The new version release from the popular web browser "Chrome 127", which introduces innovations, among which improvements in protection stand out, improvements for the Android version and bug fixes, eliminating a total of 24 vulnerabilities.
of the problems identified, 5 are considered high severity and none of them are considered critical or that allow you to bypass all levels of browser protection and execute code outside of the sandbox environment. As part of the reward program for discovering vulnerabilities, Google has awarded 16 prizes for a total of $47,500.
Main novelties of Chrome 127
In this new version of Chrome 127 that is presented, the “HTTPS-First” feature is enabled by default in incognito mode, automatically redirecting HTTP requests to HTTPS. If a site does not support HTTPS, it falls back to HTTP if there are problems with the HTTPS request or certificates. A warning is displayed when trying to open a site using HTTP.
In the Chrome Root Store, it has been decided not to trust the Entrust certification authority due to multiple non-compliance with requirements, such as delays in certificate revocation and incorrect issuance of EV (Extended Validation) level TLS certificates. Chrome will not trust TLS certificates issued by Entrust after October 31, 2024, although older certificates will still be accepted.
In addition to that, Chrome manifest version two is being phased out, which defines the capabilities and resources of extensions using the WebExtensions API. Full migration to version three of the manifest is scheduled for June 2025.
Another new feature that Chrome 127 presents is the advanced browser protection (Safe Browsing > Enhanced Protection), When enabled, telemetry is sent additional to Google servers on the pages using Vibration API, full mouse control (PointerLock) and keyboard. If the page is blacklisted, a warning is displayed and flagged APIs are disabled.
It is also highlighted that improved scanning of downloaded files in the browser's enhanced protection mode, including sending suspicious files to Google to detect viruses and malware. For downloaded encrypted files (.zip, .7z, .rar), the Browser will ask for a password to decrypt them and send them to Google for verification. The user can refuse verification or provide the password.
In the standard secure browsing mode, a password will be requested, but only metadata and file hashes will be sent to Google for verification. Implemented more visible warnings about downloading dangerous files, now located under the top panel instead of the bottom.
In the version for Android, now offering a simplified interface to link a Google account and synchronize data such as passwords and bookmarks. Sync is now integrated with account login and is no longer a separate option in settings.
Also the interface Password management has been updated. Users signed in to their Google Account, but without sync turned on, can save and use passwords linked to their Google Account.
Of the other changes that stand out:
- Initial implementation of the Private Network Access specification has been proposed, which limits the downloading of resources from public sites to hosts on internal networks
- In "Origin Testing" mode, an experimental access block to IP 0.0.0.0 has been implemented, as it can be used to bypass localhost access blocking on Linux and macOS.
- Added “Automatic Full Screen” setting (chrome://settings/content/automaticFullScreen), which allows sites to enable full screen mode automatically without user confirmation and display dialog boxes without exiting full screen mode. This setting is disabled by default and can be enabled for individual sites and web applications.
- The Service Worker Static Routing API has added the ability to use the “not” Boolean operator to reverse query match conditions.
- Streaming trigger events generated when the user interacts with content in a picture-in-picture window to the main window is now allowed.
- Added links to corresponding positions in the document when viewing CSS and HTML styles.
New presets in the network activity inspection panel to simulate “Fast 4G” access speed.
The performance analysis panel during trace now provides information about message sending and receiving events over WebSocket.
Interested in knowing more about it, you can consult the details In the following link.
How to install Google Chrome on Linux?
If you are interested in being able to install this new version of this web browser and you still do not have it installed, you can download the installer that is offered in deb and rpm packages on its official website.