefereces. While there are no changes in Chrome's interpretation of the file, the following fields are no longer present in the initial_preferences example file:
     
    • Removed from example because they're no longer valid:
      • sync_promo.show_on_first_run_allowed
      • suppress_first_run_bubble
      • suppress_first_run_Default_browser_prompt
    • Removed from example because they can be controlled by a recommended policy:
      • homepage
      • homepage_is_newtabpage
      • show_home_button
      • session
      • bookmark_bar
      • import_* except for import_bookmarks_from_file
      • make_chrome_default_*
    • Removed from example because they're not applicable to enterprise usage, or only applicable to for user-level install:
      • ping_delay
      • do_not_launch_chrome
      • do_no_register_for_update_launch

↑ back to top  

   

  • Release cycle changes   back to top

    Chrome 115 stable release will be moved from June 27 to July 18. All dates after this have been adjusted to account for this delay. Please see the Chromium Dash Schedule for updated dates.  

   

  • Bookmarks and Reading List improvements on iOS   back to top

    On Chrome 115 on iOS, some users who sign in to Chrome from bookmark manager or reading list surfaces will be able to use and save bookmarks and reading list items in their Google Account. Relevant enterprise policies such as BrowserSignin, SyncDisabled, SyncTypesListDisabled, EditBookmarksEnabled and ManagedBookmarks will continue to work as before and can be used to configure whether users use and save items in their Google Account.

   

  • Update for Secure DNS / Cox ISP users   back to top

    For clients running on systems that use the Cox ISP DNS servers, if the DnsOverHttpsMode policy is set to Automatic, then secure DNS queries will be used by Chrome instead of insecure DNS queries starting in Chrome 115 (and in earlier versions, starting on May 16, 2023, if the ChromeVariations policy is set to enable all variations).

   

  • Reading mode   back to top

    As more content is read online, we’re adding a new feature to help improve the online reading experience. Introducing reading mode, a new feature on Chrome browser, enhances the reading experience on the web for everyone. Reading mode reduces distracting elements through a resizable and customizable reader view in the Chrome browser side panel, enabling readers to focus on the primary content. Users can also customize the font, text size, spacing, theme/background color, and more, making for a more cohesive, intuitive, and comfortable reading experience.
     reading mode  

   

  • Anti-phishing telemetry expansion   back to top

    In this feature, we log user-interaction data to Chrome servers and to Safe Browsing servers that will fill knowledge gaps about how users interact with Safe Browsing phishing warnings and phishy pages. This additional telemetry will help inform where we should concentrate our efforts to improve phishing protection because it will allow us to understand the user better. Admins can opt out by using the Enterprise policies MetricsReportingEnabled and SafeBrowsingProtectionLevel.

   

  • Deprecating the use of SHA1 in server signatures in TLS   back to top

    Chrome 115 is removing support for signature algorithms using SHA-1 for server signatures during the TLS handshake. This does not affect SHA-1 support in server certificates, which was already removed, or in client certificates, which continues to be supported. SHA1 has known collisions, has been deprecated by the IETF, and should be avoided.

    Enterprises that rely on SHA1 signature schemes in TLS can use the InsecureHashesInTLSHandshakesEnabled policy to continue to accept SHA1 in server signatures.

   

  • Policy Sync dependency handling   back to top

    Currently, we require admins to set SyncDisabled for any data-deletion policy (BrowsingDataLifetime, ClearBrowsingDataOnExitList). Starting in Chrome 115, we will automatically disable sync for the respective data types and will no longer require admins to set the dependent policy.

↑ back to top  

   

  • Web MIDI permission prompt   back to top

    Starting in Chrome 116, the Web MIDI API access will be gated behind a permissions prompt. Currently, the use of SysEx messages with the Web MIDI API requires an explicit user permission. With the planned implementation, even access to the Web MIDI API without SysEx support will require user permission. Both permissions will be requested in a bundled permissions prompt.

    Three new policies DefaultMidiSetting, MidiAllowedForUrls and MidiBlockedForUrls will be available to allow administrators to pre-configure users’ access to the API.

   

  • X25519Kyber768 key encapsulation for TLS   back to top

    As early as Chrome 116, Chrome is introducing a post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard. This is exposed as a new TLS cipher suite. TLS automatically negotiates supported ciphers, so this change should be transparent to server operators. However, some TLS middleboxes may be unprepared for the size of a Kyber key encapsulation, or a new TLS ClientHello cipher code point, leading to dropped or hanging connections. This can be resolved by updating your middlebox, or disabling the key encapsulation mechanism via enterprise policy. However, long term, post-quantum secure ciphers will be required in TLS. 

   

  • Network Service on Windows will be sandboxed   back to top

    As early as Chrome 116, to improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.

   

  • Restricting the use of --load-extension   back to top

    The --load-extension command-line switch provides a very low bar for cookie theft malware to load malicious extensions without an installation prompt. Chrome will gradually phase out this switch to reduce this attack vector for malware. Starting in Chrome 116, --load-extension will be ignored for users that have enabled Enhanced Safe Browsing. 

   

  • Enable access to WebUSB API from extension service workers in Chrome 116   back to top
     

    As early as Chrome 116, we will enable access to WebUSB API from extension service workers as a migration path for Manifest V2 extensions that currently access the API from a background page.

    WebUSB policies can also be applied to extension origins to control this behavior. See DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls, and WebUsbAllowDevicesForUrls for more details.

   

  • Removal of the RendererCodeIntegrityEnabled policy   back to top

    As early as Chrome 117, the RendererCodeIntegrityEnabled policy will be removed. You can verify whether your third party software works by no longer applying the policy. You can report any issues you encounter by submitting a bug here.

↑ back to top  

   

  • Chrome 117 will no longer support macOS 10.13 and macOS 10.14   back to top

    Chrome 117 will no longer support macOS 10.13 and macOS 10.14, which are already outside of their support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security. Starting in Chrome 114, you'll see an infobar that reminds users that Chrome 117 will no longer support macOS 10.13 and macOS 10.14.  

   

  • New Chrome Desktop refresh and Chrome menu in Chrome 117   back to top

    With Google’s design platform moving to Google Material 3, we have an opportunity to modernize our desktop browser across OS’s, leveraging updated UI elements or styling, enhancing personalization through a new dynamic color system, and improving accessibility. The first wave of UI updates will roll out in Chrome 117.

     bookmarks  

    The three dot Chrome menu will also be refreshed, providing a foundation to scale desktop Chrome UI, communications, and personalization. The menu will be updated in phases starting in Chrome 117 with the Desktop Refresh.

     three dot menu  

   

  • Update for lock icon   back to top
     
    We plan to replace the lock icon with a variant of the tune icon, which is commonly used to indicate controls and settings. Replacing the lock icon with a neutral indicator prevents the misunderstanding that the lock icon is associated with the trustworthiness of a page, and emphasizes that security should be the default state in Chrome. Our research has also shown that many users never understood that clicking the lock icon showed important information and controls. We think the new icon helps make permission controls and additional security information more accessible, while avoiding the misunderstandings that plague the lock icon.

    The new icon is scheduled to launch in Chrome 117, which releases in early September 2023, as part of a general design refresh for desktop platforms. Chrome will continue to alert users when their connection is not secure. You can see the new tune icon now in Chrome Canary if you enable Chrome Refresh 2023 at chrome://flags#chrome-refresh-2023, but keep in mind this flag enables work that is still actively in-progress and under development, and does not represent a final product.

    You can read more in this blog post.
     

    lock icon  

   

  • Extensions must be updated to leverage Manifest V3   back to top
     
    Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. 

    As mentioned earlier in our blog post, More details on the transition to Manifest V3, the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed.

    During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3.

    Starting with Chrome 110, an Enterprise policy ExtensionManifestV2Availability has been available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions until at least January 2024. 

    You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management.

    For more details, refer to the Manifest V2 support timeline.

   

  • Chrome 119 to phase out support for Web SQL   back to top

    Starting in Chrome 119, to improve user data security, Chrome will remove support for Web SQL. The Web SQL Database standard was first proposed in April 2009 and abandoned in November 2010. As of today, Chrome is the only major browser with support for Web SQL. The W3C encouraged those needing web databases to adopt Indexed Database or SQLite WASM.

    The timeline for the deprecation will be:
    • Chrome 115 - Add deprecation message
    • Chrome 118 - 123  - Deprecation trial
    • Chrome 119 - Ship removal

    More details about the deprecation and removal can be found on the Chromestatus page.

    An enterprise policy WebSQLAccess is available until Chrome 123 to enable Web SQL to be available.

     

Upcoming ChromeOS changes

   

  • App Streaming on ChromeOS   back to top

    As early as ChromeOS 115, App Streaming will enhance the Phone Hub experience, by allowing users to see and interact with streamed apps running on their Pixel phone. When a user receives a mirrored conversation notification from their Pixel phone, a simple tap on that notification will kick off an app stream directly to the user's ChromeOS desktop. This is part of a Google-wide ambient computing effort.

   

  • Google Photos Shared Albums   back to top

    In ChromeOS 104, we let users use Google Photos for Wallpapers and Screensavers, but we restricted access to Shared Albums due to privacy concerns. In Chrome 115, we will address these privacy concerns to allow users to select photos from Shared Albums.

   

  • Removal of permissive Chrome Apps webview behaviors   back to top

    As early as Chrome 116, Chrome Apps webview usage have the following restrictions:
    • SSL errors within webview show an error page that does not provide the user the option to unsafely proceed.
    • The use of the webview NewWindow event to attach to a webview element in another App window causes the window reference returned by the window.open call in the originating webview to be invalidated.

    A temporary enterprise policy ChromeAppsWebViewPermissiveBehaviorAllowed will be available to give enterprises time to address possible breakage related to these changes. To test whether this change is the cause of any breakage, without needing to set the enterprise policy, the previous behavior from Chrome 112 and earlier can also be restored by navigating to chrome://flags and disabling chrome://flags/#enable-webview-tag-mparch-behavior.

    This change was originally scheduled for Chrome 113, but was postponed.
      

Upcoming Admin console changes

   

  • New Chrome Browser Cloud Management card   back to top

    Chrome is launching a new Chrome Browser Cloud Management card on the homepage of the Google Admin console. You will be able to easily access and find popular Chrome browser management tasks, directly on the homepage.

    admin console card

↑ back to top  

Chrome 113

Chrome browser updates Security/ Privacy User productivity/ Apps Management
First-Party Sets user controls    
Collect additional data for off-store extensions in telemetry reports    
Launching FastCheckout for Checkout experiences    
Updated Password Management Experience on iOS in Chrome 113     
Image-set css changes    
Restructure of the three-dot menu in Desktop     
Policy troubleshooting page available on Android      
Chrome Desktop New tab page: Journeys card    
Discover Feed on iOS and Android    
Adopt Android media picker    
Partial translate    
Android traces on the beta channel    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
Screensaver preview    
Report USB firmware version    
Allow policy-provided custom trust anchors at the lock screen    
Files app inline sync status    
ChromeOS administrator instant reboot  
Removal of permissive Chrome Apps webview behaviors    
Admin console updates Security/ Privacy User productivity/ Apps Management
Risk Assessment card  
New policies in Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
Chrome Root Store updates and removal of the ChromeRootStoreEnabled policy    
Support for Private State Tokens    
New inactive tabs section in the Chrome app on iPhone and iPad    
Lock profile cookie files on disk    
Changes to Google Password Manager in Chrome 114    
Updates to Bookmarks on Desktop    
Password management: save and retrieve notes    
Unpacking Nested Archives in Download Protection    
Separate storage of settings synced to account in Chrome 114    
Chrome policy: disable extensions unpublished from Chrome Web Store (CWS)    
Network Service on Windows will be sandboxed     
Enable access to WebUSB API from extension service workers in Chrome 115    
Skip unload events    
Release cycle changes    
Read mode    
HTTP requests upgraded to HTTPS in Chrome 115    
Deprecation Trial for unpartitioned third-party Storage, Service Workers, and Communication APIs    
Changes to phishing protection on Android as early as Chrome 115  
Chrome 117 will no longer support macOS 10.13 and macOS 10.14  
Extensions must be updated to leverage Manifest V3  
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
Cursive pre-installed for Enterprise and Education accounts    
Passpoint: Seamless, secure connection to Wi-Fi networks   
Mandatory extensions for Incognito navigation    
App Streaming on Chrome OS    

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Please allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

 

   

  • First-Party Sets user controls   back to top

    First-Party Sets is an upcoming framework for developers to declare relationships between domains, such that the browser can make decisions regarding access based on the third party’s relationship to the first party. A set may enjoy first party benefits, including continued access to their cookies when the top-level domain is in the same set.

    First-Party Sets are part of Chrome's roadmap for a more privacy-focused web.

    Chrome 113 introduces user controls for these First-Party Sets. Two enterprise policies are available to manage First-Party Sets: FirstPartySetsEnabled to enable or disable First-Party Sets, and FirstPartySetsOverrides to apply your own sets. First Party Sets  

   

  • Collect additional data for off-store extensions in telemetry reports   back to top

    When Enhanced Safe Browsing is enabled, Chrome 113 starts collecting additional telemetry on off-store extensions, such as file hashes and the manifest.json file. Google servers analyze the data collected to detect malicious off-store extensions (including self-hosted extensions) and improve protection for all Chrome extension users. This functionality along with the entire extension telemetry feature can be turned off by setting SafeBrowsingProtectionLevel to any value other than 2; this disables Enhanced Safe Browsing. Enterprise admins can use the SafeBrowsingProtectionLevel policy if they have any concerns about exposing this data.

   

  • Launching FastCheckout for Checkout experiences   back to top

    In Chrome 113, some users see updated Autofill options targeting checkout pages on some shopping websites. It can be disabled by either disabling policy AutofillAddressEnabled or AutofillCreditCardEnabled.Fast checkout  

↑ back to top  

   

  • Updated Password Management Experience on iOS in Chrome 113   back to top

    On Chrome on iOS, some users who are signed-in to Chrome but don't have Chrome sync enabled can now use and save passwords in their Google Account. Relevant enterprise policies such as BrowserSignin, SyncDisabled, SyncTypesListDisabled and PasswordManagerEnabled continue to work as before and can be used to configure whether users can use and save passwords in their Google Account.

   

  • Image-set css changes  back to top

    Chrome 113 implements standard syntax support for image-set and now treats the previously supported -webkit- vendor prefix syntax as a parse time alias for the standard. This means that values set with the vendor prefix serialize as standard.

    Example:
       -webkit-image-set(url(example.png) 1x)

    Serializes to:

       image-set(url(""example.png"") 1x) for specified value (as returned via getPropertyValue() like: testDiv.style.getPropertyValue(""background-image"");)

    and to

       image-set(url(""example.png"") 1dppx) for computed value (as returned via getComputedStyle() like window.getComputedStyle(testDiv)[""background-image""]).

    If needed, the new behavior can be turned off via the CSSImageSet runtime flag. The rendering and image-selection behavior is the same for both the prefixed and standard syntax (Chrome Status).

   

  • Restructure of the three-dot menu in Desktop  back to top

    We want to help our users to discover how to customize Chrome to perfectly fit their needs by moving Extensions and the Chrome Web Store to the first level of the three-dot menu.

   

  • Policy troubleshooting page available on Android   back to top

    chrome://policy/logs is a new page that admins can use to help troubleshoot enterprise policies on Android. On iOS, this becomes available in Chrome 113.

   

  • Chrome Desktop New tab page: Journeys card   back to top

    Chrome assists with complex, multi-session task completion through Journeys resumption and next step suggestions on the New tab page. You can control the visibility of cards on the New tab page using the NTPCardsVisible policy.
    Journeys

↑ back to top  

   

  • Discover Feed on iOS and Android   back to top


    In Chrome 113, Chrome might prompt some users to see more personalized content in their Discover Feed.

    Discover feed
    The Discover Feed also allows non-signed-in users to control the types of content they see, using updated personalization options. For example, they may choose to hide content from a certain source.

    Discover feed 2
    When users who are not signed in want to make a change to their feed content, Chrome prompts them to sign in or sync. As an admin, you still control user sign-in and sync with the BrowserSignin, SyncDisabled, and SyncTypesListDisabled policies. So, if an enterprise policy prevents sign-in or sync, users see Not available on your device.

   

  • Adopt Android media picker  back to top

    Chrome browser replaces its custom media picker for the new unified Android media picker, when uploading photos and videos to the web. The two are functionally equivalent, but there are slight differences in how they look.
    Discover feed 2

   

  • Adopt Android media picker  back to top

    Chrome browser replaces its custom media picker for the new unified Android media picker, when uploading photos and videos to the web. The two are functionally equivalent, but there are slight differences in how they look.
    Discover feed 2

   

  • Android traces on the beta channel  back to top

    Android users on the beta channel who have agreed to sending metrics now upload anonymized traces. Traces do not include user-identifying IDs, and are used to improve Chrome's performance.

   

↑ back to top  

   

  • Removed policies in Chrome browser   back to top
     

    Policy

    Description

    ChromeRootStoreEnabled

    Determines whether the Chrome Root Store and built-in certificate verifier will be used to verify server certificates (removed on Windows and Mac)

    WebSQLNonSecureContextEnabled

    Force WebSQL in non-secure contexts to be enabled

    PrefixedStorageInfoEnabled

    Re-enable the deprecated window.webkitStorageInfo API

ChromeOS updates

   

  • Screensaver preview   back to top

    In ChromeOS 113, a new option allows users to preview screensaver settings before applying. A preview is useful especially when using Google Photos with animations.

    screen saver preview

   

  • Report USB firmware version   back to top

    Whenever a USB device is plugged or unplugged from a managed ChromeOS device, the USB firmware version is reported alongside existing USB events and telemetry. You can control this using the ReportDevicePeripherals policy, which controls reporting of existing USB events and telemetry.
     

   

  • Allow policy-provided custom trust anchors at the lock screen  back to top

    Enterprise and EDU deployments might have proxies that intercept, decrypt and inspect user traffic. This requires the client device to have a CA certificate configured to allow it to trust the proxy server certificate for all web hosts, which is usually issued on the fly. For ChromeOS, enterprise deployments configure such trusted CA certificates through enterprise policy.

    These custom policy-provided CA certificates are currently only honored for user traffic and inside the user session, but not at the lock screen. This is an issue for customers who have to do re-authentication at the lock screen, which is enforced by policy,  since the proxy set in the user session is enforced at the lock screen but the CA certificate is not accessible.

   

  • Files app inline sync status   back to top

    This feature moves the existing syncing notification and visual signal to a more granular inline sync status. The status appears adjacent to files in Google Drive that are actively syncing. The status also displays for folders within a hierarchy that have syncing descendants.

    file status

   

  • ChromeOS administrator instant reboot   back to top

    With ChromeOS 113, we give admins the option to trigger ChromeOS reboots via the Admin console to facilitate support flows and apply policies instantly when required. With this option, admins can now instantly apply settings across their fleet, or on a subset of devices. For example, in a cyber attack scenario, admins can now mitigate a current attack by limiting extension permissions and forcing an instant reboot to all affected devices.

    admin reboot

    A message displays to notify users of the reboot, so they can save any work or manage their time before the reboot occurs. admin reboot

↑ back to top  

   

  • Removal of permissive Chrome Apps webview behaviors   back to top

    In Chrome 113, Chrome Apps webview usage have the following restrictions:
     
    • SSL errors within webview show an error page that does not provide the user the option to unsafely proceed.
    • The use of the webview NewWindow event to attach to a webview element in another App window causes the window reference returned by the window.open call in the originating webview to be invalidated.


    A temporary enterprise policy ChromeAppsWebViewPermissiveBehaviorAllowed is available to give enterprises time to address possible breakage related to these changes. To test whether this change is the cause of any breakage, without needing to set the enterprise policy, the previous behavior from Chrome 112 and earlier can also be restored by navigating to chrome://flags and disabling chrome://flags/#enable-webview-tag-mparch-behavior.

Admin console updates

   

  • Risk Assessment card  back to top

    In the Extension details page, we have created a new Risk assessment card to show third-party risk scores for public extensions.  Learn more.

    risk assessment

   

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

  • Chrome Root Store updates and removal of the ChromeRootStoreEnabled policy  back to top

    As early as Chrome 114, to improve user security and provide a consistent experience across different platforms, Chrome will switch to its own default root store and built-in certificate verifier on Android, Linux, and ChromeOS. Chrome continues to use custom local roots installed to the operating system’s trust store. See our article about the Chrome Root Program for more information. The Chrome Root Store is already default enabled on Windows and Mac.

    We do not anticipate any changes to how enterprises currently manage their fleet and trusted enterprise CAs, such as through group policy, macOS Keychain Access, or system management tools like Puppet.

    The ChromeRootStoreEnabled policy allows selective disabling of the Chrome Root Store in favor of the platform root store. You can set this policy to Disabled to force the use of the platform root store, otherwise it is enabled by default. The policy will be made available on Android, Linux, and ChromeOS until Chrome 120. 

    The ChromeRootStoreEnabled policy has been removed from Windows and Mac in Chrome 113. Support for trusted leaf certificates and the Windows Trusted People store was added for Chrome 111. Support for name constraints on local trust anchors was added back in Chrome 112.

   

  • Support for Private State Tokens   back to top

    Starting in Chrome 113, the Private State Tokens API will be available for use by websites. Private State Tokens enable trust in a user's authenticity to be conveyed from one context to another, to help sites combat fraud and distinguish bots from real humans—without the exchange of user identifying information. Availability of Private State Tokens will be controlled using a new setting in Chrome settings called Auto-verify. For more information, see this developer blog post.

↑ back to top  

   

  • New inactive tabs section in the Chrome app on iPhone and iPad   back to top

    In Chrome 114, old tabs will be hidden under a new Inactive Tabs section in the Tab grid view. Chrome users will be able to access the inactive tabs section to view all old tabs or close them using the new bulk tab functionality. Alternatively, users can bring back an inactive tab by clicking on it.

    Inactive tabs

   

  • Lock profile cookie files on disk   back to top

    To help protect Chrome users against malware attempting to steal cookie information, Chrome 114 on Windows holds an exclusive lock on the profile cookie files on disk. You can test this behavior to ensure this doesn't interfere with any sanctioned software on your systems by running Chrome with the -enable-features=LockProfileCookieDatabase command line flag on Dev and Beta channel of Chrome 114.

   

  • Changes to Google Password Manager in Chrome 114   back to top

    In Chrome 114, the password manager will be rebranded as Google Password Manager

    Google Password Manager will offer more functionality and be easier to access. You will be able to access the new look password manager via the three dot menu (previously located in Settings>Autofill). The upgraded Google Password Manager groups similar passwords together, has an improved checkup flow and users will be able to add the password manager to their desktop, for easy access.

    Password Manager new menu location

   

  • Updates to Bookmarks on Desktop   back to top

    In Chrome 114, some users will see an updated experience of the Bookmarks side panel content and entry point to be inclusive of bookmark powers, as well as other features such as filtering, sorting, and editing.

    bookmarks

    bookmarks

↑ back to top  

   

  • Password management: save and retrieve notes   back to top

    Chrome 114 will revamp the password management native bubble triggered from the key icon in the omnibox. It will replace the current list of passwords with a new list that allows navigating to the password details view. In the password details view, shown on the right below, users can copy the username or password, unmask the password, and edit the stored note.

    Password notes

   

  • Unpacking Nested Archives in Download Protection   back to top

    Starting in Chrome 114, users with Safe Browsing enabled will begin recursively unpacking downloads of archives. This extends the long-standing protections Chrome offers against malware and unwanted software to combat techniques being abused by distributors of cookie theft malware. The SafeBrowsingProtectionLevel policy can be used to enable or disable Safe Browsing, including this feature.

   

  • Separate storage of settings synced to account in Chrome 114   back to top

    For Chrome users on iOS and Android who have Sync enabled, settings synced to their Google account will be be kept separate from the local Chrome settings, which were set when Sync was turned-off. This will allow for strictly less data sharing than previously: local settings don’t get automatically uploaded when turning on Sync, and no settings from the account are left behind on the device when Sync is turned off. This feature is still disabled by default and can be enabled via chrome://flags#enable-preferences-account-storage.

    There are two existing policies to disable Sync functionality, which will continue to apply:
    1. SyncDisabled: Disables the entire Chrome Sync infrastructure, including settings.
    2. SyncTypesListDisabled: Disables specified individual Sync data types. The existing value preferences covers settings.

   

  • Chrome policy: disable extensions unpublished from Chrome Web Store (CWS)   back to top

    As early as Chrome 115, we will release an Enterprise policy to disable extensions that have been unpublished from the Chrome Web Store.

   

  • Network Service on Windows will be sandboxed   back to top

    As early as Chrome 115, to improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.

↑ back to top  

   

  • Enable access to WebUSB API from extension service workers in Chrome 115    back to top

    As early as Chrome 115, we will enable access to WebUSB API from extension service workers as a migration path for Manifest V2 extensions that currently access the API from a background page.

    WebUSB policies can also be applied to extension origins to control this behavior. See DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls, and WebUsbAllowDevicesForUrls for more details.

   

  • Skip unload events   back to top

    The presence of unload event listeners is a primary blocker for back/forward cache on Chromium based browsers and for Firefox on desktop platforms. On the other hand, for mobile platforms, almost all browsers prioritize the bfcache by not firing unload events in most cases. To improve the situation, we’ve been working with lots of partners and successfully reduced the use of unload event listeners over the last few years. To further accelerate this migration, we propose to have Chrome for desktop gradually skip unload events, as early as Chrome 115. In case you need more time to migrate away from unload events, we’ll offer temporary opt-outs in the form of an API and a group policy which will allow you to selectively keep the behavior unchanged.

   

  • Release cycle changes   back to top

    Chrome 115 stable release will be moved from June 27 to July 18. All dates after this have been adjusted to account for this delay. Please see the Chromium Dash Schedule for updated dates.

   

  • Read mode   back to top

    As more content is read online, we’re adding a new feature to help boost the reading experience. Introducing reading mode, a new feature on Chrome browser, enhances the reading experience on the web for everyone. Reading mode reduces distracting elements through a resizable and customizable reader view in the Chrome browser side panel, enabling readers to focus on the primary content. Users can also customize the font, text size, spacing, theme/background color, and more, making for a more cohesive, intuitive, and comfortable reading experience.

    Read mode

   

  • HTTP requests upgraded to HTTPS in Chrome 115  back to top

    As early as Chrome 115, some users may see HTTP requests automatically upgraded to HTTPs. Any page that can't load via HTTPS is automatically reverted back to HTTP. For standard server configurations, this shouldn't have any visible effect, but improves your users' security.

    Some server configurations may cause issues, for example if different content is served via HTTP and HTTPS. Users can disable automatic upgrading for a specific site by changing "Insecure Content" site setting to enabled, accessible via Page Info or chrome://settings/content. You can control this behavior with the HttpsUpgradesEnabled policy, and allowlist specific sites with the HttpAllowlist policy.

    In the long term, you should ensure that your organization's servers support HTTPS and serve the same content on both HTTP and HTTPS. If you don't intend to support HTTPS (e.g. on an internal intranet behind a firewall), servers shouldn't respond to port 443, and firewalls should close the connection rather than leave it hanging.

   

  • Deprecation Trial for unpartitioned third-party Storage, Service Workers, and Communication APIs  back to top

    Beginning gradually in Chrome 115, storage, service workers, and communication APIs will be partitioned in third-party contexts. In addition to being isolated by the same-origin policy, the affected APIs used in third-party contexts will also be separated by the site of the top-level context. Sites that haven’t had time to implement support for third-party storage partitioning can take part in a deprecation trial. During the trial, sites can temporarily unpartition (continue isolation by same-origin policy but remove isolation by top-level site) and restore prior behavior of storage, service workers, and communication APIs in content embedded on their site.

    The following APIs remain unpartitioned in third-party contexts should you enroll the top-level site in the DisableThirdPartyStoragePartitioning deprecation trial: Storage APIs (such as localStorage, sessionStorage, IndexedDB, Quota, and so on), Communication APIs (such as BroadcastChannel, SharedWorkers, and WebLocks), and ServiceWorker API.

    Chrome 113 also adds the DefaultThirdPartyStoragePartitioningSetting enterprise policy, which unpartitions APIs in all third-party contexts, as well as ThirdPartyStoragePartitioningBlockedForOrigins, which unpartitions APIs for third-party contexts when the first-party context’s origin matches the list. Both will be supported for at least 12 milestones. You can read more in this blog post.

   

  • Changes to phishing protection on Android as early as Chrome 115   back to top

    When a user authenticates to Android with their Google password, for example, during account setup, Chrome will be notified so the password can begin receiving phishing protection when surfing the Web with Chrome. In previous versions of Chrome on Android, users needed to explicitly provide their password within a Chrome tab, for example, sign in to Gmail, to receive phishing protection for their Google password. 

    You can disable warnings regarding password reuse by setting PasswordProtectionWarningTrigger to 0.
     

↑ back to top  

   

  • Chrome 117 will no longer support macOS 10.13 and macOS 10.14   back to top

    Chrome 117 will no longer support macOS 10.13 and macOS 10.14, which are already outside of their support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security.

   

  • Extensions must be updated to leverage Manifest V3   back to top

    Chrome 112 enables access to the WebHID API from extension service workers, as a migration path for Manifest V2 extensions that currently access the API from a background page.

    Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. 

    As mentioned earlier in our blog post, More details on the transition to Manifest V3, the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed.

    During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3.

    Starting with Chrome 110, an Enterprise policy ExtensionManifestV2Availability has been available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions until at least January 2024. 

    You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management.

    For more details, refer to the Manifest V2 support timeline.

Upcoming ChromeOS changes

   

  • Cursive pre-installed for Enterprise and Education accounts   back to top

    As early as ChromeOS 114, Cursive, a stylus-first notes app, will be available for Chromebook. It will be pre-installed for all Enterprise and Education accounts on stylus-enabled Chromebooks. If you want to block access to the app, you can prevent Chromebooks in your enterprise from accessing cursive.apps.chrome.

   

  • Passpoint: Seamless, secure connection to Wi-Fi networks   back to top

    Starting as early as ChromeOS 114, Passpoint will streamline Wi-Fi access and eliminate the need for users to find and authenticate a network each time they visit.  Once a user accesses the Wi-Fi network offered at a location, the Passpoint-enabled client device will automatically connect upon subsequent visits.

   

  • Mandatory extensions for Incognito navigation   back to top

    In Chrome OS 114, Extensions allow admins to enforce security features and customizations in their OU but they cannot be enforced in Incognito mode without user consent. This can be a problem as users can bypass extension-set features, for example, proxies by using Incognito mode for navigation.

    The MandatoryExtensionsForIncognitoNavigation policy will allow administrators to configure a list of extensions, which users need to explicitly allow to run in Incognito, to use Incognito mode for navigation.

   

  • App Streaming on Chrome OS   back to top

    In Chrome OS 114, App Streaming will enhance the Phone Hub experience, by allowing users to see and interact with streamed apps running on their Pixel phone. When a user receives a mirrored conversation notification from their Pixel phone, a simple tap on that notification will kick off an app stream directly to the user's Chrome OS desktop. This is part of a Google-wide ambient computing effort.

↑ back to top  

Chrome 112

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Enable access to WebHID API from extension service workers     
Unused site permissions module in safety check    
Default to origin-keyed agent clustering    
Chrome apps no longer supported on Windows, Mac, and Linux    
Auto-upgrade mixed content to HTTPS    
Chrome Root Store updates and removal of the ChromeRootStoreEnabled policy  
Updated onboarding experience    
Policy troubleshooting page available on Android    
Changes to HTTPS policies    
Add websites and PWAs to the home screen on iOS    
New Chrome Sync data types available in Takeout  
 
Autofill on iOS    
Android WebView phases out X-Requested-Header starting from version 112    
Web auth flow to use browser tab instead of App window    
Chrome for Testing    
Price tracking on iOS    
New and updated policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
Screencast supports multi-language transcription in recordings    
Fast Pair saved devices    
Introducing the Rupee symbol on US-English keyboards in India    
Screen Capture shows clicks and keyboard shortcuts    
Admin console updates Security/ Privacy User productivity/ Apps Management
New Chrome browser insights    
Device Token Management policy for device token deletion    
New policies in Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
Changes to phishing protection on Android as early as Chrome 113    
Deprecation trial for unpartitioned 3rd party Storage, Service Workers, and Communication APIs    
First-Party Sets user controls    
Removal of permissive Chrome Apps webview behaviors    
Collect additional data for off-store extensions in telemetry reports    
Launching FastCheckout for Checkout experiences    
Updated Password Management Experience on iOS in Chrome 113     
New inactive tabs section in the Chrome app on iPhone and iPad    
Image-set css changes    
Support for Private State Tokens    
Enable access to WebUSB API from extension service workers in Chrome 113    
Changes to Google Password Manager in Chrome 114    
Updates to Bookmarks on Desktop    
Network Service on Windows will be sandboxed     
Chrome 117 will no longer support macOS 10.13 and macOS 10.14    
Extensions must be updated to leverage Manifest V3  
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
Cursive pre-installed for Enterprise and Education accounts    
Screensaver preview    
Passpoint: Seamless, secure connection to Wi-Fi networks   
Upcoming Admin console changes Security/ Privacy User productivity/ Apps Management
Risk Assessment card  

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Please allow 1 to 2 weeks for translation for some languages.

 

Chrome browser updates

 

   

  • Enable access to WebHID API from extension service workers   back to top

    Chrome 112 enables access to the WebHID API from extension service workers, as a migration path for Manifest V2 extensions that currently access the API from a background page.

   

  • Unused site permissions module in safety check   back to top

    Chrome’s safety check can confirm the overall security and privacy of the browsing experience. It tells you if any passwords saved in Chrome have been compromised, flags dangerous extensions, and helps you ensure that your security protections are up to date.

    Starting with Chrome 112, safety check includes auto-revocation of unused site permissions on Chrome. Chrome resets permissions from sites that users have not visited for a while. Chrome revokes permissions automatically and offers options to opt out or re-grant. Permissions granted by enterprise policies are not affected.

   

  • Default to origin-keyed agent clustering   back to top

    Starting in Chrome 112, websites can no longer set document.domain. Websites now need to use alternative approaches such as postMessage() or Channel Messaging API to communicate cross-origin. If a website relies on same-origin policy relaxation via document.domain to function correctly, it now needs to send an Origin-Agent-Cluster: ?0 header along with all documents that require that behavior. You can read more in this blog post.  
     

    Note: document.domain has no effect if only one document sets it.

    The OriginAgentClusterDefaultEnabled enterprise policy allows you to extend the current behavior.  

   

  • Chrome apps no longer supported on Windows, Mac, and Linux   back to top

    As previously announced, we are phasing out support for Chrome apps in favor of Progressive Web Apps (PWAs) and web-standard technologies. The deprecation schedule was adjusted to provide enterprises who used Chrome apps additional time to transition to other technologies, and Chrome apps will now stop functioning in Chrome 112 or later on Windows, Mac, and Linux. If you need additional time to adjust, a policy ChromeAppsEnabled will be available to extend the lifetime of Chrome apps an additional 2 milestones.

     

    Starting in Chrome 105, if you're force-installing any Chrome apps, users are shown a message stating that the app is no longer supported. The installed Chrome apps are still launchable. 


    Starting with Chrome 112, Chrome apps on Windows, Mac and Linux no longer work. To fix this, remove the extension ID from the force-install extension list, and if necessary, add the corresponding install_url to the web app force install list. For common Google apps, the install_urls are listed below:

     
    Property Extension ID (Chrome app) install_url (PWA / Web app)
    Gmail pjkljhegncpnkpknbcohdijeoejaedia https://mail.google.com/mail/
    installwebapp?usp=admin
    Docs aohghmighlieiainnegkcijnfilokake https://docs.google.com/document/
    installwebapp?usp=admin
    Drive apdfllckaahabafndbhieahigkjlhalf https://drive.google.com/drive/
    installwebapp?usp=admin
    Sheets felcaaldnbdncclmgdcncolpebgiejap https://docs.google.com/spreadsheets/
    installwebapp?usp=admin
    Slides aapocclcgogkmnckokdopfmhonfmgoek https://docs.google.com/presentation/
    installwebapp?usp=admin
    Youtube blpcfgokakmgnkcojhhkbfbldkacnbeo https://www.youtube.com/s/
    notifications/manifest/cr_install.html
        

↑ back to top  

   

  • Auto-upgrade mixed content to HTTPS on iOS   back to top

    Chrome 112 on iOS starts automatically upgrading passive mixed content (HTTP image, audio and video on HTTPS pages) to HTTPS, when possible. Previously, Chrome on iOS blocked passive mixed content. All other Chrome platforms auto-upgrade passive mixed content, when possible. An enterprise policy, MixedContentAutoupgradeEnabled, is available to disable mixed content auto-upgrading on HTTPS sites on iOS. The policy will be removed in Chrome 116.  

   

  • Chrome Root Store updates and removal of the ChromeRootStoreEnabled policy   back to top

    Chrome 112 now enforces name constraints on root certificates. This matches the behavior prior to the launch of the Chrome Root Store in Chrome 106. If you previously disabled the Chrome Root Store to work around this issue, you can test again with Chrome 112. If you relied on Chrome not enforcing name constraints, we have provided a temporary EnforceLocalAnchorConstraintsEnabled policy to disable this behavior. This policy will be removed in the future.  

    As early as Chrome 113, to improve user security and provide a consistent experience across different platforms, Chrome will switch to its own default root store and built-in certificate verifier on Android, Linux, and ChromeOS. Chrome continues to use custom local roots installed to the operating system’s trust store. The Chrome Root Store is already default enabled on Windows and Mac.

    We do not anticipate any changes to how enterprises currently manage their fleet and trusted enterprise CAs, such as through group policy, macOS Keychain Access, or system management tools like Puppet.

    The ChromeRootStoreEnabled policy allows selective disabling of the Chrome Root Store in favor of the platform root store. You can set this policy to Disabled to force the use of the platform root store, otherwise it is enabled by default. The policy will be made available on Android, Linux, and ChromeOS until Chrome 120. 

    The ChromeRootStoreEnabled policy will be removed from Windows and Mac on Chrome 113. Support for trusted leaf certificates and the Windows Trusted People store was added for Chrome 111. If you previously disabled the Chrome Root Store to work around either of these issues, you can test again with Chrome 112.  

   

   

  • Policy troubleshooting page available on Android   back to top

    chrome://policy/logs is a new page that admins can use to help troubleshoot enterprise policies on Android. On iOS, this will become available in Chrome 113.   

   

  • Changes to HTTPS policies   back to top

    The HttpsOnlyMode policy now supports force_enabled. This enables the Always use secure connections setting on chrome://settings/security and prevents the user from disabling it. The setting causes a bypassable error interstitial to be displayed before any navigation to a non-HTTPS site. Users can always bypass the error interstitial, and the decision to bypass is remembered for one week. We’ve also added the HttpAllowlist policy, which you can use to define a list of hosts or hostname patterns that are allowed to be non-HTTPS without an error interstitial. For example, you can use the HttpAllowlist policy to allowlist internal sites that might be HTTP-only.   

↑ back to top  

   

  • Add websites and PWAs to the home screen on iOS   back to top

    Starting in Chrome 112, you can bookmark a website on the iOS device's home screen. If the website offers a Progressive Web Apps (PWAs), then this action adds the app to the home screen. Otherwise, the bookmark opens in the default browser when you tap it. This feature is available to iOS16.4 and above.   

    Bookmark website or pwa on iOS  

   

  • New Chrome Sync data types available in Takeout   back to top

    In Chrome 112, additional Chrome data is available to export in Takeout and Domain Wide Takeout (DWT). The following data types are available: AUTOFILL, PRIORITY_PREFERENCE, WEB_APP, DEVICE_INFO, TYPED_URL, ARC_PACKAGE, OS_PREFERENCE, OS_PRIORITY_PREFERENCE, PRINTER.

    You can control which data types are synced to Chrome Sync using the SyncTypesListDisabled enterprise policy. Instructions on allowing or blocking Takeout can be found in this help center article.   

   

  • Autofill on iOS   back to top

    In Chrome 112, some iOS users see a prompt to choose Chrome for Autofill in their iOS settings. The user can choose to learn more, dismiss the prompt forever, or be reminded again later. The prompt can appear after the user has copied a password from the Chrome password manager, saved a password, or logged into a website using an existing saved password. An enterprise policy, CredentialProviderPromoEnabled, is available to disable any appearance of the prompt.   

    Autofill on iOS  
     

   

  • Android WebView phases out the X-Requested-Header starting from version 112  back to top

    To improve privacy, Android WebView begins phasing out the X-Requested-With HTTP request header. Sites that currently rely on this header can sign up for the Deprecation Origin Trial, which will allow them to continue to receive the header. The deprecation trial is planned to run for at least one year, but will continue until replacement APIs have been launched to address the current use cases for the header. Apps can also enable the header for individual destination origins by using a newly introduced AndroidX API. Using this API will continue to provide the header to sites past the end of the deprecation trial.   

↑ back to top  

   

  • Web auth flow to use browser tab instead of App window   back to top

    In Chrome 112, the authorization page for web auth flow in Chrome extensions now displays either in a new tab or a popup window. This change concerns two API methods: launchWebAuthFlow and getAuthToken. It resolves several existing UX problems:
     
    • the authorization page now displays a URL which protects against phishing attacks.
    • sign-in state is now shared with all browser tabs; no need to sign-in into extension separately.
    • sign-in state is persisted on Chrome restart.
    • fixed accessibility issues of App window.
    Web auth flow  

   

  • Chrome for Testing   back to top

    In Chrome 112, Puppeteer, Chrome's browser automation library, uses the Chrome for Testing binary instead of a Chromium binary. In case you have the Chromium binary allowlisted, you can allowlist the Chrome for Testing binary too.

    Chrome for Testing is a dedicated Chrome flavor for the automated testing use case. It’s not an end-user facing product, but rather a tool to be used by automation engineers through other projects such as Puppeteer. Chrome for Testing is a completely separate binary from regular Chrome. 

   

  • Price tracking on iOS   back to top

    Chrome 112 on iOS enables users to track the prices of  products  across the web, and receive notifications when the price drops. An enterprise policy, ShoppingListEnabled, is available to control this shopping feature.  

   

 

ChromeOS updates

   

  • Screencast supports multi-language transcription in recordings   back to top

    ChromeOS 112 dramatically expands Screencast recording capabilities by including a wide range of languages by integrating with Google's S3 transcription API. 

    The Screencast app for ChromeOS lets users record transcribed screencasts on their Chromebook. In previous versions, this feature was available in EN-US only, which meant that only English speaking users in the US could record screencasts. Soon, it will be possible to record and transcribe screencasts in a wide range of languages including Spanish, Japanese, French, Italian, and German.   

↑ back to top  

   

  • Fast Pair saved devices   back to top

    ChromeOS 112 adds a subpage to Fast Pair settings for saved devices, where users can view their device associations, remove any that may be unwanted, and configure whether they want Fast Pair-paired devices to automatically save to their account. This experience mirrors the management capabilities already available for Fast Pair on Android today, and was explicitly requested as a fast-follow improvement by the ChromeOS Privacy team.   

   

  • Introducing the Rupee symbol on US-English keyboards in India   back to top

    ChromeOS 112 adds the Rupee symbol ₹ to both the virtual keyboard and the physical keyboard, where AltGr+4 is the rupee symbol (hold right-alt + 4).   

    The compact virtual keyboard just moves some currency keys around so that you can access the Rupee symbol in the more symbols menu. For accessibility, the virtual keyboard has the AltGr layer toggle available, which lets you type AltGr+4 and get the rupee symbol. 

   

  • Screen Capture show clicks and keyboard shortcuts   back to top

    You can now enhance demos made with Screen Capture by enabling users to show clicks and keyboard shortcuts on screen.   
 

Admin console updates

 

   

  • New Chrome browser insights   back to top

    In Chrome 112, a new Browsers that need attention insights card allows IT admins to quickly identify browsers that have a pending Chrome update, browsers that are inactive and browsers that have recently enrolled.

    Chrome browser insights  

   

  • Device Token Management policy for device token deletion   back to top

    A new policy allows Chrome Browser Cloud Management administrators to delete the device token on the end-point devices when deleting a browser from the managed browsers list in the Admin console.

    When the new Delete token value is selected and a browser is deleted from the Managed browser list, the browser automatically re-enrolls in Chrome Browser Cloud Management the next time it is online, if the enrollment token was not deleted on the device and the enrollment token is still active. The default value remains to invalidate the device token.

    Device token  

↑ back to top  

   

  • New policies in the Admin console   back to top
     
    Policy Name Pages Supported on Category/Field
    PrivacySandboxSiteEnabledAdsEnabled User & Browser Settings Chrome (Linux, Mac, Windows)
    ChromeOS, Android
    Security > Privacy Sandbox>Control whether privacy sandbox prompts.
    PrivacySandboxPromptEnabled User & Browser Settings Chrome (Linux, Mac, Windows)
    ChromeOS, Android
    Security > Controls whether the Privacy Sandbox Site-suggested ads setting can be disabled for your users.
    PrivacySandboxAdTopicsEnabled User & Browser Settings Chrome (Linux, Mac, Windows)
    ChromeOS, Android
    Security >Controls whether your users see the Privacy Sandbox prompt.
    PrivacySandboxAdMeasurementEnabled User & Browser Settings Chrome (Linux, Mac, Windows) ChromeOS, Android Security >Controls whether the Privacy Sandbox Ad measurement setting can be disabled for your users.
 

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

  • Changes to phishing protection on Android as early as Chrome 113   back to top

    When a user authenticates to Android with their Google password, for example, during account setup, Chrome will be notified so the password can begin receiving phishing protection when surfing the Web with Chrome. In previous versions of Chrome on Android, users needed to explicitly provide their password within a Chrome tab, for example, sign in to Gmail, to receive phishing protection for their Google password. 

    You can disable warnings regarding password reuse by setting PasswordProtectionWarningTrigger to 0.

   

  • Deprecation Trial for Unpartitioned third-party Storage, Service Workers, and Communication APIs   back to top

    Beginning gradually in Chrome 113, storage, service workers, and communication APIs will be partitioned in third-party contexts. In addition to being isolated by the same-origin policy, the affected APIs used in third-party contexts would also be separated by the site of the top-level context. Sites that haven’t had time to implement support for third-party storage partitioning can take part in a deprecation trial to temporarily unpartition (continue isolation by same-origin policy but remove isolation by top-level site) and restore prior behavior of storage, service workers, and communication APIs in content embedded on their site. 

    The following APIs will remain unpartitioned in third-party contexts should you enroll the top-level site in the DisableThirdPartyStoragePartitioning deprecation trial: Storage APIs (such as localStorage, sessionStorage, IndexedDB, Quota, and so on), Communication APIs (such as BroadcastChannel, SharedWorkers, and WebLocks), and ServiceWorker API.  

    Chrome 113 will also add the DefaultThirdPartyStoragePartitioningSetting enterprise policy, which will unpartition APIs in all third-party contexts, as well as ThirdPartyStoragePartitioningBlockedForOrigins, which will unpartition APIs for third-party contexts when the first-party context’s origin matches the list. Both will be supported for at least 12 milestones. You can read more in the blog post

   

  • First-Party Sets user controls   back to top

    First-Party Sets is an upcoming framework for developers to declare relationships between domains, such that the browser can make decisions regarding access based on the third party’s relationship to the first party. A set may enjoy first party benefits, including continued access to their cookies when the top-level domain is in the same set.

    First-Party Sets are part of Chrome's roadmap for a more privacy-focused web.

    Chrome 113 will introduce user controls for these First-Party Sets. Two enterprise policies will be made available to manage First-Party sets: one to disable First-Party Sets and one to provide your own sets.  

    First Party Sets  

↑ back to top  

   

  • Removal of permissive Chrome Apps webview behaviors   back to top

    In Chrome 113, Chrome Apps webview usage will have the following restrictions:
     
    1. SSL errors within webview will show an error page that does not provide the user the option to unsafely proceed.
    2. The use of the webview NewWindow event to attach to a webview element in another App window will cause the window reference returned by the window.open call in the originating webview to be invalidated.

    In Chrome 112, you’ll be able to test out this new behavior by navigating to chrome://flags and enabling the chrome://flags/#enable-webview-tag-mparch-behavior.

    A temporary enterprise policy ChromeAppsWebViewPermissiveBehaviorAllowed will be available to give enterprises time to address possible breakage related to these changes.

   

  • Collect additional data for off-store extensions in telemetry reports   back to top

    When Enhanced Safe Browsing is enabled, Chrome 113 will start collecting additional telemetry on off-store extensions, such as file hashes and the manifest.json file. The data collected are analyzed on Google servers to detect malicious off-store extensions (including self-hosted extensions) and improve protection for all Chrome extension users. This functionality along with the entire extension telemetry feature can be turned off by setting SafeBrowsingProtectionLevel to any value other than 2; this disables Enhanced Safe Browsing. Enterprise admins can use the SafeBrowsingProtectionLevel policy if they have any concerns about exposing this data.   

   

  • Launching FastCheckout for Checkout experiences   back to top

    In Chrome 113, some users will see an updated Autofill UI targeting checkout pages on shopping websites. It can be disabled by either disabling policy AutofillAddressEnabled or AutofillCreditCardEnabled.  

    Fast checkout  

   

  • Updated Password Management Experience on iOS in Chrome 113   back to top

    On Chrome on iOS, some users who are signed-in to Chrome but don't have Chrome sync enabled will be able to use and save passwords in their Google Account. Relevant enterprise policies such as BrowserSignin, SyncDisabled, SyncTypesListDisabled and PasswordManagerEnabled will continue to work as before and can be used to configure whether users can use and save passwords in their Google Account.  

   

  • New inactive tabs section in the Chrome app on iPhone and iPad   back to top

    In Chrome 113, old tabs will be hidden under a new Inactive Tabs section in the Tab grid view. Chrome users will be able to access the inactive tabs section to view all old tabs or close them using the new bulk tab functionality.   

↑ back to top  

   

  • Image-set css changes   back to top

    Chrome 113 implements standard syntax support for image-set and will treat the previously supported -webkit- vendor prefix syntax as a parse time alias for the standard. As a result of this, values set with the vendor prefix will serialize as standard.

    Example:

      -webkit-image-set(url(example.png) 1x)

    Will serialize to:

      image-set(url(""example.png"") 1x for specified value (as returned via getPropertyValue() like:
        testDiv.style.getPropertyValue(""background-image"");)

    and to

      image-set(url(""example.png"") 1dppx) for computed value (as returned via
         getComputedStyle() like window.getComputedStyle(testDiv)[""background-image""]).

    If needed, the new behavior can be turned off via the CSSImageSet runtime flag. The rendering and image-selection behavior will be the same for both the prefixed and standard syntax (Chrome Status).  

   

  • Support for Private State Tokens   back to top

    Starting in Chrome 113, the Private State Tokens API will be available for use by websites. Private State Tokens enable trust in a user's authenticity to be conveyed from one context to another, to help sites combat fraud and distinguish bots from real humans—without the exchange of user identifying information. Availability of Private State Tokens will be controlled using a new setting in Chrome settings called Auto-verify.   

   

  • Enable access to WebUSB API from extension service workers in Chrome 114   back to top

    As early as Chrome 114, we will enable access to WebUSB API from extension service workers as a migration path for Manifest V2 extensions that currently access the API from a background page.

    WebUSB policies can also be applied to extension origins to control this behavior. See DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls, and WebUsbAllowDevicesForUrls for more details.

   

  • Changes to Google Password Manager in Chrome 114   back to top

    In Chrome 114 the password manager will be re-branded as Google Password Manager

    Google Password Manager will offer more functionality and will be easier to access. You will be able to access the new look password manager via the three dot menu (previously located in Settings>Autofill). The upgraded Google Password Manager groups similar passwords together, has an improved checkup flow and users will be able to add the password manager to their desktop, for easy access.  

    Password manager  

   

  • Updates to Bookmarks on Desktop   back to top

    In Chrome 114, some users will see an updated experience of the Bookmarks side panel content and entry point to be inclusive of bookmark powers, as well as other features such as search, sorting, and editing.  

    Bookmarks  

    Bookmarks  

↑ back to top  

   

  • Network Service on Windows will be sandboxed   back to top

    As early as Chrome 114, to improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.

   

  • Chrome 117 will no longer support macOS 10.13 and macOS 10.14   back to top

    Chrome 117 will no longer support macOS 10.13 and macOS 10.14, which are already outside of their support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security.

   

  • Extensions must be updated to leverage Manifest V3   back to top

    Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. 

    As mentioned earlier in our blog post, More details on the transition to Manifest V3, the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed.

    During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3.

    Starting with Chrome 110, an Enterprise policy ExtensionManifestV2Availability will be available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions until at least January 2024. 

    You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management.

    For more details, refer to the Manifest V2 support timeline.   
 

Upcoming ChromeOS changes

   

  • Cursive pre-installed for Enterprise and Education accounts   back to top

    In ChromeOS 113, Cursive, a stylus-first notes app, will be available for Chromebook. It will be pre-installed for all Enterprise and Education accounts on stylus-enabled Chromebooks. If you want to block access to the app, you can prevent Chromebooks in your enterprise from accessing cursive.apps.chrome

   

  • Screensaver preview  back to top
    In ChromeOS 113, a new option will allow users to preview screensaver settings before applying. A preview will prove useful especially when using Google Photos with animations. 

    Screensaver preview  

   

  • Passpoint: Seamless, secure connection to Wi-Fi networks   back to top

    Starting as early as ChromeOS 114, Passpoint will streamline Wi-Fi access and eliminate the need for users to find and authenticate a network each time they visit.  Once a user accesses the Wi-Fi network offered at a location, the Passpoint-enabled client device will automatically connect upon subsequent visits.
 

Upcoming Admin console changes

   

  • Risk Assessment card   back to top

    We are creating a new card  in the Extension details page, which will show third-party risk scores for public extensions.

    Risk assessment card  

↑ back to top  

Chrome 111

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Reminder of change in launch schedule    
Privacy Sandbox updates in Chrome 111    
PPB_VideoDecoder(Dev) API removed    
New Chrome sync dialog in Chrome for Desktop    
Payment Handler API requires CSP connect-src    
Out-of-process System DNS Resolution    
Azure AD single sign-on (SSO)    
Web speech recognition API on iOS    
Chrome updater on Windows and Mac serves the most recent 12 versions    
Policy name changes    
Chrome Browser Cloud Management subscription    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
Fast Pair    
Keyboard shortcuts link in Text app    
Print job origin identification for managed devices    
Admin console updates Security/ Privacy User productivity/ Apps Management
Configure print server policies with Google groups    
New policies in Admin console    
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
LegacySameSiteCookieBehaviorEnabledForDomainList policy extended    
Enable access to WebHID API from extension service workers in Chrome 112    
Unused site permissions module in Safety Check    
Default to origin-keyed agent clustering in Chrome 112    
New Chrome Sync data types available in Takeout in Chrome 112    
Chrome for Testing    
Policy troubleshooting page available on Android    
Risk Assessment card    
Chrome apps no longer supported on Windows, Mac, and Linux    
Auto upgrade mixed content to HTTPS    
Launching FastCheckout for Checkout experiences    
Collect additional data for off-store extensions in telemetry reports    
Updated onboarding experience    
Deprecation trial for unpartitioned 3rd party Storage, Service Workers, and Communication APIs    
Changes to phishing protection on Android as early as Chrome 113    
Network Service on Windows will be sandboxed     
Enable access to WebUSB API from extension service workers in Chrome 113    
Extensions must be updated to leverage Manifest V3  
First-Party Sets user controls    
Removal ChromeRootStoreEnabled policy    
Full History sync    
Removal of permissive Chrome Apps webview behaviors    
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
Cursive pre-installed for Enterprise and Education accounts    
Screencast supports multi-language transcription in recordings    
Passpoint: Seamless, secure connection to Wi-Fi networks   
Upcoming Admin console changes Security/ Privacy User productivity/ Apps Management
New Chrome browser insights  

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Please allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

 

   

  • Reminder of change in launch schedule   back to top

    Starting in Chrome 110, Chrome started rolling out to the Stable channel one week earlier than previously planned to a very small subset of users. For example, the Chrome 111 Stable release moves from March 7 to March 1, 2023.

    You can also expect to see a much smaller rollout at a significantly reduced percentage of our user population for the first week of the published Stable release date. The wider rollout to most users happens at a similar timeframe to the earlier communicated dates. This slower initial rollout leads to better stability and makes it easier for enterprises to stay on the latest and safest version of Chrome.

    For more details, read about managing Chrome updates and check out the Chrome release schedule.

   

   

  • PPB_VideoDecoder(Dev) API removed   back to top

    The PPB_VideoDecoder(Dev) API was introduced for Adobe Flash. Since Flash is no longer supported in Chrome, we are removing this API in Chrome 111. If you need any extra time to migrate legacy applications, you can use the ForceEnablePepperVideoDecoderDevAPI enterprise policy. This policy will only be supported through Chrome 114. If you need to use the policy after that, file a bug on crbug.com before May 5, 2023, explaining your use case. 

   

↑ back to top  

   

  • Payment Handler API requires CSP connect-src   back to top

    If your organization uses the Web Payment API (Payment Handler and Payment Request) and also uses Content-Security-Policy (CSP) for better protection, then you need to add the domains of HTTP requests sent from the Web Payment API to the connect-src directive of the CSP. This is enforced in Chrome 111. For more information, see this developer blog post.  

   

  • Out-of-process System DNS Resolution   back to top

    Starting gradually in Chrome 111, as part of the Linux and Android network service sandboxes, system DNS resolution moves out of the network service and into the unsandboxed browser process, as system DNS resolution cannot run while sandboxed on these platforms. The Enterprise policy OutOfProcessSystemDnsResolutionEnabled is available to control this feature. Setting this policy to false causes system DNS resolution to run in the network process rather than the browser process. This might force the network service sandbox to be disabled, degrading the security of Google Chrome.  

   

  • Azure AD single sign-on (SSO)   back to top

    Chrome 111 now supports automatic sign-on into Microsoft identity providers using account information from Microsoft Windows. This feature is disabled by default and can be enabled using the CloudAPAuthEnabled policy. 

   

  • Web speech recognition API on iOS   back to top

    On Chrome 111 on iOS, websites can use the Web Speech API for speech recognition-based features. Speech-to-text conversion is performed by Apple servers.  

   

  • Chrome updater on Windows and Mac serves the most recent 12 versions   back to top

    The Chrome updater now supports serving versions of Chrome that reached 100% rollout, within the latest 12 releases on the Beta, Stable, and Extended Stable channels. If you're using the TargetVersionPrefix enterprise policy, ensure you are within 12 versions of the latest release. If you don't manually manage Chrome updates, no action is required. 

↑ back to top  

   

   

  • Chrome Browser Cloud Management subscription   back to top

    As early as March 2023, the Chrome Browser Cloud Management (CBCM) subscription will be automatically added to all Admin console accounts who are using CBCM without the subscription. CBCM customers are now required to have the Chrome Browser Cloud Management subscription to use the service. This change adds no new cost to your existing account and there are no actions required.  

   

   

  • Removed policies in Chrome browser   back to top
     
    Policy Description
    FileSystemSyncAccessHandleAsyncInterfaceEnabled Re-enable the deprecated async interface for FileSystemSyncAccessHandle in File System Access API.

     

ChromeOS updates

 

   

  • Fast Pair   back to top

    Fast Pair now makes Bluetooth pairing easier on ChromeOS devices and Android phones. When you turn on your Fast Pair-enabled accessory, it automatically detects and pairs with your ChromeOS device or Android phone in a single tap. Fast Pair also associates your Bluetooth accessory with your Google account, making it incredibly simple to move between devices without missing a beat.

    fast pair  
     

↑ back to top  

   

  • Keyboard shortcuts link in Text app   back to top

    The ChromeOS Text app has a series of built-in keyboard shortcuts. ChromeOS 111 adds a link to the Help Center article from the Text app settings, to provide instructions on how to use these keyboard shortcuts. 

   

  • Print job origin identification for managed devices   back to top

    To improve support for specific advanced printing workflows in managed environments, mostly encountered in the Healthcare space, print jobs need to contain information about the device that they originated from. ChromeOS 111 introduces the client-info IPP attribute to populate an admin-specified value, which identifies a device used for downstream printing workflow or reporting activities.

    Additionally, all print jobs now indicate ChromeOS together with the running release version.

    This new attribute in print jobs is only available for jobs originating from managed devices and controlled by a new admin policy.

    Printer ID  

Admin console updates

 

   

  • Configure print server policies with Google groups   back to top

    Admins can now use new or existing Google groups to configure print servers for users in your organization. That means when you need to configure a print server for a specific set of users–who may or may not belong to different Organizational Units (OUs)–you can now use the flexibility of groups without needing to reconfigure your OUs. Note that configuration of print server policies for user groups works exactly the same as it does for printers.

    Printer groups  

   

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

   

↑ back to top  

   

  • Enable access to WebHID API from extension service workers in Chrome 112   back to top

    This launch will enable access to WebHID API from extension service workers as a migration path for Manifest V2 extensions that currently access the API from a background page. 

   

  • Unused site permissions module in Safety Check  back to top

    In Chrome 112, Safety Check will be expanded to include auto-revocation of unused site permissions on Chrome. Chrome will reset permissions from sites that have low recent engagement. Chrome informs the user about auto-revocation of permissions and offers options to opt out or re-grant. Permissions granted by enterprise policies are not affected. This launch follows the first extension of Safety Check that introduced proactive notification of permission reminders.  

   

  • Default to origin-keyed agent clustering in Chrome 112   back to top

    In Chrome 112, websites will be unable to set document.domain. Websites will need to use alternative approaches such as postMessage() or Channel Messaging API to communicate cross-origin. If a website relies on same-origin policy relaxation via document.domain to function correctly, it will need to send an Origin-Agent-Cluster: ?0 header along with all documents that require that behavior. You can read more in the blog post.

    Note: document.domain has no effect if only one document sets it.

    The OriginAgentClusterDefaultEnabled enterprise policy will allow you to extend the current behavior.  

   

  • New Chrome Sync data types available in Takeout in Chrome 112   back to top

    There will be more Chrome data available to export in Takeout and Domain Wide Takeout (DWT). The following data types are available: AUTOFILL, PRIORITY_PREFERENCE, WEB_APP, DEVICE_INFO, TYPED_URL, ARC_PACKAGE, OS_PREFERENCE, OS_PRIORITY_PREFERENCE, PRINTER.

    You can control which data types are synced to Chrome Sync using the SyncTypesListDisabled enterprise policy.  

   

  • Chrome for Testing   back to top

    In Chrome 112, Puppeteer, Chrome's browser automation library, will start using the Chrome for Testing binary instead of a Chromium binary. In case you have the Chromium binary allowlisted, you might consider allowlisting the Chrome for Testing binary too.

    Chrome for Testing is a dedicated Chrome flavor for the automated testing use case. It’s not an end-user facing product, but rather a tool to be used by automation engineers through other projects such as Puppeteer. Chrome for Testing is a completely separate binary from regular Chrome.  

↑ back to top  

   

  • Policy troubleshooting page available on Android   back to top

    chrome://policy/logs is a new page that admins will be able to use to help troubleshoot enterprise policies on Android.  

   

  • Risk Assessment card   back to top

    In Chrome 112, we’re creating a new card  in the Extension details page, which will show 3rd party risk scores, such as CRXcavator.io or Spin.ai, for public extensions.  

   

  • Chrome apps no longer supported on Windows, Mac, and Linux   back to top

    As previously announced, we are phasing out support for Chrome apps in favor of Progressive Web Apps (PWAs) and web-standard technologies. The deprecation schedule was adjusted to provide enterprises who used Chrome apps additional time to transition to other technologies, and Chrome apps will now stop functioning in Chrome 112 or later on Windows, Mac, and Linux. If you need additional time to adjust, a policy ChromeAppsEnabled will be available to extend the lifetime of Chrome Apps an additional 2 milestones.

     

    Starting in Chrome 105, if you're force-installing any Chrome apps, users are shown a message stating that the app is no longer supported. The installed Chrome Apps are still launchable. 


    Starting with Chrome 112, Chrome Apps on Windows, Mac and Linux will no longer work. To fix this, remove the extension ID from the force-install extension list, and if necessary, add the corresponding install_url to the web app force install list. For common Google apps, the install_urls are listed below:

     
    Property Extension ID (Chrome App) install_url (PWA / Web App)
    Gmail pjkljhegncpnkpknbcohdijeoejaedia https://mail.google.com/mail/
    installwebapp?usp=admin
    Docs aohghmighlieiainnegkcijnfilokake https://docs.google.com/document/
    installwebapp?usp=admin
    Drive apdfllckaahabafndbhieahigkjlhalf https://drive.google.com/drive/
    installwebapp?usp=admin
    Sheets felcaaldnbdncclmgdcncolpebgiejap https://docs.google.com/spreadsheets/
    installwebapp?usp=admin
    Slides aapocclcgogkmnckokdopfmhonfmgoek https://docs.google.com/presentation/
    installwebapp?usp=admin
    Youtube blpcfgokakmgnkcojhhkbfbldkacnbeo https://www.youtube.com/s/
    notifications/manifest/cr_install.html
        

   

  • Auto upgrade mixed content to HTTPS on iOS in Chrome 112   back to top

    Chrome on iOS will start automatically upgrading passive mixed content (HTTP image, audio and video on HTTPS pages) to HTTPS when possible. The current behavior on iOS is to block passive mixed content. All other Chrome platforms already optimistically upgrade passive mixed content. An Enterprise policy MixedContentAutoupgradeEnabled is available to disable mixed content auto upgrading on HTTPS sites on iOS. The policy will be removed in 116.  

   

  • Launching FastCheckout for Checkout experiences   back to top

    In Chrome 112, some users will see an updated Autofill UI targeting checkout pages on shopping websites. It can be disabled by either disabling policy AutofillAddressEnabled or AutofillCreditCardEnabled.  

    Fast checkout  
     

↑ back to top  

   

  • Collect additional data for off-store extensions in telemetry reports   back to top

    When Enhanced Safe Browsing is enabled, Chrome 112 will start collecting additional telemetry on off-store extensions, such as file hashes and the manifest.json file. The data collected are analyzed on Google servers to detect malicious off-store extensions and improve protection for all Chrome extension users. This functionality along with the entire extension telemetry feature can be turned off by setting SafeBrowsingProtectionLevel to any value other than 2; this disables Enhanced Safe Browsing. Enterprise admins can use the SafeBrowsingProtectionLevel policy if they have any concerns about exposing this data. 

   

   

  • Deprecation Trial for Unpartitioned 3rd party Storage, Service Workers, and Communication APIs   back to top

    Beginning gradually in Chrome 113, storage, service workers, and communication APIs will be partitioned in third-party contexts. In addition to being isolated by the same-origin policy, the affected APIs used in third-party contexts would also be separated by the site of the top-level context. Sites that haven’t had time to implement support for third-party storage partitioning can take part in a deprecation trial to temporarily unpartition (continue isolation by same-origin policy but remove isolation by top-level site) and restore prior behavior of storage, service workers, and communication APIs in content embedded on their site. 

    The following APIs will remain unpartitioned in third-party contexts should you enroll the top-level site in the DisableThirdPartyStoragePartitioning deprecation trial: Storage APIs (such as localStorage, sessionStorage, IndexedDB, Quota, and so on), Communication APIs (such as BroadcastChannel, SharedWorkers, and WebLocks), and ServiceWorker API.

    Chrome 112 will also add the ThirdPartyStoragePartitioningEnabled enterprise policy, which will allow for unpartitioning all APIs in third-party contexts, to be supported for at least 12 milestones.  

   

  • Changes to phishing protection on Android as early as Chrome 113   back to top

    When a user authenticates to Android with their Google password, for example during account setup, Chrome will be notified so the password can begin receiving phishing protection when surfing the Web with Chrome. In previous versions of Chrome on Android, users needed to explicitly provide their password within a Chrome tab, for example, sign in to Gmail, to receive phishing protection for their Google password. 

    You can disable warnings regarding password reuse by setting PasswordProtectionWarningTrigger to 0.  

   

  • Network Service on Windows will be sandboxed   back to top

    As early as Chrome 113, to improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.  

↑ back to top  

   

  • Enable access to WebUSB API from extension service workers in Chrome 113   back to top

    As early as Chrome 113, we will enable access to WebUSB API from extension service workers as a migration path for Manifest V2 extensions that currently access the API from a background page.

    WebUSB policies can also be applied to extension origins to control this behavior. See DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls, and WebUsbAllowDevicesForUrls for more details.  

   

  • Extensions must be updated to leverage Manifest V3   back to top

    Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. 

    As mentioned earlier in our blog post, More details on the transition to Manifest V3, the Manifest V2 deprecation timelines are under review and the experiments scheduled for early 2023 are being postponed.

    During the timeline review, existing Manifest V2 extensions can still be updated, and still run in Chrome. However, all new extensions submitted to the Chrome Web Store must implement Manifest V3.

    Starting with Chrome 110, an Enterprise policy ExtensionManifestV2Availability will be available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions until at least January 2024. 

    You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Browser Cloud Management.

    For more details, refer to the Manifest V2 support timeline

   

  • First-Party Sets user controls   back to top

    First-Party Sets is an upcoming framework for developers to declare relationships between domains, such that the browser can make decisions regarding access based on the third party’s relationship to the first party. A set may enjoy first party benefits, including continued access to their cookies when the top-level domain is in the same set.

    First-Party Sets are part of Chrome's roadmap for a more privacy-focused web.

    Chrome 113 will introduce user controls for these First-Party Sets. Two enterprise policies will be made available to manage First-Party sets: one to disable First-Party Sets and one to provide your own sets. 

    First party sets  
     

   

  • Removal ChromeRootStoreEnabled policy   back to top

    In Chrome 105, we announced the launch of the Chrome Root Store on Windows and Mac. A new policy, called ChromeRootStoreEnabled, was introduced to allow selective disabling of the Chrome Root Store in favor of the platform root store. This policy will be removed from Windows and Mac on Chrome 113. Support for trusted leaf certificates and the Windows Trusted People store was added for Chrome 111. If you previously disabled the Chrome Root Store to work around either of these issues, please test again with Chrome 111. We are working on launching the Chrome Root Store for Android, Linux, and ChromeOS. As the Chrome Root Store launches on more platforms, we will continue to provide the policy on those platforms for six months after launch.  

   

  • Full History sync   back to top

    Starting with Chrome 112, Typed URLs will stop syncing for Enterprise users. Open Tabs will continue syncing as usual, unless disabled by existing SyncDisabled and SyncTypesListDisabled policies.  

↑ back to top  

   

  • Removal of permissive Chrome Apps webview behaviors   back to top

    In Chrome 113, Chrome Apps webview usage will have the following restrictions:
     
    • SSL errors within webview will show an error page that does not provide the user the option to unsafely proceed.
    • The use of the webview NewWindow event to attach to a webview element in another App window will cause the window reference returned by the window.open call in the originating webview to be invalidated.

    In Chrome 112, you’ll be able to test out this new behavior by navigating to chrome://flags and enabling the chrome://flags/#enable-webview-tag-mparch-behavior.

    A temporary enterprise policy ChromeAppsWebViewPermissiveBehaviorAllowed will be available to give enterprises time to address possible breakage related to these changes.  
     

Upcoming ChromeOS changes

 

   

  • Cursive pre-installed for Enterprise and Education accounts   back to top

    As early as ChromeOS 112, Cursive, a stylus-first notes app, will be available for Chromebooks. In an upcoming release, it will be pre-installed for all Enterprise and Education accounts on stylus-enabled Chromebooks. If you want to block access to the app, you can prevent Chromebooks in your enterprise from accessing cursive.apps.chrome.  

   

  • Screencast supports multi-language transcription in recordings   back to top

    As early as ChromeOS 112, we plan to dramatically expand Screencast recording capabilities by including a wide range of languages by integrating with Google's S3 transcription API. 

    The Screencast app for ChromeOS lets users record transcribed screencasts on their Chromebook. In previous versions, this feature was available in EN-US only, which meant that only English speaking users in the US could record screencasts. Soon, it will be possible to record and transcribe screencasts in a wide range of languages including Spanish, Japanese, French, Italian, and German.    

   

  • Passpoint: Seamless, secure connection to Wi-Fi networks   back to top

    Starting as early as ChromeOS 114, Passpoint will streamline Wi-Fi access and eliminate the need for users to find and authenticate a network each time they visit.  Once a user accesses the Wi-Fi network offered at a location, the Passpoint-enabled client device will automatically connect upon subsequent visits.

     
     

Upcoming Admin console changes

 

   

  • New Chrome browser insights   back to top

    As early as Chrome 112, a new Browsers that need attention insights card will allow IT admins to quickly identify browsers that have a pending Chrome update, browsers that are inactive and browsers that have recently enrolled. 

    Browser insights  
     

Chrome 110

Chrome browser updates Security/ Privacy User productivity/ Apps Management
Windows 7/8/8.1 and Windows Server 2012/2012 R2 are no longer supported    
Detailed translation settings    
Manual translation on iOS    
Change in launch schedule       
Biometrics protection for passwords    
App Store rating on iOS    
Custom web app default network error page    
User-level Enhanced Safe Browsing on iOS    
Chrome Headless mode upgrades    
MetricsReportingEnabled policy available on Android in Chrome browser     
WebAuthn cannot be used on sites with TLS certificate errors    
Cookie information from extensions    
Deprecation of WebSQL and other old Storage features    
Easier password updates when a compromise is detected    
Rolling out GPU changes to NaCL Swapchain and video decoding    
WebView metrics moves app package name filtering to server-side    
User-Agent reduction Phase 6    
Real-time URL Allowlist now synced through component updater on Android    
Google Update internal upgrades    
New and updated policies in Chrome browser    
Removed policies in Chrome browser    
ChromeOS updates Security/ Privacy User productivity/ Apps Management
Super Resolution Audio for Bluetooth headset microphones    
Channel labeling on ChromeOS    
Search autocomplete redesign    
ChromeOS 110 no longer supports Active Directory Management    
Select-to-speak improvements    
Local website approvals for Family Link users    
Low storage warning for ChromeOS Camera App    
Feedback tool refresh with inline assistive capabilities    
View PPDs for installed printers    
Admin console updates Security/ Privacy User productivity/ Apps Management
Recent changes on Chrome Settings page
Plugins section removed from the Browser details view  
New policies in Admin console
Upcoming Chrome browser changes Security/ Privacy User productivity/ Apps Management
Azure AD Single sign-on (SSO)    
Unused site permissions module in Safety Check    
Web speech recognition API on iOS    
Privacy Sandbox updates in Chrome 111    
New Chrome Sync data types available in Takeout in Chrome 111    
Chrome for Testing    
Enable access to WebHID API from extension service workers in Chrome 111    
PPB_VideoDecoder(Dev) API removed    
New Chrome sync dialog in Chrome for Desktop    
Strict MIME type checks for Worker scripts    
Default to origin-keyed agent clustering in Chrome 112    
Changes to phishing protection on Android as early as Chrome 112    
Chrome apps no longer supported on Windows, Mac, and Linux    
Network Service on Windows will be sandboxed     
Enable access to WebUSB API from extension service workers in Chrome 112 or later    
Extensions must be updated to leverage Manifest V3  
Payment Handler API will require CSP connect-src    
First-Party Sets user controls    
Removal ChromeRootStoreEnabled policy    
Upcoming ChromeOS changes Security/ Privacy User productivity/ Apps Management
Fast Pair    
Managed DoH (DNS over https) with user identification    
Cursive pre-installed for Enterprise and Education accounts    
Updated emoji picker    
Passpoint: Seamless, secure connection to Wi-Fi networks   
Upcoming Admin console changes Security/ Privacy User productivity/ Apps Management
Configure print server policies with Google groups    
New Chrome browser insights    

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Please allow 1 to 2 weeks for translation for some languages.



Chrome browser updates

 

   

  • Windows 7/8/8.1 and Windows Server 2012/2012 R2 are no longer supported   back to top

    Microsoft is ending support for most variants of Windows 7/8/8.1 in January 2023. As announced in a previous blog post, Chrome 109 is the last supported version of Chrome for these operating systems.

    Chrome running on Windows Server 2012 and Windows Server 2012 R2 will not be updated beyond Chrome 109, as those operating systems (OS) are based on Windows 8/8.1. However, critical security fixes will be issued to Chrome 109 on these two OS versions until October 10, 2023 to ease customer transitions. For the most up-to-date information, see this post in the Chrome Enterprise and Education help center.

   

  • Detailed translation settings   back to top

    Chrome 110 adds new detailed translation settings for controlling the current target language: Never translate languages and Always translate languages. These settings were previously only editable from the Translate UI bubble but now are permanently exposed under chrome://settings/language. Enterprise admins can use the existing TranslateEnabled policy to globally enable or disable translation.  

   

  • Manual translation on iOS   back to top

    In addition to detecting and translating languages automatically, Chrome on iOS allows the user to trigger translation manually, if the language was not detected automatically.  

   

  • Change in launch schedule   back to top

    Starting in Chrome 110, Chrome rolls out to the Stable channel one week earlier than previously planned to a very small subset of users. For example, the Chrome 110 Stable release moves from February 7 to February 1, 2023.

    You can also expect to see a much smaller rollout at a significantly reduced percentage of our user population for the first week of the published Stable release date. The wider rollout to most users happens at a similar timeframe to the earlier communicated dates. This slower initial rollout leads to better stability and makes it easier for enterprises to stay on the latest and safest version of Chrome.

    For more details, read about managing Chrome updates and check out the Chrome release schedule.

↑ back to top  

   

  • Biometrics protection for passwords   back to top

    For improved security, Chrome Desktop users can opt into requiring biometrics to autofill their passwords every time.

    biometrics password unlock  

   

  • App Store rating on iOS   back to top

    In Chrome 110, some iOS users might be presented with Apple’s standardized App Store rating prompt at most once per year. The prompt gives users the option to rate the app or dismiss the prompt. An enterprise policy, AppStoreRatingEnabled, is available to disable any appearance of the prompt.

   

  • Custom web app default network error page   back to top

    Chrome provides a custom default network error page (when the network is down) for web apps that don't define their own custom offline experience.

    Custom network error  

   

  • User-level Enhanced Safe Browsing on iOS   back to top

    For Chrome on iOS where the Safe Browsing protection level is not controlled by SafeBrowsingProtectionLevel, users who are signed in and syncing, and have enabled Enhanced Safe Browsing on their Google Account, are now notified that Enhanced Safe Browsing has been enabled on their Chrome profile. Disabling Enhanced Safe Browsing on a synced Google Account disables Enhanced Safe Browsing for their Chrome profile. Additionally, users that are signed-in and non-synced might be prompted to enable Chrome Enhanced Safe Browsing within 5 minutes of enabling Account Level Enhanced Safe Browsing.
     

   

  • Chrome Headless mode upgrades   back to top

    Chrome’s Headless mode provides a full Chrome browser to tooling vendors and developers that don’t need to bring pixels to the screen. It's used for test automation, automation of workflow steps, for example, steps required when setting up a new machine in an enterprise or autofill-like behavior, scraping web content, web rendering services, and so on.

    We’ve rebuilt Headless mode so that it’s much closer to Chrome’s regular mode. This provides more consistent experiences, including respecting enterprise policies when in Headless mode.  

↑ back to top  

   

  • MetricsReportingEnabled policy available on Android in Chrome   back to top

    As early as Chrome 110, Chrome on Android slightly modifies the first run experience to support the MetricsReportingEnabled policy. If the admin disables metrics reporting, there is no change to the first run experience. If the admin enables metrics, users can still change the setting in Chrome settings. When enabled, the MetricsReportingEnabled policy allows anonymous reporting of usage and crash-related data about Chrome to Google.  

   

  • WebAuthn cannot be used on sites with TLS certificate errors   back to top

    Starting on Chrome 110, Chrome stops allowing WebAuthn requests on websites with TLS certificate errors. The criteria are the same as those used for showing danger interstitials or a Not secure pill on the omnibox. This prevents bad actors from generating valid assertions in a Man-in-the-Middle attack on users who might skip the interstitial.

    Enterprises can use the AllowWebAuthnWithBrokenTlsCerts policy if needed as a workaround.

   

  • Cookie information from extensions   back to top

    When you enable Enhanced Safe Browsing, Chrome now collects telemetry information about the cookie information extensions request. These activities are analyzed on Google servers and further improve the detection of malicious and policy violating extensions. This improvement allows better protection for all Chrome extension users.  

   

  • Deprecation of WebSQL and other old Storage features   back to top

    Chrome 110 removes the window.webkitStorageInfo API. This legacy quota API has been deprecated since 2013, and has been replaced by the now standardized StorageManager API. Admins can re-enable webkitStorageInfo until Chrome 112, using the enterprise policy, PrefixedStorageInfoEnabled.

    WebSQL in third-party contexts is already disabled, and it has had a warning in DevTools since Chrome 105. Chrome 110 removes support in non-secure contexts. An enterprise policy, WebSQLNonSecureContextEnabled, allows Web SQL to function in non-secure contexts for a few months past the removal date.

   

  • Easier password updates when a compromise is detected   back to top

    The Check passwords tool now has an expanded set of URLs pointing directly to a Change password form. This allows users to take action and fix compromised passwords. The Check passwords tool is only available if PasswordManagerEnabled is set to true or unset.

    Check passwords  

↑ back to top  

   

  • Rolling out GPU changes to NaCL Swapchain and video decoding   back to top

    Chrome 110 refactors the implementation of the NaCL swapchain and the Pepper video decoding APIs. These changes are not intended to have any behavioral impa