Google Chrome Releases

Dev Channel Update

2009-11-06T15:37:00.000-08:00

The Dev channel has been updated to 4.0.237.0 for all platforms (Windows, Mac, and Linux). The focus on this release has been feature polish, stability improvement, and extensions work.

Mac

Significant bookmark bar improvements.

Linux

[r29163, r29299] Audio playing improvements in video/audio tags. (Issues: 23974, 20945, 17703)
[r29261] Fix international keyboard handling (alt-gr, ctrl+f). (Issues: 10846, 2215, 21471)
[r29657] ~ now works in the Omnibox to expand to home directories. (Issue: 18200)
[r29857] Fix conflicts between accelerator keys and HTML DOM accesskeys. (Issue: 21624)
[r29903] Inactive pinned tabs on linux throb when the title changes. (Issue: 25308)
Text drawn over rounded corners (including buttons) is no longer blurry. This affected a variety of sites, including Google Calendar and Google Reader.
As an experiment, we've changed the way clicking in the omnibox works. Leave a comment on the bug if it bothers you.

Extensions

Lots of work to polish and stabilize the browser and page action APIs:

[r29556] Add badge text color API. Also change color APIs from ARGB to RGBA (breaking change, sorry!) (Issues: 24635, 24644, 25215)
[r29152, r29785] Browser actions (buttons, popups) are now implemented. (Issue: 23882, 23897)
[r29997] Add support for tab-specific state to browser actions. Also, fix the bug where only the first call to setIcon() works. (Issues: 24669,24472)
[r30346] Constrain browser action popups to a min/max size. Also fix some glitches in popup sizing. (Issue 25214)
[r30499] Use a better signature for the new page actions API (chrome.pageAction.* instead of chrome.pageActions.*). This is technically a breaking change, but hopefully not too many people had gotten around to using the new API yet. (Issue 25833)

[r29665] Remove toolstrips on linux. They were causing lots of crashes and are going away soon anyway. (Issue 25106)
[r29911] Add chrome.extension.sendRequest() -- a simpler way to do content script messaging. (Issue 23865)
[r30341] Add new event chrome.tabs.onStatusChange. This makes the common case of wanting to know when tabs load much easier. (Issue 21729)
Other miscellaneous cleanup:

[r29498] Correctly handle reloading in the task manager (Issue 18693)

[r29555] Fix bug where content scripts did not always apply to first page load (Issue 11547)
[r29714, r29922, r29935, r30219] Various cleanup for the extension management page (Issues 12119, 25509, 25471)
[r30091] Improve install UI on mac (Issue 19654)
[r30312] Filter out hidden files when loading and packing extensions (Issue 23004)
[r30326] Copy chrome.extension.getTabContentses() to chrome.extension.getExtensionTabs(). Nobody liked the old name. (Issue 21433)
[r30384] Use the puzzle piece as the default extension icon. (Issue 25906)
[r30481] Hide the theme install bubble a little earlier. It was overlapping with the install dialog on linux. (Issue 26130)

Known Issues:

[r26861] - Autocomplete/ select box values are not being correctly populated in Linux. As a work around you can use the up/down arrow keys to view the current selection.
[r26600] - Task bar icon in Windows does not update/ display correctly.

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Anthony Laforge

Google Chrome Program Manager

Stable Channel Update

2009-11-05T13:18:00.000-08:00

The stable channel has been updated to 3.0.195.32, and includes the following security and stability fixes:

Resolved a history issue that affected going back from queries in Google Maps. (Issue: 21353)
Fixed issue with Adobe Acrobat Reader 9.2, where no content would be displayed. (Issue: 24883)
Fixed an infinite loop in AAC decoding. (Webkit Issue: 27239)
Fixed a top crasher. (Issue: 22205)
Fix issues where setInterval sometimes eats 100% CPU. (Issue: 25892)

Security Fixes:

CVE-2009-XXXX User not warned for some file types that can execute JavaScript

The user was not warned about certain possibly dangerous file types such as SVG, MHT and XML files. In some browsers, JavaScript can execute within these types of files. Because the JavaScript runs in the local context, it may be able to access local resources.

More info: http://code.google.com/p/chromium/issues/detail?id=23979
(This issue will be made public once a majority of users are up to date with the fix.)

Severity: Medium
Credit: Inferno of SecureThoughts.com
Mitigations:

A victim would need to visit a page under an attacker's control.
The victim would furthermore need to open a malicious file.

CVE-2009-XXXX Possible memory corruption in the Gears plugin

A malicious site could use the Gears SQL API to put SQL metadata into a bad state, which could cause a subsequent memory corruption. This may lead to a Gears plugin crash or possibly arbitrary code execution.

More info: http://code.google.com/p/chromium/issues/detail?id=26179
(This issue will be made public once a majority of users are up to date with the fix.)

Severity: High
Credit: This issue was found by the Google Chrome security team.
Mitigations:

A victim would need to visit a page under an attacker's control.
The victim would furthermore need to "click-through" the Gears dialog confirming that they trust the attacker's evil page.

Anthony Laforge

Google Chrome Program Manager

Dev Channel Updated with UI improvements for Mac

2009-11-04T15:14:00.000-08:00

This release is Mac OS X only and includes a number of UI improvements.

Version: 4.0.229.1

All,

[r30050] Use new renderer process for cross-site links with rel=noreferrer and target=_blank (Issue: 24447).
[r29848] Video/audio tags now support data:// protocol (Issue: 24357).

Mac

[r29121] Show "Loading" bubble while loading a theme. (Issue: 22219).
[r29229, r29270, r29396, r29458, r29660, r29877, r30045, r30209] Various keyboard handling fixes (Issues: 24817, 25000, 24921, 25396, 25330, 25254).
[r30032] Do not send some keyboard shortcuts to the renderers; e.g. cmd-w, cmd-t, ctrl-tab (Issues: 24877, 5496, 15090).
[r29812] "Copy image" now works (Issue: 13099).
[r30016] Cmd-clicking back button now opens history page in new background tab (Issue: 25319).
[r30100] If auto-update happens, About box now says "update is available" and "restart needed for latest version" (Issue: 13165).
[r30547] Form resubmission warning dialog implemented (Issue: 23526).
[r30189, r30190] Use Helvetica rather than Arial for several things (Issue: 21458).

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Orit Mazor

Google Chrome Technical Program Manager

Beta Channel Updated to 4.0 with Bookmark Sync

2009-11-02T15:02:00.000-08:00

Version: 4.0.223.16 (Windows Only)

The Beta Channel is being updated to 4.0.223.16 which is our first Beta release for 4.0. This release includes many bug fixes and for the first time Bookmark Sync is enabled. Extensions are disabled until the final API changes arrive. Please use the dev channel for the latest extension API.

More details about the changes since 4.0.223.11 are available in the svn log of all revisions.

You can join the Beta channel here: http://www.google.com/chrome/eula.html?extra=betachannel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Dev Channel Updated with Crash and Calendar Fix

2009-10-23T15:35:00.000-07:00

Version: 4.0.223.11

This release fixes a crash when running extensions like the Subscribe in Feed Reader sample. It also fixes a problem in Google Calendar where overlapping calendar items were invisible because they were being displayed with 0 width. This update is being released for Windows, Mac and Linux.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Dev Channel Updated with Fixes and Extension Changes

2009-10-22T09:35:00.000-07:00

This week Printing and the Quicktime plugin make their initial appearance on Chrome for Mac. Lots of important Extensions changes and quite a few bugs are also fixed.

Be sure to read the Known Issues if you are running Chrome for Mac.

All Platforms:

CSS rounded corners are now antialiased on Windows and Linux. (They were already on Mac.)

Mac:

Printing now works. (Issue: 13158)
[r28871] Autoupdates no longer cause problems if Chrome is already running. (Issue: 14610)
[r29388] Hitting backspace while IME is active does no longer go back in history. (Issue: 25000)
[r28837] QuickTime plugin no longer crashes, and often displays properly (though there are still bugs to be ironed out).
[r28837] Plugin whitelist has been removed, so that Chrome will attempt to load all NPAPI plugins. Expect more plugin crashes.
[r29396] Ctrl-tab switches tabs again. (Issue: 24921)
[r29458] Cmd-` switches windows again. (Issue: 24817)

Linux:

Minor visual polish (e.g. horizontal scrollbars show the proper grippy, omnibox highlighting fix).
[r28834] Create application shortcuts now works on Fedora 11. (Issue: 22966)
[r28869] Browser actions (extension buttons in toolbar) partly implemented. (Issue: 23882)
[r29102] Omnibox auto-complete popup stacks properly below SCIM IME candidate window. (Issue: 19082)
[r29261] Ctrl+F etc. no longer type other letters into edit boxes in non-English keyboard setups. (Issues: 10846, 2215, 21471)

Chrome Frame:

Fixes persistent IE 8 crashes. (Issue: 22768)

Fixed crashes when navigating with Web Inspector open. (Issue: 22993)

Fixes spurious errors when re-installing Chrome Frame. (Issue: 23444)

Fixes a crash in comctl32.dll, triggered by Google Wave. (Issue: 24115)

Fixes empty referrer issue for initial link navigations. (Issue: 22994)

Preview support for accessibility via MSAA, including ARIA role and state information. (Issues 23669, others)

Improved keyboard and accelerator handling.

IE text-size menu items now change text size in Chrome Frame.

Navigating to a site marked as restricted is now disabled in Chrome Frame. Chrome frame now updates the zone UI on the task bar.

Chrome Frame will now work for all other users on the machine, not just the user who installs it. (Issue: 23989)

Fixes for SSL certificate error issue.

Disables sending 'chromeframe' in the User-Agent if the Chrome Frame addon is disabled. (Issue: 22760)

Disables the 'Chrome has crashed - Restart?' message box.

Limited support for JavaScript history object for back/forward from content.

Extensions:

[r29068] *Breaking Change* Finalize browser actions API (Issue: 23879)
[r29284] *Breaking Change* Only one browser action or one page actions is now allowed per-extension. We are experimenting with the idea of a direct correspondence between extensions and visible UI features. We think this may improve managability. (Issue: 24473)
[r29335] Update page actions API to improve usability. Old API still supported. (Issue: 24635)
[r29495] Browser actions and page actions: Add chrome.browserAction.setIcon({path:...}). No longer need to prespecify images in manifest. (Issue: 22575)
[r29297] Add an options_page to the manifest. (Issue: 23801)
[r29365] You can now use (slightly) bigger icons in browser actions and page actions. Up to 19px square are now allowed (up from 16px). (Issue: 24881)
[r29046] Fix extension canceling. (Issue: 23405)
[r29143] Browser action button disappears when loading a new extension. (Issue: 23593)

Known issues:

Mac: If an older version of Chrome is running when this version is automatically installed the running version will not quit cleanly and will spike the CPU at 100%. It will be necessary to Force Quit the application. Use Cmd-Option-Escape to open the Force Quit dialog.
Mac: Cmd-opt-left/right navigate history instead of switching tabs (Issue:25396). Use cmd-{/} as workaround.
Linux: Some fonts may look blurry or extra bold. (Issue: 25365)

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Dev Channel Updated with Fixes

2009-10-15T14:08:00.000-07:00

Version 4.0.222.12

Windows release corresponding to the 4.0.222.5 releases for Mac and Linux.

Jon Conradt
Engineering Program Manager

Dev Channel updated with Bug Fixes

2009-10-15T10:13:00.000-07:00

Version: 4.0.222.5

This week's dev channel update includes quite a few bug fixes. The Windows release will arrive shortly.

Mac OS X:

[r28121] Fix bookmark bar resize issues. (Issue: 23949)
[r28145] Support OS X's url handlers. (Issue: 15546)
[r28260, r28600] Make content area a drop target for dragging images, etc. (Issues: 23517, 19529)
[r28453] Enable "Edit Search Engines" in Omnibox context menu. (Issues: 22512, 22648)
[r28505, r28528] Make cmd-left/right and backspace/shift-backspace navigate history if the focus is not in a text box. (Issue: 12557)
[r28613] Fix a ton of theming bugs. (Issues: 22213, 20295, 18547, 19851, 23651, 24338, 18438)
[r28749] Status bubble now fades in and out after a delay. (Issue: 24495)
[ r 28709 ] Key equivalents sent to renderer: Cmd-s etc. should now work on e.g. google docs. (Issue: 15090)
[ r28813 ] Chrome's and Safari's ideas of "default browser" now agree. (Issue: 24401)

Linux:

Various crash and visual glitch fixes.

Extensions

[r28095] Extensions loaded "Load unpacked extension" (and --load-extension) will no longer change id's when they're reloaded (Issue: 21281)
Browser Actions (windows only at the moment)

[r28130, r28136] Can now set an image dynamically with an ImageData from a canvas. (Issue:23269)
[r28115] Can close popups using window.close. (Issue: 23832)
[r28187] Popups now have a bubble border. (Issue: 23833)
some sample extensions converted to use browser actions. (gmail checker, buildbot, mappy)
a number of other misc bug fixes.

[r28135] Extension packing now works on Linux and Mac. (Issue: 20669)

Known Issues:

[Mac] Trackpad scroll events are passed to windows behind the chrome window.
[Mac] Cmd-` doesn't work when tab contents are focused.
[Mac] Chrome for Mac thinks its name is Google Chrome Helper. (Issue: 24776)
[Mac] Cannot "edit" or "add" bookmarks via bookmark contextual menu. (Issue: 24828)

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Beta/Stable Channel Update

2009-10-12T16:02:00.000-07:00

Both the beta and stable channel have been updated to 3.0.195.27 and contain the following fixes:

Fixed an issue where menu items for certain Indian languages were not properly visible. (Issue: 18042)
Add support to blacklist the faux www.paypal.com certificate. (Issue:24038)
Added NTLMv2 support on Windows. (Issue: 14206)
FFmpeg files now properly have NX/DBCompat enabled. (Issue: 23189 - Will be made public once this release is fully deployed)
V8 crash fix. (Issue: 22913)

Anthony Laforge

Google Chrome Program Manager

Dev Channel Update

2009-10-07T10:32:00.000-07:00

The Dev channel has been updated to 4.0.221.6 for Windows and 4.0.221.8 for Mac and Linux.

Theme change should automatically update New Tab Page background again. [r27841] (Issue: 20392)

No longer crash when selecting closed window from Dock menu. [r27769] (Issue: 14003)
Fix several issues with dragging tabs and quickly letting go. [r27861] (Issues: 22266, 13594, 22538)
Fixes for full screen plugins: keystrokes are now sent to full screen plugins and the Menu Bar is properly hidden. [r27755] (Issues: 19534, 21020)

Linux

Work around the sudden creation of a tree of directories in your homedir after an update. [r27997] (Issue: 23327)
Tab titles in Thai locales are no longer chopped. [r27725] (Issue: 22791)

Extensions

More features for browser actions (still in progress, still Windows-only)

badges [r27951] (Issue: 23268)
popups [r27889] (Issue: 23596)

Fix bug on Linux where directory cruft was accidentally created. (Issue: 23327)

Known Issues

Linux: Google Chrome fails to collect zombie processes from closed tabs. (Issue: 23778)
Mac: Bookmark bar looks weird, and hurts you when you resize the window (hit cmd-shift-b twice after window resizing as workaround).

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Anthony Laforge

Google Chrome Program Manager

Beta and Stable Channel Update

2009-10-05T13:24:00.000-07:00

The beta and stable channels have been updated to 195.25. This release includes only a single change that adds an image link to the new tab page which directs new users to the themes gallery.

Anthony Laforge
Google Chrome Program Manager

Dev Channel Updated with Fixes

2009-10-02T12:15:00.000-07:00

Version: 4.0.220.1

This week's dev channel update includes a number of fixes. It introduces the Native Client as a built-in feature for the first time on Windows. Some additional Extensions APIs also make their first appearance.

All Platforms

[r27300] Remove "Remove Item" from download item context menu. (Issue: 23078)

[r26976] Omnibox now understands Zeroconf .local hosts. (Issue: 19957)

Windows

[r27445] Native Client is now built into the renderer but disabled by default. For info on how to enable please see this page.

Mac

[r27015] cmd-f, cmd-g, cmd-e now use the system-wide find pasteboard. (Issue: 14562)

[r27464] cmd-up/cmd-down now work correctly. (Issue: 22585)

[r27378] Sheets should be positioned between the content and everything above it, no matter if they are window- or tab-modal. (Issue: 17615)

[r27185] Download item name no longer displayed in white in Incognito window. (Issue: 22664)

[r27405] about:ipc page enabled. (Issue: 22664)

[r27064] Omnibox now draws red bar over "https" for bad site certificates. (Issue: 22558)

[r27127] Typing option-return in the Omnibox now opens a new foreground tab. (Issue 22822)

Linux

[r27368] Extension shelf now obeys GTK theme. (Issue 23031)

[r27041] "Other bookmarks" link no longer chopped off non-English locales. (Issue 22788)

[r27194], [r27422] App shortcuts now work and use proper icon. (Issue 22589, 22528)

Extensions

[r27599] Extensions menu item now in 'wrench' menu. (Issue 22883)

[r27319] Introduce Browser Actions. (Issue 22099 and others) (still a work in progress)

[r27163] Implemented extension packing on Linux.

[r27290] Toolstrip dragging now restricted to extension shelf.

[r27262] Themes and extensions now install if you have "ask for destination" option set in download options.

[r27376] Content scripts can now see their own functions in setTimeout.

[r27440] Fix crash when using non-extension iframe.

[r27393] Some initial i18n API (still a work in progress). (Issue: 12131)

More details about additional changes are available in the svn log of all revisions.

Jonathan Conradt

Engineering Program Manager

Stable Channel Update

2009-09-30T14:01:00.000-07:00

3.0.195.24 has been promoted to the stable channel. There are no additional fixes or changes in this release.

Security Fixes:

CVE-2009-0689 dtoa() error parsing long floating point numbers

The v8 engine uses a common dtoa() implementation to parse strings into floating point numbers. We have applied a patch to fix a recent bug in this component.

Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.

Credit: Original discovery by Maksymilian Arciemowicz of SecurityReason. The Google Chrome security team determined that Chrome was affected.

Mitigations:

A victim would need to visit a page under an attacker's control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.

Beta Channel Update

2009-09-28T17:10:00.000-07:00

The beta channel has been updated to 3.0.195.24.

This update contains the following:

A fix to two significant history related crashing bugs 16591 and 21377.
A fix where PAC scripts would fail to parse if they ended with a comment and no new line 22864.
Corrected an issue where tabs would flash,for a split second, if multiple tabs were opened at the same time 20831.
Fixed an issue which prevented proper logins to CNET 22181.

Anthony Laforge

Google Chrome Program Manager

Dev Channel Updated: Bug fixes

2009-09-24T16:57:00.000-07:00

Version: 4.0.212.1 for Macintosh and 4.0.213.1 for Windows and Linux.

All Platforms

[r26815] New-FTP: Requires re-authentication when navigating around. (Issue: 21184)
[r26860] [DEPS] Move FTP LIST parsing code to the renderer process, limiting potential damage from security issues.

Windows

Issues with drop down select boxes fixed.
[r26359] BiDi-language filenames now displayed correctly in download shelf. (Issue: 10860)

Mac

Extension shelf (that weird gray box at the bottom) is only displayed if you have extensions installed.
[r26495] Add Command-0..8 shortcuts to "select Nth tab" and Command-9 to "select last tab".
[r26694] Basic emacs key bindings in text fields should work. (e.g., ctrl-e, ctrl-a, ctrl-d) (Issue: 12538)
[r26603] Paste-and-Go for Mac omnibox, cleaned up omnibox context menu. (Issues: 13021, 10937)
[r26471] Form controls now draw correctly in 10.6. (Issue: 19604)
[r26646] Search Engine Manager UI improved.
[r26567] Find bar now animates open and close.
[r26527] Pressing Up/Down arrows in find bar now scrolls page.
[r26853] Empty bookmark bar should show IDS_BOOKMARKS_NO_ITEMS. (Issue: 17360)
[r26792] Add favicons to items in folders on the bookmark bar. (Issue: 22601)

Linux

Issues with drop down select boxes fixed.
[r26590] "Create application shortcuts" doing nothing: More reliably find the .desktop file for the browser. (Issue: 21995)
[r26647] Implement GetCPUUsage() so the task manager shows CPU. (Issue: 19864)
[r26891] Added download in progress dialog. (Issue: 21652)

Extensions

[r26526] Fix crashy toolstrips. (Issues: 22070, 22135)
[r26532] Audio and video tag doesn't work for extension resources. (Issue 22152)
[r26685] Fix an issue where we do not initiate the extension install UI with certain combinations of HTTP headers.
[r26556] Introduce chrome.tabs.executeScriptInTab() and chrome.tabs.insertCSSInTab(). (Issue: 12465)
[r26706] Hide the mole handle by default. (Issue: 15494)
[r26658] Remove the right-click devtools behavior. (Issue: 20634)
[r26654] Add CSS classes to the document when switching between toolstrip and mole mode.
--show-extensions-on-top works pretty well now (on windows). Try it out!

Sync

Sync library now built entirely from trunk.

Known Issues

(Issue 22585) - CMD+Down, CMD+Up no longer scrolling to top/bottom of page on Mac.
One machine in our QA group is seeing blank pages on Facebook. (Issue 22978)

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Dev Channel Update

2009-09-18T15:13:00.000-07:00

UPDATE: 2009-09-22 - 4.0.211.7 is being pushed to Windows. It contains 2 fixes, the first resolves the issue which prevented large downloads and the second is a stability fix which should resolve a number of crashes (bug 22135). Thank you for you again for your patience.

UPDATE: 2009-09-19 - 4.0.211.4 is being pushed to Windows and resolves this issues with bookmark synchronization. Thank you for your patience.

UPDATE: THIS RELEASE HAS BEEN HALTED DUE TO A CRASHING ERROR WITH --enable-sync.

This week's changes for the dev channel, 4.0.211.2, is being released to all platforms.

All

Fixed a bug that prevented some Dailymotion videos from playing. [r25220]

Bug fixes in NewFTP. [r25624][r25729][r25750][r25771]

Improved New Tab page load performance. [r25232]

Win

Ensure that tips change when the Chrome language changes. [r25834]

Mac

Import from Firefox no longer hangs. [r25174]

Added SSL icons. [r26307]

Implement the search engine manager. [r26078]

Allow windows with a single tab to be merged into other windows with drag and drop.

Allow Snow Leopard systems to connect to certain IPv6-enabled web sites when only IPv4 is available. [r26051]

Prevent a sad tab when loading certain images on Snow Leopard. [r26089]

Don't show "Google Chrome did not shut down properly" when quit from the Dock, logout, restart, or shut down. [r26269]

Linux:

Make the bookmark toolbar folders act like a menu bar. [r25677]

Bookmark bar shows a menu on too many bookmarks. [r25200]

Implement external protocol handler dialog (e.g. for aim: URLs).[r25373]

Extensions can register page actions. [r25934]

Fix a crash when closing tabs that have open login prompts. [r26066]

Work around a Flash crash that mostly affects Gentoo users. [r26265]

Extensions

Enable/disable extension button on chrome://extensions

Update extensions now button to force autoupdate check on chrome://extensions

chrome.window and chrome.tab APIs can now reference relative URLs inside an extension

Known issues:

All

Large files do not download completely - bug 406

Linux:

Cannot be set as the default browser in GNOME (Already fixed by [r26314, r26316]).

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Anthony Laforge

Google Chrome Program Manage

Stable Channel Update

2009-09-15T09:59:00.000-07:00

3.0.195.21 has graduated from Beta to the Stable channel today.

This release includes themes support, a brand new New Tab page, an updated omnibox, support for audio and video tags, and a higher performing V8 engine.

You can read more about it here.

Anthony Laforge

Google Chrome Program Manager

Security Fixes:

We would like to extend special thanks to Will Dormann of CERT for working with us to improve the security of the new audio and video codecs in this release.

CVE-2009-XXXX Content-Type: application/rss+xml being rendered as active content

Previously, we rendered RSS and Atom feeds as XML. Because most other browsers render these documents with dedicated feed previewers, some web sites do not sanitize their feeds for active content, such as
JavaScript. In these cases, an attacker might be able to inject JavaScript into a target web site.

More info: http://code.google.com/p/chromium/issues/detail?id=21238
(This issue will be made public once a majority of users are up to date with the fix.)

Severity: Medium. Most web sites are not affected because they do not include untrusted content in RSS or Atom feeds.

Credit: Inferno of SecureThoughts.com

Mitigations:

A victim would need to visit a page under an attacker's control.
The target web site would need to let the attacker inject JavaScript into an RSS or an Atom feed.

CVE-2009-XXXX Same Origin Policy Bypass via getSVGDocument() method

The getSVGDocument method was lacking an access check, resulting in a cross-origin JavaScript capability leak. A malicious web site operator could use the leaked capability to inject JavaScript into a target web site hosting an SVG document, bypassing the same-origin policy.

More info: http://code.google.com/p/chromium/issues/detail?id=21338
(This issue will be made public once a majority of users are up to date with the fix.)

Severity: High

Credit: Isaac Dawson

Mitigations:

A victim would need to visit a page under an attacker's control.
The target web site would need to host an SVG document.

Beta Channel Update

2009-09-14T13:02:00.000-07:00

The Windows Beta channel has been updated to 3.0.195.21.

This release includes some minor fixes:

A fix for issue 3380 which caused the browser to lose focus in certain conditions after installing a theme.
Fix About box truncation in some locales when a new version is available.

You can install the current Beta channel release from http://www.google.com/intl/en/landing/chrome/beta/.

Anthony Laforge
Google Chrome Program Manager

Beta Update

2009-09-11T15:04:00.000-07:00

The Windows Beta channel has been updated to 3.0.195.20.

This release includes better international support and stability/bug fixes for the New Tab page and themes support.

You can install the current Beta channel release from http://www.google.com/intl/en/landing/chrome/beta/.

Anthony Laforge
Google Chrome Program Manager

Dev Channel Update: Bug fixes for Mac and Linux

2009-09-10T15:33:00.000-07:00

This week's changes for the dev channel focus on bug fixes as well as a new defense for cross-site scripting attacks.

Version: 4.0.207.0 for Mac and Linux.

All:

Reflective XSS filter for better security against a common attack. See the mailing list post for more information.
Fixed extraneous horizontal scrollbars in Gmail (Issue: 7976)

Mac:

[r25560], [r25475], [r25478] Tweaks to the Omnibox look.
[r25182] Fix zoom (green maximize) button. (Issue: 17472)
[r25380] Adjust color spaces so that Mac Chrome renders colors properly. (Issues: 20552, 19951)
[r25167] Don't show favicons or throbbers for the New Tab page on the Mac. (Issues: 13337, 20378)
Uploading images with "Hide extension" set does now work. (Issue: 20857)

Linux:

[r25373] Add external protocol dialog for Linux. (Issue: 20731)
[r25100] Handle external protocols, e.g. mailto: links. (Issue: 20696)
[r25125] Fix crash when switching to a tab containing audio/video elements. (Issues: 20138, 19677)

Extensions:

[r25293] Added an auto-update now button to chrome://extensions page. (Issue: 17853)
[r25253] Fix crash on Mac when pressing "load unpacked extension" in chrome://extensions page. (Issue: 20860)

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Beta Channel Update

2009-09-08T16:33:00.000-07:00

The Windows Beta channel has been updated to 3.0.195.17.

More stability/ bug fixes pertaining to the New Tab page, the omnibox, video tag, and themes support.

You can install the current Beta channel release from http://www.google.com/intl/en/landing/chrome/beta/.

Anthony Laforge
Google Chrome Program Manager

Dev Channel Updated with fixes and extension changes

2009-09-04T13:01:00.000-07:00

The dev channels have been updated to 4.0.206.1.

All Platforms

[r24663] Closing the download shelf removes all completed and cancelled downloads from it. (Issue: 15712)
[r24331] Fixes various audio/video events which were not firing. (Issues: 20152, 16768)
[r24519] Saved passwords for proxy servers are now correctly labeled. (Issue: 12992)
[r24384] Add single line of tips to New New Tab Page. (Issue: 19162)

[r24241] HTTP Auth dialog autofills passwords.
New Tab Page displays much faster. (Issue 13337)
[r23722, r 23955] Improved scrolling and display performance, particularly on machines without powerful graphics hardware (such as laptops)
[r24621] Plugins starting offscreen will draw correctly when they scroll into view (Issue 20234)

Linux

[r24241] HTTP Auth dialog autofills passwords.
[r24558] Fix the find bar so the match count is inside the entry. (Issue: 17962)
[r24831] Now respects both GNOME and KDE proxy settings. (Issue: 17363)
[r24930] Implemented "Confirm form resubmission" dialog. (Issue: 19761)
[r24454] Don't paste primary selection when middle clicking scrollbars. (Issue: 16400)
[r24287] Fix inability to select Times New Roman in font options with some versions of Pango. (Issue: 19823)
[r24903, r25007] Fixed tab dragging on 64-bit. (Issue: 20513)
[r25039] Fixed 64-bit JavaScript crash on some CPUs. (Issue: 20789)

Extensions

Two breaking changes (see mailing list post for more information):

[r24816] Enforce granular permissions
[r24770] Modified several APIs to be more consistent

[r24539] Polish the look of Linux extension shelf. (Issue: 16759)
[r24599] Polish extension install UI.
[r24864] Allow extension toolstrip to detach. (ctrl+alt+b)
[r24871, r24877] Polish chrome://extensions/ page. Add convenience developer tools to load an extension and pack an extension.

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Dev Channel Update: Updates for Snow Leopard

2009-08-31T15:23:00.000-07:00

The dev channel has been updated with a new release for Mac OS X. This release includes bug fixes and some improved compatibility with Snow Leopard. This release is only slightly different than the 4.0.203.2 release so please refer to that release for more information.

Version: 4.0.203.4

Changes specific to Mac OS X:

[r23636, r23693] Add modifier key support (e.g. cmd-clicking, shift-clicking) throughout the Mac UI. (Issues: 17301, 17912)
[r23667] Sometimes cmd-w wouldn't close the last tab in a window. (Issue: 19447)
[r23702] Korean IME didn't work in the Omnibox. (Issue: 19421)
[r23715, r23733, r23740, r23821, r24213] Improve appearance of various UI components. (Issue: 14898, 18902, 19115, 19943)
[r23741, r24006] Favicon lost in various circumstances. (Issue: 18352, 18359)
[r23886] Add bubble when user clicks the star button. (Issue: 14929)
[r23964] Implement tab-to-search. (Issues: 10943, 10944, 12285)
[r23975, r24209, r24234] Crash fixes. (Issue: 19837, 19958, 19728)
[r24030] Text could appear garbled on 10.6. (Issue: 11269)

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Dev Channel Update: Linux true 64 bit, Crash and Bug Fixes

2009-08-28T16:39:00.000-07:00

The dev channels for Windows and Linux have been updated to 4.0.203.2.

All Platforms

[r23666, r23790, r23988] Fix some hangs/crashes. (Issue: 16512, 16871, 18217, 18521, 19710, 19860)

[r23668] Fix hang with video and audio tags. (Issue: 19276)

[r23670] When SafeBrowsing alerts for a page, don't allow that page to redirect until after the user has dealt with the alert. (Issue: 6442)

[r23754, r23937] Prevent time/slider from jumping around during and after seeking in video and audio tag content. (Issue: 19396)

[r23859] Reduce Omnibox flicker. (Issue: 18369)

[r23965] Unicode text could sometimes produce garbled Omnibox dropdown entries. (Issue: 5490)

[r23967] Fix problems with plugin z-order. (Issue: 15840)

[r24033] Fix a crash on Windows and Linux. (Issue: 17569)

[r24151] Fix regression (since Chrome 2.0.172.1) where some gzipped files (e.g. script) were not unzipped before evaluation, making them unusable. (Issue: 16430)

[r24170] Faster startup with custom themes. (Issue: 18768)

[r24179] Graphical errors with some themes. (Issue: 20139)

[r24189] Problems with video/audio tag playback and looping at rates other than 1.0. (Issues: 19856, 19105)

[r24192] Properly align cursors used for middle-mouse-autoscroll with the original click location. (Issue: 6173)

Windows

[r23915] During uninstall, if Chrome was the default browser, prompt user to choose a new default. (Issue: 14023)

[r23849] Fix clicking/noise when playing video/audio tag content with 48 or 96 kHz audio. (Issue: 17940)

[r24198] Remove "Clear browsing data" and "Import bookmarks & settings" from Tools menu since they are now available in the Options. (Issue: 20137)

Linux

Chrome for Linux is now truly 64 bit.

[r23696, r23737, r23768, r23815, r23846, r23930, r23944, r24034, r24040, r24191, r24207] Crash fixes. (Issues: 10911, 17549, 18686, 18866, 18907, 18957, 19552, 19670, 19788, 19915, 19971, 19994)

[r23828] Make inactive titlebar legible. (Issue: 18856)

[r23834] Ctrl-C does nothing in Omnibox. (Issue: 19648)

[r23760] Default to not using custom frame under Fluxbox. (Issue: 19130)

[r23757, r23827, r23998, r24010] Add some missing pieces of UI. (Issue: 11507, 13524, 17251, 19290)

[r23879, r24001] Fix small graphical issues with the find bar. (Issue: 19726, 19811)

[r23899, r24149] Fix issues with tab titles and their tooltips. (Issue: 19741, 19754)

[r24210] Cookie manager polish. (Issue: 17919)

[r24000] Allow users to delete entries from autocomplete suggestion lists. (Issue: 19664)

Extensions

[r23675] Fix some issues around re-enabling disabled extensions. (Issue: 12140)

[r23676] Async extension callbacks now always fire and set chrome.extension.lastError on error. (Issue: 17381)

[r23739] Beginnings of localization support. (Issue: 12131)

[r24223] Unconditionally enable HTML5 Database and Local Storage support for chrome-extension:// pages. (Issue: 19511)

[r24231] Crash fix. (Issue: 15888)

Known Issues

WebInspector's Elements Panel is blank for some sites. (Issue: 19850)

Control key misbehaves in omnibox on Linux (Issue: 20166)

Chrome for Linux not fully themed with GTK+ theming.

Moving a tab in Chrome 64 bit for Linux always detaches the tab. (Issue 20513)

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Beta Channel Update

2009-08-27T17:26:00.000-07:00

The Windows Beta channel has been updated to 3.0.195.10.

In addition to stability fixes, this release contains updates for the New Tab page, the omnibox, and themes support.

You can install the current Beta channel release from http://www.google.com/intl/en/landing/chrome/beta/.

Known Issues:

There is a known issue, 20452, that the themes gallery does not recognize the new version of Google Chrome. This issue is purely aesthetic and does not affect a user's ability to install themes from the gallery.

Anthony Laforge
Google Chrome Program Manager