Previous release notes

 

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

↑ back to top  

Chrome browser updates	Security/ Privacy	User productivity/ Apps	Management
Tab compare		✓
Chrome no longer support macOS 10.15	✓		✓
Ad-hoc code signatures for PWA shims on macOS		✓
Certificate Manager on Windows and macOS	✓
Chrome Security Insights	✓		✓
Deprecate Safe Browsing Extended reporting	✓
Inactive tabs on Android		✓
New option in HttpsOnlyMode policy	✓		✓
Screenshot protections	✓
Sync tab group		✓
Google Play Services fixes issues with on-device passwords			✓
Deprecate the includeShadowRoots argument on DOMParser	✓
Deprecation of non-standard declarative shadow DOM serialization	✓
Rename inset-area to position-area	✓
Clear local device data on sign out on iOS	✓
Toolbar customization		✓
Google Password Manager Passkey usage on ChromeOS		✓
New and updated policies in Chrome browser			✓
ChromeOS updates	Security/ Privacy	User productivity/ Apps	Management
Chrome Enterprise Premium for file transfers on Managed Guest Sessions	✓
Educators Appreciation wallpaper		✓
Display brightness controls		✓
Peripheral Welcome experience		✓
Managed accounts no longer synced as secondary accounts on Android	✓		✓
Live Translate		✓
Keyboard brightness controls		✓
Keyboard shortcut for Select-to-Speak		✓
PIN as an authentication factor	✓
Automatic reload of sign-in screen	✓
CSE Workspace file types now supported in Google Drive			✓
Battery Icon updates		✓
Admin console updates	Security/ Privacy	User productivity/ Apps	Management
Extension Risk Score on the Apps and Extensions Usage report			✓
Upcoming Chrome browser changes	Security/ Privacy	User productivity/ Apps	Management
Entrust certificate distrust	✓
Fallback styles for <meter> element	✓
Compression dictionary transport with Shared Brotli and Shared Zstandard	✓
Keyboard-focusable scroll containers		✓
Support non-special scheme URLs	✓
Simplified sign-in and sync experience		✓
Chrome extension telemetry integration with SecOps	✓		✓
User Link capturing on PWAs		✓	✓
Chrome Third-Party Cookie Deprecation (3PCD)	✓
Insecure form warnings on iOS	✓
Remove policy used for legacy same site behavior			✓
X25519Kyber768 key encapsulation for TLS	✓
UI Automation accessibility framework provider on Windows		✓
Upcoming ChromeOS changes	Security/ Privacy	User productivity/ Apps	Management
Generative AI wallpapers and video conference backgrounds	✓
ChromeOS XDR window events	✓
Upcoming Admin console changes	Security/ Privacy	User productivity/ Apps	Management
Chrome browser managed profile reporting			✓
Default change for GenAI policies		✓
GenAI control policy		✓
Support for user-level settings on the Custom configurations page			✓

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.

Chrome Enterprise and Education release notes are published in line with the Chrome release schedule, on the Early Stable date for Chrome browser.

Chrome browser updates

   

• Tab compare 

  Starting in Chrome 129 (US-only), we introduce Tab compare, a new feature that presents an AI-generated overview of products from across multiple tabs, all in one place. This feature is controlled through the TabCompareSettings policy. For more details, see our Tab compare article in the Chrome Enterprise and Education help center.

  • Chrome 129 on Linux, macOS, Windows 
   

   

• Chrome no longer supports macOS 10.15 

  Chrome 129 no longer supports macOS 10.15, which is already outside of its support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security. If run on macOS 10.15, Chrome continues to show an infobar that reminds users that Chrome 129 no longer supports macOS 10.15.

  • Chrome 129 on macOS: Chrome no longer supports macOS 10.15
   

   

• Ad-hoc code signatures for PWA shims on macOS 

  Code signatures for application shims that are created when installing a Progressive Web App (PWA) on macOS are changing to use ad-hoc code signatures, which are created when the application is installed. The code signature is used by macOS as part of the application's identity. These ad-hoc signatures will result in each PWA shim having a unique identity to macOS; currently every PWA looks like the same application to macOS.

  This addresses problems when attempting to include multiple PWAs in the macOS Open at Login preference pane, and permits future improvements for handling user notifications within PWAs on macOS. 

  • Chrome 129 on macOS
   

   

• Certificate Manager on Windows and macOS 

  As early as Chrome 129, there is a new certificate management settings screen accessible from security settings on Windows and macOS. This replaces the link to Windows cert manager and macOS keychain, respectively, although these operating system surfaces are still accessible from the certificate management settings page.

  The certificate manager displays certificates that are trusted or distrusted by Chrome, including the contents of the Chrome Root Store, and any certificates that have been imported from the underlying operating system. Users can access the page directly by navigating to chrome://certificate-manager.

  A future release will introduce user and enterprise management of certificates added directly to Chrome.

  • Chrome 129 on macOS, Windows
   

   

• Chrome Security Insights 

  You can now enable Chrome Security Insights, which allows you to monitor insider risk and data loss enhanced monitoring for Chrome activity if you have Chrome Enterprise Core and Workspace Enterprise Standard or Workspace Enterprise Plus with assigned licenses. For more information, see Monitoring for insider risk and data loss.

  • Chrome 125 on ChromeOS, Linux, macOS, Windows: Feature enabled for Chrome Enterprise Core 
  • Chrome 129 on ChromeOS, Linux, macOS, Windows: Feature enabled for EDU customers (except K-12)
   

   

• Deprecate Safe Browsing Extended reporting 

  Safe Browsing Extended reporting is a feature that enhances the security of all users by collecting telemetry information from participating users that is used for Google Safe Browsing protections. The data collected includes URLs of visited web pages, limited system information, and some page content. However, this feature is now superseded by Enhanced protection mode. We suggest users switch to Enhanced protection to continue providing security for all users in addition to enabling the strongest security available in Chrome. For more information, see Safe Browsing protection levels. 

     
  • Chrome 129 on Android, iOS, ChromeOS, Linux, macOS, Windows: Deprecation of Safe Browsing Extended Reporting — Excluding real-time Client Safe Browsing Report Request
  • Chrome 131 on Android, iOS, ChromeOS, Linux, macOS, Windows: Deprecating SafeBrowsingExtendedReportingEnabled for real-time Client Safe Browsing Report Request

   

• Inactive tabs on Android 

  In Chrome 129, old tabs will be hidden under a new Inactive Tabs section in the tab switcher on Chrome on Android. Chrome users can access the inactive tabs section to view all old tabs or close them using the new bulk tab functionality. These tabs will be deleted after being in this section for over 60 days. 

  • Chrome 129 on Android: Feature rolls out to 1%
   

   

• New option in HttpsOnlyMode policy 

  Ask Before HTTP (ABH), formerly named HTTPS Only/First Modes, is a setting that tells Chrome to ask for user consent before sending insecure HTTP content over the wire. The HttpsOnlyMode policy allows force-enabling, or force-disabling, ABH.

  In Chrome 129, we are adding a new middle-ground variant of ABH called balanced mode. This variant aims to reduce user inconvenience by working like (strict) ABH most of the time, but not asking when Chrome knows that an HTTPS connection isn't possible, such as when connecting to a single-label hostname like internal/.

  We are adding a force_balanced_enabled policy option to allow force-enabling this new variant. Setting force_balanced_enabled on browsers before Chrome 129 will result in the default behavior, which places no enterprise restrictions on the ABH setting.

  To avoid unexpected impact, if you have previously set force_enabled, we recommend not setting force_balanced_enabled until your entire fleet has upgraded to Chrome 129 or higher. If you are not migrating from force_enabled to force_balanced_enabled, you will be unaffected by this change.

  • Chrome 129 on Android, ChromeOS, LaCrOS, Linux, macOS, Windows, Fuchsia
   

   

• Screenshot protections 

  Screenshot protections allow Admins to prevent users from taking screenshots or screen sharing specific web pages considered to contain sensitive data. This feature is available to Chrome Enterprise Premium users only. This feature can be controlled via the same EnterpriseRealTimeUrlCheckMode Chrome Enterprise policy that enables all real-time URL lookups.

  • Chrome 129 on ChromeOS, Linux, macOS, Windows
   

   

• Sync tab group 

  The tab groups on iOS are now saved. Closing a tab group no longer deletes it. For users syncing their tabs across devices, the groups also sync.

   
  • Chrome 129 on iOS
   

   

• Google Play Services fixes issues with on-device passwords  

  Users with old versions of Google Play Services (<24w02) experience reduced functionality with their on-device passwords, and Password Manager might soon stop working for them altogether. These users need to update Play Services, otherwise they will be guided through other troubleshooting methods depending on their state. This is part of an ongoing migration that only affects Android users of Password Manager.

  • Chrome 129 on Android
   

   

• Deprecate the includeShadowRoots argument on DOMParser 

  The includeShadowRoots argument was a never-standardized argument to the DOMParser.parseFromString() function, which was there to allow imperative parsing of HTML content that contains declarative shadow DOM. This was shipped in Chrome 90 as part of the initial shipment of declarative shadow DOM. Since the standards discussion rematerialized in 2023, the shape of DSD APIs changed, including this feature for imperative parsing. To read more, see details of the context on the related standards, and information is also available on the related deprecations of shadow DOM serialization and shadow root attribute.
  Now that a standardized version of this API, in the form of setHTMLUnsafe() and parseHTMLUnsafe() shipped in Chrome 124, the non-standard includeShadowRoots argument needs to be deprecated and removed. All usage should shift accordingly:
  Instead of:
    (new DOMParser()).parseFromString(html,'text/html',{includeShadowRoots: true});
  This can be used instead:
    document.parseHTMLUnsafe(html);

  • Chrome 129 on Linux, macOS, Windows, Android
   

   

• Deprecation of non-standard declarative shadow DOM serialization 

  The prototype implementation, which was shipped in 2020 and then updated in 2023, contained a method called `getInnerHTML()` that could be used to serialize DOM trees containing shadow roots. That part of the prototype was not standardized with the rest of the declarative shadow DOM, and has only recently reached spec consensus (for details, see Github). As part of that consensus, the shape of the getInnerHTML API changed.

  This feature represents the deprecation of the previously shipped `getInnerHTML()` method. The replacement is called `getHTML()`, which shipped in Chrome 125. For details, see this ChromeStatus feature description.

   
  • Chrome 129 on Windows, macOS, Linux, Android
   

   

• Rename inset-area to position-area 

  The CSS working group (CSSWG) resolved to rename this property from `inset-area` to `position-area`. For more details, see the CSSWG discussion in Github. Chrome will support both the old and new property names for a few milestones, to help developers migrate to the new position-area name. We are shipping the new property name, `position-area`, as a synonym for `inset-area` in Chrome 129 along with the deprecation DevTrial for `inset-area`.

  The `inset-area` property is currently planned for removal in Chrome 131.

  • Chrome 129 on Windows, macOS, Linux, Android
   

   

• Clear local device data on sign out on iOS 

  Starting in Chrome 129, signing out from a managed account in an unmanaged browser deletes local browsing data that is saved on the device. Managed users are presented a confirmation dialog on sign-out explaining that unsaved data will be cleared. Data will be cleared only from the time of sign-in, otherwise all data will be cleared; time of sign-in is only known if the user signed in on Chrome 122 or later. 

  The data that is deleted includes: 

  • browsing history
  • cookies and site data
  • passwords
  • site settings
  • autofill
  • cached images and files
   
  • Chrome 129 on iOS
   

   

• Toolbar customization 

  We are introducing a toolbar customization feature in Chrome 129, which allows desktop browser users to pin and unpin icons to their toolbar via a new side panel. 

   
  • Chrome 129 on ChromeOS, Linux, macOS, Windows: Rolls out gradually
     

   

• Google Password Manager Passkey usage on ChromeOS 

  Passkeys improve user security but until today have been slightly more difficult to use across devices. Now, users can save passkeys to Google Password Manager and use them across devices and platforms. This feature is already available on Windows, macOS, Linux and Android. It is now available on ChromeOS.

   
  • Chrome 127 on Windows, Android and macOS
  • Chrome 129 on Windows, Android, macOS and ChromeOS 

   

• New and updated policies in Chrome browser  

  Policy	Description
  TabCompareSettings	Tab Compare settings
  AdHocCodeSigningForPWAsEnabled	Ad-hoc code signing for Progressive Web App shims

 

ChromeOS updates

   

• Chrome Enterprise Premium for file transfers on Managed Guest Sessions 

  In ChromeOS 129, organizations can extend Chrome Enterprise Premium’s powerful scanning and content and context-based protection to local files on ChromeOS on Managed Guest Sessions. 

  For example, a misplaced file containing Social Security numbers is instantly blocked when a user attempts to copy it to an external drive, safeguarding this confidential information.

   

• Educators Appreciation wallpaper 

  In ChromeOS 129, we have added a new wallpaper collection to celebrate and share our gratitude and support to educators around the world.

   

• Display brightness controls 

  Chromebook users can now easily adjust display brightness and control the ambient light sensor directly from the Settings app. This new feature lets you set your screen brightness to the perfect level and turn the ambient light sensor on or off as needed in the Settings app. These updates make it simpler to use your device and help manage battery life.

   

• Peripheral Welcome experience 

  Knowing that a peripheral has been successfully connected, configuring it, and finding its companion app are critical steps in the peripheral user journey. This release aims to deliver a high-quality Welcome Experience by letting users know their peripheral is successfully connected and inviting them to configure it and make the most of it.

   

• Managed accounts no longer synced as secondary accounts on Android 

  Starting from ChromeOS version 129, we enhance the data security for Android on ChromeOS. Enterprise accounts that are added as secondary accounts in-session will no longer automatically be added to the Android on ChromeOS environment. This change does not affect consumer accounts, education accounts, or accounts that were previously added.

   

• Live Translate 

  Chromebook Plus devices are getting Live Translate which will allow a user to translate captionable content from Live Captions into a language of their choice. If an English speaking user is having a conversation with a person with whom they don't share the same language, so long as Live Captions is supported for the language of the person they're speaking with, it can be translated into English. This also works for videos as well and can be used on YouTube to Live Translate a video to English.

     

   

• Keyboard brightness controls 

  Chromebook users can now easily adjust keyboard brightness and control the ambient light sensor directly from the Settings app. This new feature lets you set your keyboard brightness to the perfect level and turn the ambient light sensor on or off as needed. These updates make it simpler to use your device and help manage battery life. Meanwhile, if the Chromebook supports RGB, the Keyboard Settings page will have a direct link to the Personalization Hub's RGB color selection options.

   

• Keyboard shortcut for Select-to-Speak 

  The Select-to-Speak keyboard shortcut (Search + s) now works when it is first pressed. You no longer need to enable it in Settings first. A dialog displays confirming that you want to turn on select to speak the first time you press the keyboard shortcut.

     

   

• PIN as an authentication factor 

  This launch enables PIN as an authentication factor in all authentication surfaces across ChromeOS.

   

• Automatic reload of sign-in screen 

  Starting from version 129, ChromeOS optimizes the support of 3P identity provider based logins. In the most common scenario, administrators show a permanent 3P identity provider login on the sign in screen. Many identity providers time out after a specific cadence, for example, 15 mins, leading to errors for the user. The new DeviceAuthenticationFlowAutoReloadInterval policy allows for a repeated refresh of 3P identity providers on the login screen, avoids timeouts, and therefore significantly increases the reliability of 3P identity provider logins.

   

• CSE Workspace file types now supported in Google Drive 

  Client side encryption (CSE) is a Google Workspace and Drive feature that allows customers and users to encrypt files with customer provided keys so that data is encrypted and never stored on our servers in the clear. This launch provides basic CSE support in the Files app on ChromeOS. This includes making CSE files visible, opening CSE files in the browser and flagging non Google Workspace CSE files as unsupported.

   

• Battery Icon updates 

  We are launching an update to the battery icon to ensure that the battery state no longer covers the battery level. Now you can easily see how much battery you have left.

 

Upcoming Admin console changes

   

• Chrome browser managed profile reporting 

  Chrome Enterprise Core will introduce new Chrome browser managed profile reporting in the Admin console. This feature will provide a new Managed profile listing and detail pages. On these pages, IT administrators will be able to find reporting information on managed profiles such as profile details, browser versions, policies applied, and more.

  • As early as Chrome 130 on Android, Linux, macOS, Windows
   

   

• Default change for GenAI policies 

  Starting with 130, we will change the default setting for GenAI policies from switched off to allowed, without improving AI models. If you have devices enrolled in Chrome Enterprise core, this policy is automatically applied to those devices to prevent sending data for AI model training. The existing policies that will have the updated default setting are:

  • CreateThemesSettings (available in the US-only for now)
  • DevToolsGenAiSettings (available in most countries)
  • HelpMeWriteSettings (available in the US-only for now)
  • HistorySearchSettings (available in the US-only for now)
  • TabOrganizerSettings (available in the US-only for now)
  • TabCompareSettings (available in the US-only for now)
   

   

• GenAI control policy 

  Starting with 130, Chrome Enterprise Core will include a policy to control the behavior of multiple GenAI policies. This will be a convenient feature, allowing Admins to control the default behavior of a set of policies in one place, for example, off by default. This policy will control the following policies:

  • CreateThemesSettings 
  • DevToolsGenAiSettings
  • HelpMeWriteSettings
  • HistorySearchSettings 
  • TabOrganizerSettings
  • TabCompareSettings
  • GenAIVcBackgroundSettings (launching in Chrome 130)
  • GenAIWallpaperSettings (launching in Chrome 130)
   

   

• Support for user-level settings on the Custom Configurations page 

  The Custom configurations page was recently launched in Chrome 127 and it allows IT admins to configure Chrome policies that are not yet in the Admin console, using JSON scripts. As early as October 1st, Custom configurations will support applying settings at the user-level, in addition to machine-level support. In other words, you will be able to enforce policies when users sign in to a managed Google account using the Custom configurations page.

   
  • As early as October 1st on Android, iOS, Linux, macOS, Windows: Feature rolls out for user policies
   

  To get started, you can find the Custom configurations in the Admin console, under Chrome browser > Reports — you will need the Chrome Enterprise Core SKU:

  

 

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming Chrome browser updates

    

• Entrust certificate distrust  

  In response to sustained compliance failures, Chrome 127 changes how publicly-trusted TLS server authentication, that is, website or certificates issued by Entrust, are trusted by default. This applies to Chrome 127 and later on Windows, macOS, ChromeOS, Android, and Linux; iOS policies do not allow use of the Chrome Root Store in Chrome for iOS.

  Specifically, TLS certificates validating to the Entrust root CA certificates included in the Chrome Root Store and issued:

      - after October 31, 2024, will no longer be trusted by default.

      - on or before October 31, 2024, will be unaffected by this change. 

  If a Chrome user or an enterprise explicitly trusts any of the affected Entrust certificates on a platform and version of Chrome relying on the Chrome Root Store, for example, when explicit trust is conveyed through a Windows Group Policy Object, the Signed Certificate Timestamp (SCT) constraints described above will be overridden and certificates will function as they do today.  

  For additional information and testing resources, see Sustaining Digital Certificate Security - Entrust Certificate Distrust.

  To learn more about the Chrome Root Store, see this FAQ.

  • Chrome 127 on Android, ChromeOS, Linux, macOS, Windows: All versions of Chrome 127 and higher that rely on the Chrome Root Store will honor the blocking action, but the blocking action will only begin for certificates issued after October 31, 2024.
  • Chrome 130 on ChromeOS, Linux, macOS, Windows: The blocking action will begin for certificates issued after October 31, 2024. This will also affect Chrome 127, 128 and 129.

    

• Fallback styles for <meter> elements  

  As early as Chrome 130, HTML5 <meter> elements with `appearance: none` will have a reasonable fallback style that matches Safari and Firefox instead of just disappearing from the page. In addition, developers will be able to custom style the <meter> elements.

  A temporary policy MeterAppearanceNoneFallbackStyle will be available until Chrome 133 to control this feature.

  • Chrome 130 on Windows, macOS, Linux, Android

    

• Compression dictionary transport with Shared Brotli and Shared Zstandard  

  This feature adds support for using designated previous responses, as an external dictionary for Brotli- or Zstandard-compressing HTTP responses.

  Enterprises might experience potential compatibility issues with enterprise network infrastructure. The CompressionDictionaryTransportEnabled policy is available to turn off the compression dictionary transport feature.

  • Chrome 130 on Windows, macOS, Linux, Android

    

• Keyboard-focusable scroll containers  

  Improves accessibility by making scroll containers focusable using sequential focus navigation. Today, the tab key doesn't focus scrollers unless tabIndex is explicitly set to 0 or more.

  By making scrollers focusable by default, users who can't (or don't want to) use a mouse will be able to focus clipped content using a keyboard's tab and arrow keys. This behavior is enabled only if the scroller does not contain any keyboard focusable children. This logic is necessary so we don't cause regressions for existing focusable elements that might exist within a scroller like a <textarea>.

  • Chrome 130 on Windows, macOS, Linux, Android

    

• Support non-special scheme URLs  

  Chrome 130 will support non-special scheme URLs, for example, git://example.com/path, correctly. Previously, Chromium's URL parser didn't support non-special URLs. The parser parses non-special URLs as if they had an opaque path, which is not aligned with the URL Standard. Now, Chromium's URL parser parses non-special URLs correctly, following the URL Standard. For more details, see http://bit.ly/url-non-special. 

  • Chrome 130 on Windows, macOS, Linux, Android

    

• Simplified sign-in and sync experience  

  Starting in Chrome 131, existing users with Chrome sync turned on will experience a simplified and consolidated version of sign-in and sync in Chrome. Chrome sync will no longer be shown as a separate feature in settings or elsewhere. Instead, users can sign in to Chrome to use and save information like passwords, bookmarks and more in their Google Account, subject to the relevant enterprise policies.

  As before, the functionality previously part of Chrome sync that saves and accesses Chrome data in the Google Account can be controlled by SyncTypesListDisabled. Sign-in to Chrome can be disabled via BrowserSignin as before.

  Note that the changes do not affect users’ ability to sign in to Google services on the web (like Gmail) without signing in to Chrome, their ability to stay signed out of Chrome, or their ability to control what information is synced with their Google Account.

  • Chrome 131 on Android

    

• Chrome extension telemetry integration with Google SecOps  

  We will begin to collect relevant Chronicle extension telemetry data from within Chrome, for managed profiles and devices, and send it to Google SecOps. Google SecOps will analyze the data to provide instant analysis and context on risky activity; this data is further enriched to provide additional context and is searchable for a year.

  • Chrome 131 on ChromeOS, LaCrOS, Linux, macOS, Windows

    

• User Link capturing on PWAs  

  Web links automatically direct users to installed web apps. To better align with users' expectations around installed web apps, Chrome makes it easier to move between the browser and installed web apps. When the user clicks a link that could be handled by an installed web app, Chrome adds a chip in the address bar to suggest switching over to the app. When the user clicks the chip, this either launches the app directly, or opens a grid of apps that can support that link. Clicking a link always automatically opens the app.

  • Chrome 121 on Linux, macOS, Windows: When some users click a link, it always opens in an installed PWA, while some users see the link open in a new tab with a chip in the address bar, clicking on which will launch the app. A flag is available to control this feature: chrome://flags/#enable-user-link-capturing-pwa.
  • Chrome 131 on Linux, macOS, Windows: Launch to 100% of Stable with either a default on (always launch apps on link clicks) or a default off (always open in a tab, only launch if the user clicks on chip on address bar).
  

    

• Chrome Third-Party Cookie Deprecation (3PCD)  

  On July 22nd, we announced a new path forward for Privacy Sandbox on the web. Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time. We're discussing this new path with regulators, and will engage with the industry as we roll this out. 

  For more details, see this Privacy Sandbox update. 

    

• Insecure form warnings on iOS  

  Chrome 125 started to block form submissions from secure pages to insecure pages on iOS. When Chrome detects an insecure form submission, it now displays a warning asking the user to confirm the submission. The goal is to prevent leaking of form data over plain text without user's explicit approval. A policy InsecureFormsWarningsEnabled is available to control this feature, and will be removed in Chrome 130.

  • Chrome 125 on iOS: Feature rolls out
  • Chrome 130 on iOS: InsecureFormsWarningsEnabled policy will be removed

    

• Remove enterprise policy used for legacy same site behavior  

  In Chrome 79, we introduced the LegacySameSiteCookieBehaviorEnabledForDomainList policy to revert the SameSite behavior of cookies to legacy behavior on the specified domains. The LegacySameSiteCookieBehaviorEnabledForDomainList policy’s lifetime has been extended and will be removed on the milestone listed below.

  • Chrome 132 on Android, ChromeOS, Linux, macOS, Windows: Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy

    

• X25519Kyber768 key encapsulation for TLS  

  Starting in Chrome 124, Chrome enables by default on all desktop platforms a new post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard (ML-KEM). This protects network traffic from Chrome with servers that also support ML-KEM from decryption by a future quantum computer. This is exposed as a new TLS cipher suite. TLS automatically negotiates supported ciphers, so this change should be transparent to server operators. This cipher will be used for both TLS 1.3 and QUIC connections.

  However, some enterprise network devices such as firewalls and proxies (TLS middleboxes) might be unprepared for the size of a Kyber (ML-KEM) key encapsulation, or a new TLS ClientHello cipher code point, leading to dropped or hanging connections. This can be resolved by updating your middlebox, or disabling the key encapsulation mechanism via the temporary PostQuantumKeyAgreementEnabled enterprise policy, which will be available through at least Chrome 141 in 2025. However, long term, post-quantum secure ciphers will be required in TLS and the enterprise policy will be removed. Post-quantum cryptography is required for CSNA 2.0.

  Starting in Chrome 131, Chrome will switch the key encapsulation mechanism from the draft version of Kyber, to the final standard version of ML-KEM. Using any form of post-quantum key exchange (Kyber or ML-KEM) will continue to be controlled by the PostQuantumKeyAgreementEnabled policy.

  For more detail, see this Chromium blog post and this Google Security blog post.

  • Chrome 124 on Windows, macOS, Linux
  • Chrome 131

    

• UI Automation accessibility framework provider on Windows  

  Starting in Chrome 126, Chrome will start directly supporting accessibility client software that uses Microsoft Windows's UI Automation accessibility framework. Prior to this change, such software interoperated with Chrome by way of a compatibility shim in Microsoft Windows. This change is being made to improve the accessible user experience for many users. It provides complete support for Narrator, Magnifier, and Voice Access; and will improve third-party apps that use Windows's UI Automation accessibility framework. Users of Chrome will find reduced memory usage and processing overhead when used with accessibility tools. It will also ease development of software using assistive technologies.

  Administrators can use the UiAutomationProviderEnabled enterprise policy, available from Chrome 125, to either force-enable the new provider (so that all users receive the new functionality), or disable the new provider. This policy will be supported through Chrome 136, and will be removed in Chrome 137. This one-year period is intended to give enterprises sufficient time to work with third-party vendors so that they may fix any incompatibilities resulting from the switch from Microsoft's compatibility shim to Chrome's UI Automation provider.

  • Chrome 125 on Windows:The UiAutomationProviderEnabled policy is introduced so that administrators can enable Chrome's UI Automation accessibility framework provider and validate that third-party accessibility tools continue to work.
  • Chrome 126 on Windows: The Chrome variations framework will be used to begin enabling Chrome's UI Automation accessibility framework provider for users. It will be progressively enabled to the full stable population, with pauses as needed to address compatibility issues that can be resolved in Chrome. Enterprise administrators may continue to use the UiAutomationProviderEnabled policy to either opt-in early to the new behavior, or to temporarily opt-out through Chrome 136.
  • Chrome 137 on Windows: The UiAutomationProviderEnabled policy will be removed from Chrome. All clients will use the browser's UI Automation accessibility framework provider.

Upcoming ChromeOS changes

   

• ChromeOS XDR Window Events  

  In ChromeOS 130, window focus events will be available as part of Extended Threat Detection and Response (XDR) on ChromeOS. You will be able to bring windows into focus activities of devices in your managed fleet by simply updating XDR events in the Admin console!

   

• Generative AI wallpapers and video conference backgrounds  

  As early as ChromeOS 130, we plan to introduce high-resolution, generative AI wallpapers and video-conference meeting backgrounds on ChromeOS. With this feature, you can unleash your creativity and turn your Chromebook into a canvas of personal expression. Choose from a diverse collection of templates and, in just a few clicks, infuse your Chromebook with your unique personality, mood, or interest. 

  Two new policies will be available to control these features; GenAIVcBackgroundSettings and GenAIWallpaperSettings.

 

Upcoming Admin console changes

   

• Chrome browser managed profile reporting 

  Chrome Enterprise Core will introduce new Chrome browser managed profile reporting in the Admin console. This feature will provide a new Managed profile listing and detail pages. On these pages, IT administrators will be able to find reporting information on managed profiles such as profile details, browser versions, policies applied, and more.

  • As early as Chrome 130 on Android, Linux, macOS, Windows
   

   

• Default change for GenAI policies 

  Starting with 130, we will change the default setting for GenAI policies from switched off to allowed, without improving AI models. If you have devices enrolled in Chrome Enterprise core, this policy is automatically applied to those devices to prevent sending data for AI model training. The existing policies that will have the updated default setting are:

  • CreateThemesSettings (available in the US-only for now)
  • DevToolsGenAiSettings (available in most countries)
  • HelpMeWriteSettings (available in the US-only for now)
  • HistorySearchSettings (available in the US-only for now)
  • TabOrganizerSettings (available in the US-only for now)
  • TabCompareSettings (available in the US-only for now)
   

   

• GenAI control policy 

  Starting with 130, Chrome Enterprise Core will include a policy to control the behavior of multiple GenAI policies. This will be a convenient feature, allowing Admins to control the default behavior of a set of policies in one place, for example, off by default. This policy will control the following policies:

  • CreateThemesSettings 
  • DevToolsGenAiSettings
  • HelpMeWriteSettings
  • HistorySearchSettings 
  • TabOrganizerSettings
  • TabCompareSettings
  • GenAIVcBackgroundSettings (launching in Chrome 130)
  • GenAIWallpaperSettings (launching in Chrome 130)
   

   

• Support for user-level settings on the Custom Configurations page 

  The Custom configurations page was recently launched in Chrome 127 and it allows IT admins to configure Chrome policies that are not yet in the Admin console, using JSON scripts. As early as October 1st, Custom configurations will support applying settings at the user-level, in addition to machine-level support. In other words, you will be able to enforce policies when users sign in to a managed Google account using the Custom configurations page.

   
  • As early as October 1st on Android, iOS, Linux, macOS, Windows: Feature rolls out for user policies
   

  To get started, you can find the Custom configurations in the Admin console, under Chrome browser > Reports — you will need the Chrome Enterprise Core SKU:

  

 

Chrome browser updates	Security/ Privacy	User productivity/ Apps	Management
Search your history in Chrome with AI		✓
Admin-configurable site search		✓	✓
Handling undecryptable passwords in Password Manager			✓
Inactive Tabs		✓
New PromotionsEnabled policy replaces PromotionalTabsEnabled			✓
Revamped Chrome Safety Check on Android	✓
Rust JSON Parser	✓
Tab Groups on iPad		✓
Updates for CookiePartitionKey of partitioned cookies	✓
Deprecate CHIPS and Relaunch in WebView	✓
Isolated Web Apps	✓
Rename position-try-options to position-try-fallbacks	✓
Google Calendar Card on the New tab page		✓
New and updated policies in Chrome browser			✓
Removed policies in Chrome browser			✓
ChromeOS updates	Security/ Privacy	User productivity/ Apps	Management
Snap groups on ChromeOS		✓
Data processor mode: EU-wide rollout	✓
Privacy Controls: Geolocation	✓
ChromeOS privacy control reminders on app settings page	✓		✓
Store aggregated vitals data with one-year retention	✓
OCR in ChromeOS Camera App		✓
Magnifier follows Chromevox		✓
Auto Gain Control enabled by default		✓
APN management			✓
Pinned notifications on ChromeOS			✓
Admin console updates	Security/ Privacy	User productivity/ Apps	Management
Chrome profile separation - new deployment guide	✓
Chrome Enterprise Data Controls: Clipboard		✓
Upcoming Chrome browser changes	Security/ Privacy	User productivity/ Apps	Management
Tab compare		✓
Ad-hoc code signatures for PWA shims on macOS		✓
Clear device data on sign out on iOS	✓
Fallback styles for HTML5 <meter> element	✓
Chrome will no longer support macOS 10.15	✓		✓
Deprecate Safe Browsing Extended reporting	✓
Certificate Manager on Windows and MacOS	✓
New option in HttpsOnlyMode policy	✓		✓
Sync Tab Group		✓
Update Google Play Services to fix issues with on-device passwords			✓
Deprecate non-standard declarative shadow DOM serialization	✓
Deprecate the includeShadowRoots argument on DOMParser	✓
Rename inset-area to position-area	✓
Entrust certificate distrust	✓
Support non-special scheme URLs	✓
Network Service on Windows will be sandboxed			✓
Chrome Third-Party Cookie Deprecation (3PCD)	✓
User Link capturing on PWAs		✓	✓
Private network access checks for navigation requests: warning-only mode			✓
Insecure form warnings on iOS	✓
Chrome extension telemetry integration with Chronicle	✓		✓
Remove policy used for legacy same site behavior			✓
X25519Kyber768 key encapsulation for TLS	✓
UI Automation accessibility framework provider on Windows		✓
Upcoming ChromeOS changes	Security/ Privacy	User productivity/ Apps	Management
Update to keyboard shortcut for Select-to-speak		✓
Chrome Enterprise Premium for file transfers on Managed Guest Sessions		✓
ChromeOS XDR window events	✓
Generative AI wallpapers and video conference backgrounds	✓
Upcoming Admin console changes	Security/ Privacy	User productivity/ Apps	Management
Chrome browser managed profile reporting			✓
Admin console widget for data controls			✓
Default change for GenAI policies			✓

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.

Chrome Enterprise and Education release notes are published in line with the Chrome release schedule, on the Early Stable date for Chrome browser.

Chrome browser updates

   

• Search your history in Chrome with AI  

  Starting in Chrome 128, users can search their browsing history based on page contents and not just the page title and URL. Initially, this feature is only available to users in English in the US. Admins can control this feature by using the HistorySearchSettings policy. You have the following options for your organization:  

  •   0 = Enable the feature for users, and send relevant data to Google to help train or improve AI models. Relevant data may include prompts, inputs, outputs, and source materials, depending on the feature. It may be reviewed by humans for the sole purpose of improving AI models.
  •   1 = Enable the feature for users, but do not send data to Google to train or improve AI models.
  •   2 = Fully disable feature

  For more information, see Search your history in Chrome with AI.

  • Chrome 128 on Linux, Mac, Windows 
   

   

• Admin-configurable site search  

  Site search shortcuts are a way to use the address bar (Omnibox) as a search box for a specific site without navigating directly to the site’s URL, similar to how you can use the Omnibox to perform a broad Google search of the web. You can now create site shortcuts on behalf of your managed users, to shortcut to the most critical enterprise sites. You can control this feature using the SiteSearchSettings policy.

   
  • Chrome 128 on ChromeOS, Linux, Mac, Windows: Available for Chrome Browser Core customers signed up for Trusted Tester starting Chrome 128, followed by gradual rollout for all Chrome Browser Enterprise customers a few weeks later
   

  

   

• Handling undecryptable passwords in Password Manager  

  Users sometimes end up with undecryptable passwords on their device, for example, if they've used third party software to move to a new device. We are launching a new policy called DeletingUndecryptablePasswordsEnabled that helps handle such passwords. When enabled, this policy deletes undecryptable passwords from the user's device, unless the UserDataDir policy is specified. When DeletingUndecryptablePasswordsEnabled is off, undecryptable passwords are untouched, but this will result in broken Password Manager functionality.

   
  • Chrome 128 on iOS, Linux, Mac, Windows

   

• Inactive tabs  

  In Chrome 128, we now hide old tabs under a new Inactive Tabs section in the tab switcher on Chrome on Android. Chrome users can access the Inactive Tabs section to view all old tabs or close them using the new bulk tab functionality. These tabs will be deleted if inactive for over 60 days. 

   

  

   
  • Chrome 128 on Android: Rolls out to 1% 

   

• New PromotionsEnabled policy replaces PromotionalTabsEnabled  

  In Chrome 128, new promotional OS-level notifications are shown to users. To include a larger number of promotional features under one policy, a new policy PromotionsEnabled has been created to replace PromotionalTabsEnabled, which will be deprecated in the future. 

   
  • Chrome 128 on ChromeOS, Linux, Mac, Windows: PromotionsEnabled will begin to roll out with Chrome 128. There is no flag.

   

• Revamped Chrome Safety Check on Android  

  Chrome 128 introduces  a new proactive Safety Check that regularly checks the browser for safety-related issues and informs users when there's anything that needs their attention. This launch also introduces a re-designed Safety Check page, chrome://settings/safetyCheck, with Chrome’s proactive safety-related actions and information tailored to each user, designed to make it easier for users to stay safe online. For more information, see Manage Chrome safety and security.

   
  • Chrome 128 on Android

  

   

• Rust JSON Parser  

  As early as Chrome 128, Chrome will parse JSON using Rust, rather than C++. This will remove the risk of memory safety vulnerabilities in the JSON parser, improving security. This change should be transparent to users. There is a small risk of certain invalid JSON, which Chrome currently accepts, no longer being accepted, although the Rust parser remains extremely lenient.

  In the event that Chrome doesn't accept the invalid JSON, this will lead to 500s or other application-level errors, not crashes. If Chrome no longer accepts some invalid JSON, the JSON should be aimed to be fixed.

   
  • Chrome 128

   

• Tab Groups on iPad  

  Chrome for iPad users can create and manage tab groups. This helps users stay organized, reduce clutter and manage their tasks more efficiently.

   
  • Chrome 128 on iOS

   

• Updates for CookiePartitionKey of partitioned cookies  

  Chrome 128 adds a cross-site ancestor bit to the keying of the partitioned cookie's CookiePartitionKey. This change unifies the partition key with the partition key values used in storage partitioning and adds protection against clickjacking attacks by preventing cross-site embedded frames from having access to the top-level-site's partitioned cookies.

  If an enterprise experiences any breakage with embedded iframes, they can use the CookiesAllowedForUrls policy or use SameSite=None cookies without the Partitioned attribute and then invoke the Storage Access API (SAA) to ensure that embedded iframes have access to the same cookies as the top level domain. 

   
  • Chrome 128 on Windows, Mac, Linux

   

• Deprecate CHIPS and relaunch in WebView  

  The WebViewClient supports a method, shouldInterceptRequest, which allows developers to intercept network activity and modify HTTP headers, etc. This API does not have access to the Cookie header and relies on the Android CookieManager API in order to query what cookies are available for a particular request URL. However, partitioned cookies are double-keyed on the top-level site and the site of the URL using the cookies.

  Currently, the CookieManager API provides no way for developers to query partitioned cookies correctly, and this will cause a mismatch between what the Java API returns and what frames in WebView will actually be in their Cookie header. After discussing this with the WebView team, we believe that the option that will minimize potential app breakage is to disable Cookies Having Independent Partitioned State (CHIPS) on WebView until we are able to ship support for the Cookie header to shouldInterceptRequest. We will release the changes to shouldInterceptRequest in the next target SDK version (API level 36).

  Enterprise workflows that use WebView to load web content that relies on partitioned cookies will have their state cleared. WebView apps still have access to unpartitioned 3P cookies and cookies set with Partitioned after the change will revert to their legacy pre-CHIPS behavior until we relaunch the feature.

   
  • Chrome 128 on Android

   

• Isolated Web Apps  

  Isolated Web Apps (IWAs) are an extension of existing work on PWA installation and Web Packaging that provides stronger protections against server compromise and other tampering, which is necessary for developers of security-sensitive applications.

  Rather than being hosted on live web servers and fetched over HTTPS, these IWAs are packaged into Web Bundles, signed by their developer, and distributed to end-users through one or more of the potential methods described in the Chromium project explainer.

  In this initial release, IWAs are only installable using a new policy, IsolatedWebAppInstallForceList, on enterprise-managed ChromeOS devices.

   
  • Chrome 128 on ChromeOS

   

• Rename position-try-options to position-try-fallbacks  

  The CSS working group (CSSWG) resolved to rename this property, because fallbacks more accurately describe what this property controls. The word options is a bit unclear, since the styles outside of `position-try` blocks will be tested first, and if they result in a layout that fits within the containing block, none of the options will get used. So fallbacks is a better word to describe this behavior. For more details, see Github.

  • Chrome 128 on Windows, Mac, Linux, Android

   

• Google Calendar Card on the New tab page  

  Enterprise users can now access their upcoming meetings directly from the New tab page with the new calendar card. This streamlined experience eliminates the need to switch tabs or waste time searching for your next meeting, allowing you to focus on what matters most. You can control cards on the New tab page with the NTPCardsVisible policy. 

   
  • Chrome 128 on Linux, Mac, Windows

  

   

• New and updated policies in Chrome browser  

  Policy	Description
  DataControlsRules	Sets a list of Data Controls rules
  PromotionsEnabled	Enable showing promotional content
  SiteSearchSettings	Provides a list of sites that users can quickly search using shortcuts in the address bar
  LensOverlaySettings	Settings for the Lens Overlay feature
  ExtensionDeveloperModeSettings	Control the availability of developer mode on extensions page
  QRCodeGeneratorEnabled	Enable QR Code Generator
  PrintingLPACSandboxEnabled	Enable Printing LPAC Sandbox
  HistorySearchSettings	Settings for AI-powered History Search
  ChromeForTestingAllowed	Allow Chrome for Testing
  ProvisionManagedClientCertificateForUser	Enables the provisioning of client certificates for a managed user or profile
  StandardizedBrowserZoomEnabled	Enable Standardized Browser Zoom Behavior
  DeletingUndecryptablePasswordsEnabled	Enable deleting undecryptable passwords
  EnterpriseCustomLabel	Set a custom enterprise label

   

• Removed policies in Chrome browser  

  Policy	Description
  RemoteAccessHostTokenUrl	URL where remote access clients should obtain their authentication token
  RemoteAccessHostTokenValidationUrl	URL for validating remote access client authentication token
  EnterpriseBadgingTemporarySetting	Control the visibility of enterprise badging
  RemoteAccessHostTokenValidationCertificateIssuer	Client certificate for connecting to RemoteAccessHostTokenValidationUrl
  EnforceLocalAnchorConstraintsEnabled	Determines whether the built-in certificate verifier will enforce constraints encoded into trust anchors loaded from the platform trust store.
  CertificateTransparencyEnforcementDisabledForLegacyCas	Disable Certificate Transparency enforcement for a list of Legacy Certificate Authorities

ChromeOS updates

   

• Snap groups on ChromeOS 

  In ChromeOS 128, Snap groups allow you to group windows on ChromeOS. A snap group is formed when you pair two windows for a split-screen. You can bring the windows back together, resize them simultaneously, or move them both as a group.

   

  

   

   

• Data processor mode: EU-wide rollout 

  New data processor mode features and ChromeOS terms are available to the entire EU through the Google Admin console. For more details, see Overview of ChromeOS data processor mode. 

  As a ChromeOS administrator, you can now activate Data processor mode, which covers  a set of ChromeOS features and services referred to as Essential Services. 

   

• Privacy controls: Geolocation 

  Privacy on ChromeOS devices is now easier to manage by adding the ability to control geolocation access to the Settings > Privacy and security > Privacy controls page. Users can now set geolocation access to Allowed, Only allowed for system services, or Off, depending on their preference. 

  We allow users to block all apps or websites, or entire systems access to geolocation regardless of previously granted permissions, and provide users easy to use controls to re-enable them whenever it would be helpful.

  

   

  We’ve added a new policy,  GoogleLocationServicesEnabled. This controls the availability of geolocation on the device inside of user sessions. Unlike the now deprecated policy below, it affects the entire system, not just the Android VM (Arc).

  Deprecation notice (6 months): ArcGoogleLocationServicesEnabled 

  This is being deprecated in favor of the added GoogleLocationServicesEnabled policy, as it covers the entire system and not just Android VM (Arc). Additionally, we are modifying the effect of the DefaultGeolocationSetting to no longer affect the system geolocation setting.

   

• ChromeOS privacy control reminders on Apps settings page 

  To use the cameras and microphones on ChromeOS, you need to turn on both privacy controls and app permissions in two separate places. 

  We are making it easier for users to be aware of the states of the privacy controls and provide actionable reminders on the ChromeOS Apps settings page so that users have a smoother experience. To view the ChromeOS Apps settings page, click Settings >Apps > Manage your Apps, and select the desired app.

   

  

   

   

• Store aggregated vitals data with one-year retention 

  From ChromeOS 128 onwards, we store aggregated vitals data for one-year retention to better track the progress over time. Vitals data includes Android app performance metrics, such as crash rate, and these metrics will help us improve Android app performance on ChromeOS devices.

   

• OCR in ChromeOS Camera App 

  Optical Character Recognition (OCR) enables text extraction from images captured in the ChromeOS Camera App by integrating an ML-powered text extraction service. ChromeOS 128 supports 77 languages; it also supports both horizontal and vertical detection. This allows copying and searching text from images, speaking text from images by screen reader, and creating searchable PDFs from images. By default, text detection in Photo mode is disabled and can be enabled from Settings > Text detection in preview.

   

  

   

   

• Magnifier follows ChromeVox 

  Magnifier following ChromeVox is designed for people who are blind or have low vision. When you read text aloud using ChromeVox, the screen magnifier now automatically follows the words, so you never lose your place. To try this out, you can enable both Magnifier and ChromeVox in your settings. Zoom in to your preferred zoom level using Ctrl + Alt + Brightness up and Ctrl + Alt + Brightness down. A setting is available under the Magnifier settings to adjust this behavior.

   

• Auto Gain Control enabled by default 

  Auto Gain Control (AGC) allows apps, such as video calling apps, to automatically optimize microphone volume for best audio quality. When auto gain control is enabled and in-use, a message appears in the quick settings panel to inform the user that the microphone gain slider is being overridden. AGC is enabled by default in ChromeOS 128. If you want to manually control the microphone volume even for apps that support AGC, you can go to Settings > Device > Audio and deselect Allow apps to automatically adjust mic volume. 

   

  

   

   

• APN management 

  For ChromeOS cellular-enabled devices, we have made it easier to view, manage, and add Access Point Names (APNs). We’ve also improved registration failure handling and messaging.

   

• Pinned notifications on ChromeOS 

  ChromeOS notifications help to visually separate pinned notifications from other notifications. ChromeOS 128 significantly differentiates the visual look of pinned notifications from typical notifications to reflect their significant difference - we notify the user of an ongoing process rather than an instantaneous event.

Admin console updates

   

• Chrome profile separation - new deployment guide   

  We have created a detailed deployment guide to help you control profile separation in your organization: ProfileSeparationSettings, ProfileSeparationDataMigrationSettings and ProfileSeparationDomainExceptionList.

  • Chrome 128 on Windows, Mac, Linux

   

• Chrome Enterprise Data Controls: Clipboard   

  Data Controls are lightweight rules in the Admin console that set a Chrome policy to control security-sensitive user actions like file attachments, downloads, copy and paste actions, and printing. Chrome blocks or warns the user when these actions happen by applying those rules locally.

  Chrome 128 releases the clipboard protection parts of Data Controls, that is, copy and paste actions. Other protections are planned in future releases.

  You can control this feature with the DataControlsRules policy.

   
  • Chrome 128 on ChromeOS, Linux, Mac, Windows

   

  

   

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming Chrome browser updates

    

• Tab compare  

  Starting in Chrome 129 (US-only), we will introduce Tab compare, a new feature that presents an AI-generated overview of products from across multiple tabs, all in one place. This feature will be controlled through the TabCompareSettings policy.

  • Chrome 129 on Linux, Mac, Windows 

  

   

    

• Ad-hoc code signatures for PWA shims on macOS  

  Code signatures for application shims that are created when installing a Progressive Web App (PWA) on macOS are changing to use ad-hoc code signatures, which are created when the application is installed. The code signature is used by macOS as part of the application's identity. These ad-hoc signatures will result in each PWA shim having a unique identity to macOS; currently every PWA looks like the same application to macOS.

  This will address problems when attempting to include multiple PWAs in the macOS Open at Login preference pane, and will permit future improvements for handling user notifications within PWAs on macOS.

  • Chrome 129 on Mac
   

    

• Clear device data on sign out on iOS  

  Starting in Chrome 129, signing out from a managed account in an unmanaged browser will delete browsing data that is saved on the device. Managed users will be presented a confirmation dialog on sign-out explaining that the data will be cleared. Data will be cleared only from the time of sign-in, otherwise all data will be cleared; time of sign-in is only known if the user signed in on Chrome 122 or later. 

  The data that will be deleted includes: 

  • browsing history
  • cookies and site data
  • passwords
  • site settings
  • autofill
  • cached images and files
   
  • Chrome 129 on iOS

  

   

    

• Fallback styles for HTML5 <meter> elements  

  As early as Chrome 129, HTML5 <meter> elements with `appearance: none` will have a reasonable fallback style that matches Safari and Firefox instead of just disappearing from the page. In addition,  developers will be able to custom style the <meter> elements.

  A temporary policy MeterAppearanceNoneFallbackStyle will be available until Chrome 133 to control this feature.

  • Chrome 129 on Windows, Mac, Linux, Android
   

    

• Chrome will no longer support macOS 10.15  

  Chrome will no longer support macOS 10.15, which is already outside of its support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security. If run on macOS 10.15, Chrome continues to show an infobar that reminds users that Chrome 129 will no longer support macOS 10.15.

  • Chrome 129 on Mac: Chrome no longer supports macOS 10.15
   

    

• Deprecate Safe Browsing Extended reporting  

  Safe Browsing Extended reporting is a feature that enhances the security of all users by collecting telemetry information from participating users that is used for Google Safe Browsing protections. The data collected includes URLs of visited web pages, limited system information, and some page content. However, this feature is now superseded by Enhanced protection mode. We suggest users switch to Enhanced protection to continue providing security for all users in addition to enabling the strongest security available in Chrome. For more information, see Safe Browsing protection levels. 

   

  

   
  • Chrome 129 on Android, iOS, ChromeOS, Linux, Mac, Windows: Deprecation of Safe Browsing Extended Reporting
   

    

• Certificate Manager on Windows and MacOS  

  As early as Chrome 129, there is a new certificate management settings screen accessible from security settings on Windows and MacOS. This replaces the link to Windows cert manager and MacOS keychain, respectively, although these operating system surfaces are still accessible from the certificate management settings page.

  The certificate manager displays certificates that are trusted or distrusted by Chrome, including the contents of the Chrome Root Store, and any certificates that have been imported from the underlying operating system. Users can access the page directly by navigating to chrome://certificate-manager.

  A future release will introduce user and enterprise management of certificates added directly to Chrome.

  • Chrome 129 on Mac, Windows

    

• New option in HttpsOnlyMode policy  

  Ask Before HTTP (ABH) , formerly named HTTPS Only/First Modes, is a setting that tells Chrome to ask for user consent before sending insecure HTTP content over the wire. The HttpsOnlyMode policy allows force-enabling, or force-disabling, ABH.

  In Chrome 129, we are adding a new middle-ground variant of ABH called balanced mode. This variant aims to reduce user inconvenience by working like (strict) ABH most of the time, but not asking when Chrome knows that an HTTPS connection isn't possible, such as when connecting to a single-label hostname like internal/.

  We are adding a force_balanced_enabled policy option to allow force-enabling this new variant. Setting force_balanced_enabled on browsers before Chrome 129 will result in the default behavior, which places no enterprise restrictions on the ABH setting.

  To avoid unexpected impact, if you have previously set force_enabled, we recommend not setting force_balanced_enabled until your entire fleet has upgraded to Chrome 129 or higher. If you are not migrating from force_enabled to force_balanced_enabled, you will be unaffected by this change.

  • Chrome 129 on Android, ChromeOS, Linux, Mac, Windows, Fuchsia
   

    

• Sync Tab Group  

  The tab groups on iOS will now be saved. Closing a tab group will no longer delete it. For users syncing their tabs across devices, the groups will also sync.

   
  • Chrome 129 on iOS

  

   

    

• Update Google Play Services to fix issues with on-device passwords  

  Users with old versions of Google Play Services will experience reduced functionality with their on-device passwords, and Password Manager might soon stop working for them altogether. These users will need to update Play Services, or will be guided through other troubleshooting methods depending on their state. This is part of an ongoing migration that only affects Android users of Password Manager.

  • Chrome 129 on Android
   

    

• Deprecate of non-standard declarative shadow DOM serialization  

  The prototype implementation, which was shipped in 2020 and then updated in 2023, contained a method called `getInnerHTML()` that could be used to serialize DOM trees containing shadow roots. That part of the prototype was not standardized with the rest of the declarative shadow DOM, and has only recently reached spec consensus (for details, see Github). As part of that consensus, the shape of the getInnerHTML API changed.

  This feature represents the deprecation of the previously shipped `getInnerHTML()` method. The replacement is called `getHTML()`, which shipped in Chrome 125. For details, see this ChromeStatus feature description.

  • Chrome 129 on Windows, Mac, Linux, Android
   

    

• Deprecate the includeShadowRoots argument on DOMParser  

  The includeShadowRoots argument was a never-standardized argument to the DOMParser.parseFromString() function, which was there to allow imperative parsing of HTML content that contains declarative shadow DOM. This was shipped in Chrome 90 as part of the initial shipment of declarative shadow DOM. Since the standards discussion rematerialized in 2023, the shape of DSD APIs changed, including this feature for imperative parsing. To read more, see details of the context on the related standards, and information is also available on the related deprecations of shadow DOM serialization and shadow root attribute.
  Now that a standardized version of this API, in the form of setHTMLUnsafe() and parseHTMLUnsafe() shipped in Chrome 124, the non-standard includeShadowRoots argument needs to be deprecated and removed. All usage should shift accordingly:
  Instead of:
    (new DOMParser()).parseFromString(html,'text/html',{includeShadowRoots: true});
  This can be used instead:
    document.parseHTMLUnsafe(html);

  • Chrome 129 on Linux, Mac, Windows, Android
   

    

• Rename inset-area to position-area  

  The CSS working group (CSSWG) resolved to rename this property from `inset-area` to `position-area`. See the CSSWG discussion in Github. 

  Chrome has decided to release an interoperable solution, by supporting both property names. We will ship the new property name, `position-area`, as a synonym for `inset-area` first. Then after a suitable amount of time, we will remove `inset-area`. The latter removal will be done under a separate Intent.

  • Chrome 129 on Windows, Mac, Linux, Android
   

    

• Entrust certificate distrust  

  In response to sustained compliance failures, Chrome 127 changes how publicly-trusted TLS server authentication, that is, websites or certificates issued by Entrust, are trusted by default. This applies to Chrome 127 and later on Windows, macOS, ChromeOS, Android, and Linux; iOS policies do not allow use of the Chrome Root Store in Chrome for iOS.

  Specifically, TLS certificates validating to the Entrust root CA certificates included in the Chrome Root Store and issued:

      - after October 31, 2024, will no longer be trusted by default.

      - on or before October 31, 2024, will be unaffected by this change. 

  If a Chrome user or an enterprise explicitly trusts any of the affected Entrust certificates on a platform and version of Chrome relying on the Chrome Root Store, for example, when explicit trust is conveyed through a Windows Group Policy Object, the Signed Certificate Timestamp (SCT) constraints described above will be overridden and certificates will function as they do today.  

  For additional information and testing resources, see Sustaining Digital Certificate Security - Entrust Certificate Distrust.

  To learn more about the Chrome Root Store, see this FAQ.

  • Chrome 127 on Android, ChromeOS, Linux, Mac, Windows: All versions of Chrome 127 and higher that rely on the Chrome Root Store will honor the blocking action, but the blocking action will only begin for certificates issued after October 31, 2024.
  • Chrome 130 on ChromeOS, Linux, Mac, Windows: The blocking action will begin for certificates issued after October 31, 2024. This will also affect Chrome 127, 128 and 129.
   

    

• Support non-special scheme URLs  

  Chrome 130 will support non-special scheme URLs correctly. Previously, Chromium's URL parser doesn't support non-special URLs. The parser parses non-special URLs as if they had an “opaque path”, which is not aligned with the URL Standard. Now, Chromium's URL parser parses non-special URLs correctly, following the URL Standard. For more details, see Support Non-Special Scheme URLs .

  • Chrome 130 on Windows, Mac, Linux, Android
   

    

• Network Service on Windows will be sandboxed  

  To improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions. You can use the Chromium bug tracker to report any issues you encounter.

  • Chrome 130 on Windows: Network Service sandboxed on Windows
   

    

• Chrome Third-Party Cookie Deprecation (3PCD)  

  On July 22nd, we announced a new path forward for Privacy Sandbox on the web. Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time. We're discussing this new path with regulators, and will engage with the industry as we roll this out. 

  For more details, see this Privacy Sandbox update. 

   

    

• User Link capturing on PWAs  

  Web links automatically direct users to installed web apps. To better align with users' expectations around installed web apps, Chrome makes it easier to move between the browser and installed web apps. When the user clicks a link that could be handled by an installed web app, Chrome adds a chip in the address bar to suggest switching over to the app. When the user clicks the chip, this either launches the app directly, or opens a grid of apps that can support that link. For some users, clicking a link always automatically opens the app.

  • Chrome 121 on Linux, Mac, Windows: When some users click a link, it always opens in an installed PWA, while some users see the link open in a new tab with a chip in the address bar, clicking on which will launch the app. A flag is available to control this feature: chrome://flags/#enable-user-link-capturing-pwa.
  • Chrome 130 on Linux, Mac, Windows: Launch to 100% of Stable with either a default on (always launch apps on link clicks) or a default off (always open in a tab, only launch if the user clicks on chip on address bar).

   

   

    

• Private network access checks for navigation requests: warning-only mode  

  Before a website A navigates to another site B in the user's private network, this feature does the following:

  1. Checks whether the request has been initiated from a secure context.

  2. Sends a preflight request, and checks whether B responds with a header that allows private network access.

  There are already features for subresources and workers, but this one is for navigation requests specifically. These checks protect the user's private network.  

  Since this feature is the warning-only mode, we do not fail the requests if any of the checks fail. Instead, a warning will be shown in the DevTools console, to help developers prepare for the coming enforcement.

  • Chrome 130 on Windows, Mac, Linux, Android
   

    

• Insecure form warnings on iOS  

  Chrome 125 started to block form submissions from secure pages to insecure pages on iOS. When Chrome detects an insecure form submission, it now displays a warning asking the user to confirm the submission. The goal is to prevent leaking of form data over plain text without user's explicit approval. A policy InsecureFormsWarningsEnabled is available to control this feature, and will be removed in Chrome 130.

  • Chrome 125 on iOS: Feature rolls out
  • Chrome 130 on iOS: InsecureFormsWarningsEnabled policy will be removed
   

    

• Chrome extension telemetry integration with Chronicle  

  As early as Chrome 131, we will begin to collect relevant extension telemetry data from within Chrome, for managed profiles and devices, and send it to Chronicle. Chronicle will analyze the data to provide instant analysis and context on risky activity.

  • Chrome 131 on ChromeOS, Linux, Mac, Windows
   

    

• Remove enterprise policy used for legacy same site behavior  

  In Chrome 79, we introduced the LegacySameSiteCookieBehaviorEnabledForDomainList policy to revert the SameSite behavior of cookies to legacy behavior on the specified domains. The LegacySameSiteCookieBehaviorEnabledForDomainList policy’s lifetime has been extended and will be removed on the milestone listed below.

  • Chrome 132 on Android, ChromeOS, Linux, Mac, Windows: Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy
   

    

• X25519Kyber768 key encapsulation for TLS  

  Starting in Chrome 124, Chrome enables by default on all desktop platforms a new post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard (ML-KEM). This protects network traffic from Chrome with servers that also support ML-KEM from decryption by a future quantum computer. This is exposed as a new TLS cipher suite. TLS automatically negotiates supported ciphers, so this change should be transparent to server operators. This cipher will be used for both TLS 1.3 and QUIC connections.

  However, some TLS middleboxes might be unprepared for the size of a Kyber (ML-KEM) key encapsulation, or a new TLS ClientHello cipher code point, leading to dropped or hanging connections. This can be resolved by updating your middlebox, or disabling the key encapsulation mechanism via the temporary PostQuantumKeyAgreementEnabled enterprise policy, which will be available through the end of 2024. However, long term, post-quantum secure ciphers will be required in TLS and the enterprise policy will be removed. Post-quantum cryptography is required for CSNA 2.0.

  For more detail, see this Chromium blog post.

  • Chrome 124 on Windows, Mac, Linux
  • Chrome 135 on Android
   

    

• UI Automation accessibility framework provider on Windows  

  Starting in Chrome 126, Chrome will start directly supporting accessibility client software that uses Microsoft Windows's UI Automation accessibility framework. Prior to this change, such software interoperated with Chrome by way of a compatibility shim in Microsoft Windows. This change is being made to improve the accessible user experience for many users. It provides complete support for Narrator, Magnifier, and Voice Access; and will improve third-party apps that use Windows's UI Automation accessibility framework. Users of Chrome will find reduced memory usage and processing overhead when used with accessibility tools. It will also ease development of software using assistive technologies.

  Administrators might use the UiAutomationProviderEnabled enterprise policy, available from Chrome 125, to either force-enable the new provider (so that all users receive the new functionality), or disable the new provider. This policy will be supported through Chrome 136, and will be removed in Chrome 137. This one-year period is intended to give enterprises sufficient time to work with third-party vendors so that they may fix any incompatibilities resulting from the switch from Microsoft's compatibility shim to Chrome's UI Automation provider.

   
  • Chrome 125 on Windows:The UiAutomationProviderEnabled policy is introduced so that administrators can enable Chrome's UI Automation accessibility framework provider and validate that third-party accessibility tools continue to work.
  • Chrome 126 on Windows: The Chrome variations framework will be used to begin enabling Chrome's UI Automation accessibility framework provider for users. It will be progressively enabled to the full stable population, with pauses as needed to address compatibility issues that can be resolved in Chrome. Enterprise administrators may continue to use the UiAutomationProviderEnabled policy to either opt-in early to the new behavior, or to temporarily opt-out through Chrome 136.
  • Chrome 137 on Windows: The UiAutomationProviderEnabled policy will be removed from Chrome. All clients will use the browser's UI Automation accessibility framework provider.

 

Upcoming ChromeOS changes

   

• Update to keyboard shortcut for Select-to-speak  

  On Chromebooks, the Select-to-speak keyboard shortcut (Search + s) now works when it is first pressed. As early as ChromeOS 129, you will no longer need to enable it first in Settings > Accessibility > Text-to-Speech > Select-to-speak. A dialog appears confirming that you want to turn on Select-to-speak the first time you press the keyboard shortcut. 

   

  

   

   

• Chrome Enterprise Premium for file transfers on Managed Guest Sessions  

  As early as ChromeOS 129, organizations will be able to extend Chrome Enterprise Premium’s powerful scanning and content and context-based protection to local files on ChromeOS on Managed Guest Sessions. 

  For example, a misplaced file containing Social Security numbers is instantly blocked when a user attempts to copy it to an external drive, safeguarding this confidential information.

   

• ChromeOS XDR Window Events  

  In ChromeOS 130, window focus events will be available as part of Extended Threat Detection and Response (XDR) on ChromeOS. You will be able to bring windows into focus activities of devices in your managed fleet by simply updating XDR events in the Admin console!

   

• Generative AI wallpapers and video conference backgrounds  

  As early as ChromeOS 130, we plan to introduce high-resolution, generative AI wallpapers and video-conference meeting backgrounds on ChromeOS. With this feature, you can unleash your creativity and turn your Chromebook into a canvas of personal expression. Choose from a diverse collection of templates and, in just a few clicks, infuse your Chromebook with your unique personality, mood, or interest. 

  Two new policies will be available to control these features; GenAIVcBackgroundSettings and GenAIWallpaperSettings.

 

Upcoming Admin console changes

   

• Chrome browser managed profile reporting 

  Chrome Enterprise Core will introduce new Chrome browser managed profile reporting in the Admin console. This feature will provide a new Managed profile listing and detail pages. On these pages, IT administrators will be able to find reporting information on managed profiles such as profile details, browser versions, policies applied, and more.

  • Chrome 130 on Android, Linux, Mac, Windows
   

   

• Admin console widget for data controls 

  A new settings widget in the Admin console allows users to configure data controls policies for specific URLs. 

  • Chrome 128 on ChromeOS, Linux, Mac, Windows
   

   

• Default change for GenAI policies 

  Starting with 130, we will change the default setting for GenAI policies from switched off to allowed, without improving AI models. This doesn't impact age restrictions on access to any relevant GenAI features. The existing policies that will have the updated default setting are:

  • CreateThemesSettings
  • DevToolsGenAiSettings
  • HelpMeWriteSettings
  • HistorySearchSettings
  • TabOrganizerSettings
   

Chrome browser updates	Security/ Privacy	User productivity/ Apps	Management
App-bound encryption for cookies	✓
Chrome Profile Separation - policy improvements			✓
Enhanced Safe Browsing promos on iOS	✓
Entrust certificate distrust	✓
Generating insights for DevTools console warnings and errors			✓
HTTPS-First Mode in Incognito	✓
Migrate extensions to Manifest V3 before June 2025	✓	✓	✓
Policy to configure ACG for browser process			✓
Simplified sign-in and sync experience on Android		✓
Additional Safe Browsing telemetry about pages	✓
Updated password management experience on Android	✓	✓
Watermarking	✓
Automatic fullscreen content setting		✓
Deprecate mutation events	✓
Keyboard-focusable scroll containers	✓
Support for not condition in ServiceWorker static routing API	✓
New and updated policies in Chrome browser			✓
Removed policies in Chrome browser			✓
ChromeOS updates	Security/ Privacy	User productivity/ Apps	Management
Chrome Enterprise Premium for file transfers on ChromeOS	✓
ChromeOS video conferencing: DLC states for features		✓
Audio Bluetooth telephony		✓
OCR on Backlight		✓
Firmware update instructions			✓
Read Aloud in Reading Mode		✓
Classroom Glanceables		✓
PDF page deletion and reordering		✓
Admin console updates	Security/ Privacy	User productivity/ Apps	Management
Configure ChromeOS User & browser settings with Google groups			✓
Add managed browsers to groups for group-based policy management			✓
Filter for popular and recently added settings with policy tags			✓
Revamped ChromeOS device list and details			✓
Upcoming Chrome browser changes	Security/ Privacy	User productivity/ Apps	Management
Isolated Web Apps	✓
Rust JSON parser	✓
Clear device data on sign out on iOS			✓
Attribution tags for search engine			✓
Tab Groups on iPad		✓
Cross-site ancestor chain bit for CookiePartitionKey of partitioned cookies	✓
Rename position-try-options to position-try-fallbacks	✓
Ad-hoc code signatures for PWA shims on macOS		✓
Chrome will no longer support macOS 10.15	✓		✓
Deprecate Safe Browsing Extended reporting	✓
Deprecation of non-standard declarative shadow DOM serialization	✓
Deprecate the includeShadowRoots argument on DOMParser	✓
Network Service on Windows will be sandboxed			✓
Third-party cookie access in Chrome	✓
User Link capturing on PWAs		✓	✓
Private network access checks for navigation requests: warning-only mode			✓
Insecure form warnings on iOS	✓
Remove policy used for legacy same site behavior			✓
X25519Kyber768 key encapsulation for TLS	✓
UI Automation accessibility framework provider on Windows		✓
Upcoming ChromeOS changes	Security/ Privacy	User productivity/ Apps	Management
Snap Groups		✓
Data processor mode: EU-wide rollout	✓
Privacy Hub: Geolocation	✓
Upcoming Admin console changes	Security/ Privacy	User productivity/ Apps	Management
Chrome browser managed profile reporting			✓
Admin console widget for data controls			✓

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.

Chrome Enterprise and Education release notes are published in line with the Chrome release schedule, on the Early Stable date for Chrome browser.

Chrome browser updates

   

• App-bound encryption for cookies  

  To improve the security of cookies on Windows, the encryption key used for cookie encryption will be further secured by binding it to Chrome's application identity. This can help protect against malware running at the same privilege as Chrome that might attempt to steal cookies from the system. This does not protect against an attacker who is able to elevate privilege or inject into Chrome's processes.

  App-bound Encryption strongly binds encryption keys to the local machine so customers who are using Chrome with roaming profiles may want to consider disabling this security feature otherwise cookies will not be portable between workstations.

  An enterprise policy, ApplicationBoundEncryptionEnabled, is available to disable application-bound encryption.

  • Chrome 127 on Windows
   

   

• Chrome Profile Separation - policy improvements  

  Chrome profiles offer a user-friendly way to keep personal and work browsing data separate, simplifying the experience, preventing data breaches, and ensuring privacy and compliance. We have created three intuitive policies to help you control profile separation in your organization: ProfileSeparationSettings, ProfileSeparationDataMigrationSettings and ProfileSeparationDomainExceptionList. These policies replace ManagedAccountsSigninRestriction and EnterpriseProfileCreationKeepBrowsingData.

  • Chrome 127 on Windows, Mac, Linux
   

   

• Enhanced Safe Browsing promos on iOS  

  In Chrome 127, users who do not already have Enhanced Safe Browsing enabled see an infobar promoting Enhanced Safe Browsing on the Safe Browsing warning page. We also show a promotion for Enhanced Safe Browsing on the Chrome settings page, for users who do not already have Enhanced Safe Browsing enabled. These promos are not shown to users when the SafeBrowsingProtectionLevel enterprise policy is set to any value.

  • Chrome 127 on iOS
   

   

• Entrust certificate distrust  

  In response to sustained compliance failures, Chrome 127 changes how publicly-trusted TLS server authentication, that is, website or certificates issued by Entrust, are trusted by default. This applies to Chrome 127 and later on Windows, macOS, ChromeOS, Android, and Linux; iOS policies do not allow use of the Chrome Root Store in Chrome for iOS.

  Specifically, TLS certificates validating to the Entrust root CA certificates included in the Chrome Root Store and issued:

      - after October 31, 2024, will no longer be trusted by default.

      - on or before October 31, 2024, will be unaffected by this change. 

  If a Chrome user or an enterprise explicitly trusts any of the affected Entrust certificates on a platform and version of Chrome relying on the Chrome Root Store, for example, when explicit trust is conveyed through a Windows Group Policy Object, the Signed Certificate Timestamp (SCT) constraints described above will be overridden and certificates will function as they do today.  

  For additional information and testing resources, see Sustaining Digital Certificate Security - Entrust Certificate Distrust.

  To learn more about the Chrome Root Store, see this FAQ.

  • Chrome 127 on Android, ChromeOS, Linux, Mac, Windows: All versions of Chrome 127 and higher that rely on the Chrome Root Store will honor the blocking action, but the blocking action will only begin for certificates issued after October 31, 2024.
  • Chrome 130 on ChromeOS, Linux, Mac, Windows: The blocking action will begin for certificates issued after October 31, 2024. This will also affect Chrome 127, 128 and 129.
   

   

• Generating insights for DevTools Console warnings and errors  

  In Chrome 127, this Generative AI (GenAI) feature becomes available for managed Chrome Enterprise and Education users in supported regions:  Generating insights for Chrome DevTools Console warnings and errors. These insights provide a personalized description and suggested fixes for the selected errors and warnings. Admins can control this feature by using the DevToolsGenAiSettings policy.

  • Chrome 125 on ChromeOS, Linux, Mac, Windows: Feature becomes available to unmanaged users globally, except Europe, Russia, and China. 
  • Chrome 127 on ChromeOS, Linux, Mac, Windows: Feature becomes available to managed Chrome Enterprise and Education users in supported regions.
   

   

• HTTPS-First Mode in Incognito  

  Starting in Chrome 127, as part of Chrome's move towards HTTPS by default, HTTPS-First Mode is enabled by default in Incognito mode. Users will see a warning before they navigate to sites over insecure HTTP. This can be controlled using the existing enterprise policies HttpsOnlyMode and HttpAllowlist. 

  • Chrome 127 on Android, ChromeOS, LaCrOS, Linux, Mac, Windows
   

   

• Migrate extensions to Manifest V3 before June 2025  

  Extensions must be updated to leverage Manifest V3. Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. Beginning June 2024, starting with Chrome 127 pre-stable versions, Chrome begins to gradually disable Manifest V2 extensions running in the browser. 

  You can use the ExtensionManifestV2Availability policy to test Manifest V3 in your organization ahead of the migration. Additionally, machines on which the policy is enabled will not be subject to the disabling of Manifest V2 extensions until the following year - June 2025 - at which point the policy will be removed.

  You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Enterprise Core. Read more on the Manifest timeline, including: 

   
  • Chrome 127 on ChromeOS, Windows, Mac, Linux: Chrome will gradually disable Manifest V2 extensions on user devices. Only those with the ExtensionManifestV2Availability enterprise policy enabled would be able to continue using Manifest V2 extensions in their organization.
  • Chrome 139 on ChromeOS, LaCrOS, Linux, MacOS, Windows: Remove ExtensionManifestV2Availability policy.
   

   

• Policy to configure ACG for browser process  

  A new policy called DynamicCodeSettings is available in Chrome 127. Setting this policy to '1' switches on Arbitrary Code Guard (ACG) for the browser process. ACG prevents dynamic code being generated from within the browser process, which can help prevent potentially hostile code making unauthorized changes to the behavior of the browser process.

  Switching on ACG might cause compatibility issues with third-party software that must run inside the browser process.

  • Chrome 127 on Windows
   

   

• Simplified sign-in and sync experience on Android  

  Chrome 127 launches a simplified and consolidated version of sign-in and sync in Chrome on Android. Chrome sync is no longer shown as a separate feature in settings or elsewhere. Instead, users can sign in to Chrome to use and save information like passwords, bookmarks and more in their Google Account, subject to the relevant enterprise policies.

  As in earlier releases, the functionality previously part of Chrome sync that saves and accesses Chrome data in the Google Account can be turned off via SyncTypesListDisabled. Sign-in to Chrome can still be disabled via BrowserSignin.

  Note that the changes do not affect users’ ability to sign in to Google services on the web (like Gmail) without signing in to Chrome, their ability to stay signed out of Chrome, or their ability to control what information is synced with their Google Account.

  The changes are virtually identical to the simplified sign-in and sync experience launched on iOS in 117.

  • Chrome 127 on Android
   

   

• Additional Safe Browsing telemetry about pages  

  When an Enhanced Safe Browsing user visits a page that triggers vibration, keyboard or pointer lock API, attributes of that page are now sent to Safe Browsing. If the telemetry is sent and the page seems to be malicious, users see a Safe Browsing warning and their keyboard or pointer is unlocked, if they were locked. If you'd like your users to avail of this feature, set MetricsReportingEnabled to true and set the SafeBrowsingProtectionLevel policy to 2.

  • Chrome 127 on Android, ChromeOS, LaCrOS, Linux, Mac, Windows, Fuchsia 
   

   

• Updated password management experience on Android  

  On Chrome on Android, some users who are signed-in to Chrome but don't have Chrome sync enabled can now use and save passwords in their Google Account. Relevant policies such as BrowserSignin, SyncTypesListDisabled and PasswordManagerEnabled continue to work as before and can be used to configure whether users can use and save passwords in their Google Account.

  • Chrome 127 on Android
   

   

• Watermarking  

  This feature allows admins to overlay a watermark on top of a webpage if navigating to it triggers a specific Data loss Prevention (DLP) rule. It will contain a static string displayed as the watermark. Watermarking is available to Chrome Enterprise Premium customers only. 

  • Chrome 124 on Linux, Mac, Windows: Trusted Tester access
  • Chrome 127 on Linux, Mac, Windows: Feature rolls out
   

   

• Automatic Fullscreen content setting  

  A new Automatic Fullscreen content setting permits Element.requestFullscreen() without a user gesture, and permits browser dialogs to appear without exiting fullscreen.

  The setting is blocked by default and sites cannot prompt for permission. New UI controls are limited to Chrome's settings pages (chrome://settings/content/automaticFullScreen) and the site info bubble. Users can allow Isolated Web Apps, and admins can allow additional origins with the AutomaticFullscreenAllowedForUrls policy. 

  Combined with Window Management permission and unblocked popups (chrome://settings/content/popups), this unlocks valuable fullscreen capabilities:

  - Open a fullscreen popup on another display, from one gesture

  - Show fullscreen content on multiple displays from one gesture

  - Show fullscreen content on a new display, when it's connected

  - Swap fullscreen windows between displays with one gesture

  - Show fullscreen content after user gesture expiry or consumption

  • Chrome 127 on Windows, Mac, Linux
   

   

• Deprecate mutation events  

  Synchronous mutation events, including DOMSubtreeModified, DOMNodeInserted, DOMNodeRemoved, DOMNodeRemovedFromDocument, DOMNodeInsertedIntoDocument, and DOMCharacterDataModified, negatively affect page performance, and also significantly increase the complexity of adding new features to the Web. These APIs were deprecated from the spec in 2011, and were replaced (in 2012) by the much better-behaved Mutation Observer API. Usage of the obsolete mutation events must be removed or migrated to Mutation Observer. In Chrome 124, a temporary enterprise policy, MutationEventsEnabled, was introduced to re-enable deprecated or removed mutation events. 

  Starting in Chrome 127, mutation event support is disabled by default , from around July 30, 2024. Code should be migrated before that date to avoid site breakage. If more time is needed, there are a few options:

  • The Mutation Events Deprecation Trial can be used to re-enable the feature for a limited time on a given site. This can be used through Chrome 134, ending March 25, 2025.
  • A MutationEventsEnabled enterprise policy can also be used for the same purpose, also through Chrome 134.

  For more details,  see this post on the Chrome developer blog. You can report any issues on the Chromium issue tracker.

  • Chrome 127 on Windows, Mac, Linux, Android
   

   

• Keyboard-focusable scroll containers  

  Chrome 127 improves accessibility by making scroll containers focusable using sequential focus navigation. 

  In previous releases, the tab key did not focus scrollers unless tabIndex was explicitly set to 0 or more.

  By making scrollers focusable by default, users who can't (or don't want to) use a mouse can now focus clipped content using keyboard tab and arrow keys. This behavior is enabled only if the scroller does not contain any keyboard focusable children. This logic is necessary so we don't cause regressions for existing focusable elements that might exist within a scroller like a <textarea>.

  • Chrome 127 on Windows, Mac, Linux, Android
   

   

• Support for not condition in ServiceWorker static routing API  

  The ServiceWorker static routing API is an API used for routing the request to the network, the ServiceWorker fetch handler, or directly looking up from cache, and so on. Each route consists of a condition and a source, and the condition is used for matching the request.

  For Chromium implementations, the or condition is only the supported condition. However, to write the condition more flexibly, supporting the not condition is expected, which matches the inverted condition inside.

  • Chrome 127 on Windows, Mac, Linux, Android

   

• New and updated policies in Chrome browser  

  Policy	Description
  DynamicCodeSettings	Policy controls the dynamic code settings
  CSSCustomStateDeprecatedSyntaxEnabled	Controls whether the deprecated :--foo syntax for CSS custom state is enabled
  KeyboardFocusableScrollersEnabled	Enable keyboard focusable scrollers

   

• Removed policies in Chrome browser  

  Policy	Description
  BlockTruncatedCookies	Block truncated cookies
  UserAgentClientHintsGREASEUpdateEnabled	Control the User-Agent Client Hints GREASE Update feature

ChromeOS updates

   

• Chrome Enterprise Premium for file transfers on ChromeOS 

  Chrome Enterprise Premium is a zero trust solution that enables secure access to applications and resources, and offers integrated threat and data protection.

  We are now allowing organizations to extend Chrome Enterprise Premium’s powerful scanning and content and context-based protection to local files on ChromeOS. 

  For example, a misplaced file containing Social Security numbers is instantly blocked when a user attempts to copy it to an external drive, safeguarding this confidential information.

  

  For more details, see Protect Chrome users with Chrome Enterprise Premium; this article contains detailed guidance for both IT administrators and users.

   

• ChromeOS Video Conferencing: DLC States for features 

  ChromeOS 127 introduces a visual enhancement for Downloadable Content (DLC) in the video control panel. This release now adds status indicators for Noise Cancellation, Live Captions, Relighting, and Blur. 

   

• Audio Bluetooth Telephony 

  ChromeOS now supports call control buttons on compatible Bluetooth headsets, including answering, rejecting or terminating a call, and muting the microphone.

   

• OCR on Backlight 

  ChromeOS is launching a PDF OCR AI reader on Gallery, enabling reading for inaccessible documents, further filling the gap in accessibility for low vision and blind users that use a screen reader. ChromeOS leverages its machine learning models to extract, compartmentalize, and section PDF documents to make them more accessible on the Gallery app for ChromeVox users.

   

• Firmware update app: Update Instructions for peripheral devices 

  The Firmware Updates app on ChromeOS now supports updating peripherals that require user action during the update, for example, unplugging and re-plugging the peripheral. When an update is available for one of these devices, the user will be guided with clear, step-by-step instructions. For most existing peripherals, the update experience remains unchanged. 

  

 

   

• Read aloud in Reading Mode 

  As early as ChromeOS 127, Read Aloud will bring Google's high quality voices to Chrome Reading Mode for users to leverage Text to Speech to read content on the web. The goal of Read Aloud is to help people who have difficulty reading to understand long-form text. The new Read Aloud feature in Reading Mode on Chrome desktop allows users to hear the text they are reading, which improves focus and comprehension.

   

• Classroom Glanceables 

  Students can now quickly view and access their upcoming Classroom assignments one click away on their Chromebook home screen. Users can see this new feature if they are logged into a Chromebook with an account where they are enrolled in active courses in Google Classroom. Users can find this feature by clicking on the date chip on the shelf of their Chromebook if they are logged into an account, where they will see the new panel which can view lists of their upcoming, due, missing and completed assignments.

   

• PDF Page deletion and reordering 

  The Gallery app in ChromeOS now supports more options for editing PDF pages. You can now delete or reorder pages within a PDF via mouse or by using keyboard shortcuts. 

  PDF page deletion:

  

   

  PDF page reorder: 

  

Admin console updates

   

• Configure ChromeOS User & browser settings with Google groups   

  Admins can now use Google groups to manage ChromeOS User & browser settings in the Admin console and API. Admins can use new or existing Google Groups to configure User & browser settings in their organizations. When admins need to configure a policy for a specific set of users–who might belong to different organizational units (OUs)–they can use the flexibility of groups without needing to reconfigure their OUs.  To learn more, see Managing group-based policies.

  Today, the majority of user settings are configurable by Groups, with most of the remaining settings available in the coming months. Available settings are automatically filtered and displayed when admins select a particular group.  

  

 

   

• Add managed browsers to groups for group-based policy management   

  Admins can now add managed Chrome browsers to Google groups, thereby allowing them to specify User & browser policies and extension settings for a group of browsers. Managed browsers can be assigned to multiple groups, which allows IT administrators to have more flexibility to manage Chrome browsers using cloud management.

   

   

• Filter for popular and recently added settings with policy tags   

  The Admin console now provides options to filter settings by recently added and popular. With these new filters, you’ll be able to see our newest settings as well as see some of our most popular and relevant Chrome settings. 

   

  

   

   

• Revamped ChromeOS device list and details   

  The Admin console devices page redesigned with a proactive and actionable notification for your fleet of devices. 

  Notifications module: Easily identify and address device issues with the new Notifications module, providing an overview of ongoing problems in your fleet.

  Centralized dashboards:  Quickly access all the information and reports you need about your fleet, all in one convenient location – the Dashboards tab.

  Revamped device list page: Find more detailed information about your devices with new tabs (General, OS, Hardware, Network, and Policy), device-specific notifications, and a new card design for improved readability.

   

  

   

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

    

• Isolated Web Apps  

  Isolated Web Apps (IWAs) are an extension of existing work on PWA installation and Web Packaging that provide stronger protections against server compromise and other tampering that is necessary for developers of security-sensitive applications.

  Rather than being hosted on live web servers and fetched over HTTPS, these applications are packaged into Web Bundles, signed by their developer, and distributed to end-users through one or more of the potential methods described in the explainer.

  In this initial release IWAs will only be installable through an admin policy on enterprise-managed ChromeOS devices.

  • Chrome 128 on ChromeOS

 

    

• Rust JSON parser  

  As early as Chrome 128, Chrome will parse JSON using Rust, rather than C++. This will remove the risk of memory safety vulnerabilities in the JSON parser, improving security. This change should be transparent to users. There is a small risk that some invalid JSON (which Chrome currently accepts) no longer being accepted, although the Rust parser remains extremely lenient.

  • Earliest Chrome 128: Chrome will parse JSON using Rust

 

    

• Clear device data on sign out on iOS  

  Starting in Chrome 128, signing out from a managed account in an unmanaged browser will delete browsing data that is saved on the device. Managed users will be presented a confirmation dialog on sign-out explaining that the data will be cleared. Data will be cleared only from the time of sign-in, otherwise all data will be cleared; time of sign-in is only known if the user signed in on Chrome 122 or later.

  The data that will be deleted includes: 

  • browsing history
  • cookies and site data
  • passwords
  • site settings
  • autofill
  • cached images and files
   
  • Chrome 128 on iOS

  

   

    

• Attribution tags for Search Engine  

  As part of our Digital Markets Act (DMA) compliance, Google is introducing choice screens for users to choose their default search engine within Chrome. The choice from the prompt controls the default search engine setting, currently available at chrome://settings/search.

  Selections from this screen will have their search URL appended with an attribution tag for use by third party search engines to attribute traffic from selections originating from the search engine choice screen. This change will not be applied for Education-configured organizations or Enterprises with metrics or usage statistics turned off.

  For enterprises that have chosen to have their administrator set their enterprise users’ search settings using the enterprise policies DefaultSearchProviderEnabled and DefaultSearchProviderSearchUrl, those policies continue to control their enterprise search settings. Where the administrator has not set their enterprise users’ search settings by policy, enterprise users might see a prompt to choose their default search engine within Chrome.

  Read more about these policies and the related atomic group.

  • Chrome 128 on Android, iOS, ChromeOS, LaCrOS, Linux, Mac, Windows

 

    

• Tab Groups on iPad  

  Chrome for iPad users can create and manage tab groups. This helps users stay organized, reduce clutter and manage their tasks more efficiently.

  • Chrome 128 on iOS

 

    

• Cross-site ancestor chain bit for CookiePartitionKey of partitioned cookies  

  Chrome 128 adds a cross-site ancestor bit to the keying of the partitioned cookie's CookiePartitionKey. This change unifies the partition key with the partition key values used in storage partitioning and adds protection against clickjacking attacks by preventing cross-site embedded frames from having access to the top-level-site's partitioned cookies.

  If an enterprise experiences any breakage with embedded iframes, they can use the CookiesAllowedForUrls policy or use SameSite=None cookies without the Partitioned attribute and then invoke the Storage Access API (SAA) to ensure that embedded iframes have access to the same cookies as the top level domain. 

  • Chrome 128 on Windows, Mac, Linux

 

    

• Rename position-try-options to position-try-fallbacks  

  The CSS working group (CSSWG) resolved to rename this property, because fallbacks more accurately describe what this property controls. The word options is a bit unclear, since the styles outside of `position-try` blocks will be tested first, and if they result in a layout that fits within the containing block, none of the options will get used. So fallbacks is a better word to describe this behavior. For more details, see Github.

  • Chrome 128 on Windows, Mac, Linux, Android

 

    

• Ad-hoc code signatures for PWA shims on macOS  

  Code signatures for the application shims that are created when installing a Progressive Web App (PWA) on macOS are changing to use ad-hoc code signatures that are created when the application is installed. The code signature is used by macOS as part of the application's identity. These ad-hoc signatures will result in each PWA shim having a unique identity to macOS; currently every PWA looks like the same application to macOS.

  This will address problems when attempting to include multiple PWAs in the macOS Open at Login preference pane, and will permit future improvements for handling user notifications within PWAs on macOS.

  • Chrome 129 on Mac

 

    

• Chrome will no longer support macOS 10.15  

  Chrome will no longer support macOS 10.15, which is already outside of its support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security. If run on macOS 10.15, Chrome continues to show an infobar that reminds users that Chrome 129 will no longer support macOS 10.15.

  • Chrome 129 on Mac: Chrome no longer supports macOS 10.15

 

    

• Deprecate Safe Browsing Extended reporting  

  Safe Browsing Extended reporting is a feature that enhances the security of all users by collecting telemetry information from participating users that is used for Google Safe Browsing protections. The data collected includes URLs of visited web pages, limited system information, and some page content. However, this feature is now superseded by Enhanced protection mode. We suggest users switch to Enhanced protection to continue providing security for all users in addition to enabling the strongest security available in Chrome. For more information, see Safe Browsing protection levels. 

   

  

   
  • Chrome 129 on Android, iOS, ChromeOS, Linux, Mac, Windows: Deprecation of Safe Browsing Extended Reporting

 

    

• Deprecation of non-standard declarative shadow DOM serialization  

  The prototype implementation, which was shipped in 2020 and then updated in 2023, contained a method called `getInnerHTML()` that could be used to serialize DOM trees containing shadow roots. That part of the prototype was not standardized with the rest of declarative shadow DOM, and has only recently reached spec consensus (for details, see Github). As part of that consensus, the shape of the getInnerHTML API changed.

  This feature represents the deprecation of the previously shipped `getInnerHTML()` method. The replacement is called `getHTML()`, which shipped in Chrome 125. For details, see this ChromeStatus feature description.

  • Chrome 129 on Windows, Mac, Linux, Android

 

    

• Deprecate the includeShadowRoots argument on DOMParser  

  The includeShadowRoots argument was a never-standardized argument to the DOMParser.parseFromString() function, which was there to allow imperative parsing of HTML content that contains declarative shadow DOM. This was shipped in Chrome 90 as part of the initial shipment of declarative shadow DOM. Since the standards discussion rematerialized in 2023, the shape of DSD APIs changed, including this feature for imperative parsing. To read more, see details of the context on the related standards, and information is also available on the related deprecations of shadow DOM serialization and shadow root attribute.
  Now that a standardized version of this API, in the form of setHTMLUnsafe() and parseHTMLUnsafe() shipped in Chrome 124, the non-standard includeShadowRoots argument needs to be deprecated and removed. All usage should shift accordingly:
  Instead of:
    (new DOMParser()).parseFromString(html,'text/html',{includeShadowRoots: true});
  This can be used instead:
    document.parseHTMLUnsafe(html);

  • Chrome 129 on Linux, Mac, Windows, Android

 

    

• Network Service on Windows will be sandboxed  

  To improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions. You can use the Chromium bug tracker to report any issues you encounter.

  • Chrome 130 on Windows: Network Service sandboxed on Windows

 

    

• Third-party cookie access in Chrome 

  On 22 July 2024, we announced a new path forward for the Privacy Sandbox on the web. Instead of deprecating third-party cookies, we plan to introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing. They would be able to adjust that choice at any time. We're discussing this new path with regulators, and will engage with the industry as we roll this out. 

  
  For more details, see this Privacy Sandbox update.

 

    

• User Link capturing on PWAs  

  Web links automatically direct users to installed web apps. To better align with users' expectations around installed web apps, Chrome makes it easier to move between the browser and installed web apps. When the user clicks a link that could be handled by an installed web app, Chrome adds a chip in the address bar to suggest switching over to the app. When the user clicks the chip, this either launches the app directly, or opens a grid of apps that can support that link. For some users, clicking a link always automatically opens the app.

  • Chrome 121 on Linux, Mac, Windows: When some users click a link, it always opens in an installed PWA, while some users see the link open in a new tab with a chip in the address bar, clicking on which will launch the app. A flag is available to control this feature: chrome://flags/#enable-user-link-capturing-pwa.
  • Chrome 130 on Linux, Mac, Windows: Launch to 100% of Stable with either a default on (always launch apps on link clicks) or a default off (always open in a tab, only launch if the user clicks on chip on address bar).

   

    

• Private network access checks for navigation requests: warning-only mode  

  Before a website A navigates to another site B in the user's private network, this feature does the following:

  1. Checks whether the request has been initiated from a secure context.

  2. Sends a preflight request, and checks whether B responds with a header that allows private network access.

  There are already features for subresources and workers, but this one is for navigation requests specifically. These checks protect the user's private network.  

  Since this feature is the warning-only mode, we do not fail the requests if any of the checks fail. Instead, a warning will be shown in the DevTools console, to help developers prepare for the coming enforcement.

  • Chrome 130 on Windows, Mac, Linux, Android

 

    

• Insecure form warnings on iOS  

  Chrome 125 started to block form submissions from secure pages to insecure pages on iOS. When Chrome detects an insecure form submission, it now displays a warning asking the user to confirm the submission. The goal is to prevent leaking of form data over plain text without user's explicit approval. A policy InsecureFormsWarningsEnabled is available to control this feature, and will be removed in Chrome 130.

  • Chrome 125 on iOS: Feature rolls out
  • Chrome 130 on iOS: InsecureFormsWarningsEnabled policy will be removed

 

    

• Remove enterprise policy used for legacy same site behavior  

  In Chrome 79, we introduced the LegacySameSiteCookieBehaviorEnabledForDomainList policy to revert the SameSite behavior of cookies to legacy behavior on the specified domains. The LegacySameSiteCookieBehaviorEnabledForDomainList policy’s lifetime has been extended and will be removed on the milestone listed below.

  • Chrome 132 on Android, ChromeOS, Linux, Mac, Windows: Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy

 

    

• X25519Kyber768 key encapsulation for TLS  

  Starting in Chrome 124, Chrome enables by default on all desktop platforms a new post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard (ML-KEM). This protects network traffic from Chrome with servers that also support ML-KEM from decryption by a future quantum computer. This is exposed as a new TLS cipher suite. TLS automatically negotiates supported ciphers, so this change should be transparent to server operators. This cipher will be used for both TLS 1.3 and QUIC connections.

  However, some TLS middleboxes might be unprepared for the size of a Kyber (ML-KEM) key encapsulation, or a new TLS ClientHello cipher code point, leading to dropped or hanging connections. This can be resolved by updating your middlebox, or disabling the key encapsulation mechanism via the temporary PostQuantumKeyAgreementEnabled enterprise policy, which will be available through the end of 2024. However, long term, post-quantum secure ciphers will be required in TLS and the enterprise policy will be removed. Post-quantum cryptography is required for CSNA 2.0.

  For more detail, see this Chromium blog post.

  • Chrome 124 on Windows, Mac, Linux
  • Chrome 135 on Android

 

    

• UI Automation accessibility framework provider on Windows  

  Starting in Chrome 126, Chrome will start directly supporting accessibility client software that uses Microsoft Windows's UI Automation accessibility framework. Prior to this change, such software interoperated with Chrome by way of a compatibility shim in Microsoft Windows. This change is being made to improve the accessible user experience for many users. It provides complete support for Narrator, Magnifier, and Voice Access; and will improve third-party apps that use Windows's UI Automation accessibility framework. Users of Chrome will find reduced memory usage and processing overhead when used with accessibility tools. It will also ease development of software using assistive technologies.

  Administrators might use the UiAutomationProviderEnabled enterprise policy, available from Chrome 125, to either force-enable the new provider (so that all users receive the new functionality), or disable the new provider. This policy will be supported through Chrome 136, and will be removed in Chrome 137. This one-year period is intended to give enterprises sufficient time to work with third-party vendors so that they may fix any incompatibilities resulting from the switch from Microsoft's compatibility shim to Chrome's UI Automation provider.

  • Chrome 125 on Windows:The UiAutomationProviderEnabled policy is introduced so that administrators can enable Chrome's UI Automation accessibility framework provider and validate that third-party accessibility tools continue to work.
  • Chrome 126 on Windows: The Chrome variations framework will be used to begin enabling Chrome's UI Automation accessibility framework provider for users. It will be progressively enabled to the full stable population, with pauses as needed to address compatibility issues that can be resolved in Chrome. Enterprise administrators may continue to use the UiAutomationProviderEnabled policy to either opt-in early to the new behavior, or to temporarily opt-out through Chrome 136.
  • Chrome 137 on Windows: The UiAutomationProviderEnabled policy will be removed from Chrome. All clients will use the browser's UI Automation accessibility framework provider.

 

Upcoming ChromeOS changes

   

• Snap groups on ChromeOS  

  As early as ChromeOS 127, Snap groups will allow you to group windows on ChromeOS. A snap group is formed when a user pairs two windows for a split-screen. The windows can then be brought back together, resized simultaneously, or moved as a group.

   

• Data processor mode: EU-wide rollout  

  In ChromeOS 128, new data processor mode features and ChromeOS terms will be made available to the entire EU through the Google Admin console. For more details, see Overview of ChromeOS data processor mode. 

  As a ChromeOS administrator, you’ll have the option to activate Data processor mode, which covers  a set of ChromeOS features and services referred to as Essential Services.

   

• Privacy Hub: Geolocation  

  As early as ChromeOS 128, we will make privacy on Chromebooks easier to manage by adding the ability to control geolocation access to the privacy controls page. Users will be able to set geolocation access to Allowed, System Only, or Blocked depending on their preference. 

  We will allow users to block all apps or websites, or entire systems access to geolocation regardless of previously granted permissions, and provide users easy to use controls to re-enable them whenever it would be helpful.

Upcoming Admin console changes

   

• Chrome browser managed profile reporting 

  Chrome Enterprise Core will introduce new Chrome browser managed profile reporting in the Admin console. This feature will provide a new Managed profile listing and detail pages. On these pages, IT administrators will be able to find reporting information on managed profiles such as profile details, browser versions, policies applied, and more.

  • Chrome 130 on Android, Linux, Mac, Windows

   

• Admin console widget for data controls 

  A new settings widget in the Admin console allows users to configure data controls policies for specific URLs. 

  • Chrome 128 on ChromeOS, Linux, Mac, Windows

Chrome browser updates	Security/ Privacy	User productivity/ Apps	Management
Chrome Third-Party Cookie Deprecation (3PCD)	✓
Extract text from PDFs for screen reader users		✓
Memory Saver aggressiveness		✓
Out of process iframe PDF viewer		✓
Reactive prefetch on Desktop	✓
Tab Groups on iPad		✓
UI Automation accessibility framework provider on Windows			✓
Removing support for UserAgentClientHintsGREASEUpdateEnabled	✓		✓
Align navigator.cookieEnabled with spec	✓
Search with Google Lens		✓
New and updated policies in Chrome browser			✓
ChromeOS updates	Security/ Privacy	User productivity/ Apps	Management
Extended auto-update opt-in			✓
Digital zoom with super resolution		✓
Set up new Chromebook with Android phone		✓
Instant Hotspot		✓
Enhanced firmware updates	✓		✓
Web apps to capture multiple surfaces		✓
Remote CRD for idle devices	✓
Captive portal for managed networks	✓		✓
Turn off overscroll behavior		✓
Turn off cursor blink rate		✓
Magnifier can follow Select to Speak focus		✓
Supervised user extensions installation flow		✓
Multi-calendar support		✓
New policy to control Kiosk wake and sleep times			✓
Locale expansion for Live Captions and Dictation		✓
Show wildcard URLs in Data Controls reporting			✓
Admin console updates	Security/ Privacy	User productivity/ Apps	Management
Custom configurations for IT admins			✓
Interactive setup guides for Chrome Enterprise Core			✓
New policies in the Admin console			✓
Upcoming Chrome browser changes	Security/ Privacy	User productivity/ Apps	Management
Entrust certificate distrust	✓
App-bound encryption for cookies	✓
Chrome extension telemetry integration with Chronicle	✓
Generating insights for DevTools console warnings and errors			✓
Migrate extensions to Manifest V3 before June 2025	✓	✓	✓
Network Service on Windows will be sandboxed	✓
Simplified sign-in and sync experience on Android		✓
Telemetry about pages that trigger keyboard and pointer Lock APIs	✓
Updated password management experience on Android	✓	✓
Watermarking	✓
Automatic fullscreen content setting		✓
Cross-site ancestor chain bit for CookiePartitionKey of partitioned cookies			✓
Deprecate mutation events	✓
Keyboard-focusable scroll containers	✓
Support for not condition in Service Worker static routing API	✓
Ad-hoc code signatures for PWA shims on macOS		✓
Deprecate Safe Browsing Extended reporting	✓
Chrome will no longer support macOS 10.15	✓		✓
User link capturing on PWAs		✓	✓
Deprecate the includeShadowRoots argument on DOMParser	✓
Insecure form warnings on iOS	✓
Private network access checks for navigation requests: warning-only mode	✓
Remove enterprise policy used for legacy same site behavior			✓
X25519Kyber768 key encapsulation for TLS	✓
Upcoming ChromeOS changes	Security/ Privacy	User productivity/ Apps	Management
Snap Groups		✓
Read Aloud in Reading Mode		✓
Upcoming Admin console changes	Security/ Privacy	User productivity/ Apps	Management
Filter for popular and recently added settings with policy tags			✓
Chrome browser managed profile reporting			✓
Group based policy for Chrome browser			✓

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.

Chrome Enterprise and Education release notes are published in line with the Chrome release schedule, on the Early Stable date for Chrome browser.

Chrome browser updates

   

• Chrome Third-Party Cookie Deprecation (3PCD)  

  Third party cookies will be restricted in a future release of Chrome. Currently, they are restricted by default for 1% of Chrome users to allow sites to preview the user experience without third-party cookies. Most enterprises are excluded from this group automatically and admins can use the BlockThirdPartyCookies and CookiesAllowedForUrls policies to re-enable third-party cookies if needed.

  End users can use the eye icon in the omnibox to temporarily re-enable third-party cookies for 90 days on a given site when necessary. See this help article for more details on how to toggle these settings for the desired configuration. Bounce tracking protections are enforced when the bouncing site is not permitted to use 3P cookies, and are controllable with the same policies. Enterprise SaaS integrations used in a cross-site context for non-advertising use cases can register for the third-party deprecation trial or the first-party deprecation trial for continued access to third-party cookies for a limited period of time.

  For more details on how to prepare, provide feedback and report potential site issues, refer to our updated landing page on preparing for the end of third-party cookies.

  • Starting in Chrome 120 on ChromeOS, Linux, macOS, Windows
    1% of global traffic has third-party cookies disabled. Enterprise users are excluded from this automatically where possible, and a policy is available to override the change.

   

• Extract text from PDFs for screen reader users  

  Chrome browser now launches an optical character recognition (OCR) AI reader for PDFs, creating a built-in PDF screen reader for inaccessible documents, further filling the gap in accessibility for low vision and blind users across the web.

  This feature leverages Google's OCR models to extract, compartmentalize, and section PDF documents to make them more accessible. A local machine intelligence library will be added that uses Screen AI technology to analyze screenshots or the accessibility tree, and extract more information to help assistive technology, such as texts (OCR) and main content of the page.

  

  • Chrome 126 on ChromeOS, Linux, Mac, Windows: Already fully launched on ChromeOS. Ramping up from 50% Canary/Dev/Beta to Stable on Linux, Mac, and Windows.

   

• Memory Saver aggressiveness  

  Memory Saver is a feature that deactivates unused tabs to free up memory on a user's device. There is an existing policy, HighEfficiencyModeEnabled, which allows administrators to control the Memory Saver feature. A new policy called MemorySaverModeSavings allows you to configure how aggressive the Memory Saver is when deciding to deactivate tabs. Choose the conservative option to deactivate fewer tabs or the aggressive one to get the most memory savings.

  • Chrome 126 on ChromeOS, LaCrOS, Linux, Mac, Windows: The feature will roll out gradually to all platforms.

   

• Out of process iframe PDF viewer  

  In Chrome 126, some users use an out-of-process iframe (OOPIF) architecture for the PDF viewer. This is the new PDF viewer architecture, as it is simpler and makes adding new features easier. An enterprise policy, PdfViewerOutOfProcessIframeEnabled, is available to revert to using the original PDF viewer architecture.

  • Chrome 126 on Linux, Mac, Windows

   

• Reactive prefetch on Desktop  

  This feature enables prefetching of subresources during a navigation, to speed up navigations and load new pages faster. The subresources prefetched are predicted by a Google-owned service, and the browser shares the URL of pages being navigated to with this service, to retrieve predictions. You can control this feature using the UrlKeyedAnonymizedDataCollectionEnabled policy.

  • Chrome 126 on ChromeOS, LaCrOS, Linux, Mac, Windows

   

• Tab Groups on iPad  

  Chrome for iPad users can create and manage tab groups. This helps users stay organized, reduce clutter and manage their tasks more efficiently.

  • Chrome 126 on iOS

   

• UI Automation accessibility framework provider on Windows  

  Starting in Chrome 126, Chrome starts to directly support accessibility client software that uses Microsoft Windows's UI Automation accessibility framework. Prior to this change, such software interoperated with Chrome using a compatibility shim in Microsoft Windows. This change improves the user experience for many users. It provides complete support for Narrator, Magnifier, and Voice Access; and it improves third-party apps that use Windows's UI Automation accessibility framework. Chrome users now find reduced memory usage and processing overhead when using accessibility tools. It also eases development of software using assistive technologies.
  Administrators can use the UiAutomationProviderEnabled enterprise policy, introduced in Chrome 125, to either force-enable the new provider (so that all users receive the new functionality), or disable the new provider. This policy will be supported through Chrome 136, and will be removed in Chrome 137. This one-year period is intended to give enterprises sufficient time to work with third-party vendors so that they can fix any incompatibilities resulting from the switch from Microsoft's compatibility shim to Chrome's UI Automation provider.

  • Chrome 125 on Windows: The UiAutomationProviderEnabled policy is introduced so that administrators can enable Chrome's UI Automation accessibility framework provider and validate that third-party accessibility tools continue to work.
  • Chrome 126 on Windows: The Chrome variations framework will be used to begin enabling Chrome's UI Automation accessibility framework provider for users. It will be progressively enabled to the full stable population, with pauses as needed to address compatibility issues that can be resolved in Chrome. Enterprise administrators may continue to use the UiAutomationProviderEnabled policy to either opt-in early to the new behavior, or to temporarily opt-out through Chrome 136.
  • Chrome 137 on Windows: The UiAutomationProviderEnabled policy will be removed from Chrome. All clients will use the browser's UI Automation accessibility framework provider.

   

• Removing support for UserAgentClientHintsGREASEUpdateEnabled  

  Chrome 126 removes the UserAgentClientHintsGREASEUpdateEnabled policy since the updated GREASE algorithm has been on by default for over a year.

  • Chrome 124 on Android, ChromeOS, Linux, Mac, Windows: Policy is deprecated
  • Chrome 126 on Android, ChromeOS, Linux, Mac, Windows: Policy is removed

   

• Align navigator.cookieEnabled with spec  

  navigator.cookieEnabled currently indicates if the user agent attempts to handle cookies in a given context. A change in Chrome, shipping as part of third-party cookie deprecation (3PCD), would cause it to indicate whether unpartitioned cookie access is possible (causing it to return false in most cross-site iframes). We should restore the prior behavior of navigator.cookieEnabled which indicated only if cookies were enabled or disabled for the site and rely on the cross-vendor function document.hasStorageAccess to indicate if unpartitioned cookie access is possible.

  • Chrome 126 on Windows, Mac, Linux, Android

   

• Search with Google Lens  

  As early as Chrome 126, users will be able to search any images or text they see on their screen with Google Lens. To use this feature, go to a website and click Search with Google Lens on the on-focus omnibox chip, on the right-click menus, or on the 3-dot menu. Users can click, highlight, or drag anywhere on the screen to search its contents, and refine their search by adding keywords or questions to the searchbox. Admins can control the feature through a policy called LensOverlaySettings. To perform the search, a screenshot of the screen is sent to Google servers but it is not linked to any IDs or accounts, it is not viewed by any human, and data about its contents is not logged. 

  We are rolling out this feature gradually in Chrome 126 and we plan to launch fully in Chrome 127.

  • Chrome 126 on ChromeOS, Linux, Mac, Windows: Rollout of the feature at 1% Stable and LensOverlaySettings becomes available
  • Chrome 127: Rollout to 100% stable

   

• New and updated policies in Chrome browser  

  Policy	Description
  LensOverlaySettings	Settings for the Lens Overlay feature
  MemorySaverModeSavings	Change Memory Saver Mode Savings
  ProvisionManagedClientCertificateForUser	Enables the provisioning of client certificates for a managed user or profile
  PdfViewerOutOfProcessIframeEnabled	Use out-of-process iframe PDF Viewer

ChromeOS updates

   

• Extended auto-update opt-in and policy 

  ChromeOS provides 10 years of OS updates for security, stability, and performance improvements. Most devices will receive these updates automatically. For a subset of older devices, users and administrators can now opt in to extended updates to get a full 10 years of support. 

  For details, see our Help Center article.

   

• Digital zoom with super resolution 

  The built-in Camera app now supports zooming on cameras that do not have optical zoom motors, including the built-in camera. On selected high-performance Chromebooks, AI-based super resolution may be applied to further enhance the images.

   

• Set up new Chromebook with Android phone 

  You can now set up a new Chromebook using your Android phone. By establishing a secure connection between your phone and the Chromebook, you can automatically transfer your Wi-Fi and Google Account login information without needing to manually enter your passwords. This is available for unmanaged users only.

  

   

• Instant Hotspot 

  ChromeOS 126 renames the Instant Tethering feature to Instant Hotspot.

   

• Enhanced firmware updates 

  ChromeOS 126 supports firmware updates on a wide variety of additional peripherals. This significantly reduces the overhead and time needed to make new firmware updates available.

   

• Web apps to capture multiple surfaces 

  Web apps can now capture multiple surfaces at once. This feature introduces a new API getAllScreensMedia() that allows developers to request several surfaces at once (instead of only one with getDisplayMedia()). This API auto-accepts capture requests, for managed sessions only, guarded by policies that have to be explicitly set by the device owners and with clear usage indicators so that users are aware of capturing at all times. For details, see our Help Center article.

   

• Remote management for idle devices 

  Chrome Remote Desktop (CRD) is a feature that allows for remote control of ChromeOS devices, primarily for troubleshooting purposes, where a device is idle and unused. Admins can now initiate a CRD connection to a ChromeOS device sitting on the login screen. This enables an admin to sign-in to a managed device with their own set of credentials for troubleshooting or testing.

  

   

• Captive portal for managed networks 

  Given that captive portal detection is always disabled for managed networks, administrators are unable to configure the ChromeOS device to auto connect to captive portal networks or to detect that the captive portal exists. If they do make the captive portal network managed, users have to manually open a browser and connect to an HTTP site that can then be redirected to a portal sign in page. We’ve added a new policy, CaptivePortalAuthenticationIgnoresProxy, which allows admins to force portal detection.

  

   

• Turn off overscroll behavior  

  A new setting is available to turn on and off the swipe gesture to navigate between pages. This feature is also known as overscroll or overscrolling pages. This setting is found under Settings > Accessibility > Cursor and touchpad > Use a swipe gesture to navigate between pages.

   

• Turn off cursor blink rate 

  A new setting is available to turn off the blinking text cursor under Settings > Accessibility > Keyboard and text input > Text cursor blink rate. Customers with photosensitive seizure triggers and cognitive differences may want to turn off the blinking text cursor.

   

• Magnifier to follow Select to Speak 

  Magnifier following Select to Speak is a feature designed for people who have low vision, but may be beneficial for anyone who enjoys reading text at larger sizes. When you read text aloud using Select to Speak, the screen magnifier will automatically follow the words, so you never lose your place. To try this out you can enable both Magnifier and Select to Speak in your settings. Zoom in to your preferred zoom level using Ctrl + Alt + Brightness up and Ctrl + Alt + Brightness down. Select the text you want to read out and press the Select to Speak play button, or Search + S. A setting is available under the Magnifier settings to adjust this behavior.

   

• Supervised user extensions installation 

  For supervised accounts managed via Family Link, we are separating the parental control for Permissions for sites, extensions, and apps to give parents more granular control. Parents now have two options to choose from: Permissions for apps and Extensions. The impact on supervised accounts is that a parent can now allow extensions installations with or without approval. Previously, parents could block extensions but had no way to allow them without approval.

   

• Multi-calendar support 

  We are launching multi-calendar support to allow users view all events from multiple calendars that they have selected within their Google Calendar.

  

   

• New policy to control Kiosk wake and sleep times 

  ChromeOS 126 introduces a new kiosk device policy that allows Admins to schedule when a device will wake and sleep. For more details, see Kiosk settings.

   

• Locale expansion for Live Captions and Dictation 

  ChromeOS 126 expands support for  live captions from 1 to 6 languages and dictation from 1 to 18 locales. We now use a new voice recognition model that provides additional battery savings.

  Live captions on ChromeOS can be used on videos played with the Gallery player app, in YouTube, in Google Meet, in Zoom, or social media sites. To see or change your current live captions language, select Settings > Audio and captions > Live Caption > Manage languages.  For more information on live captions, see this Help Center article.

  Dictation is available on Google Docs, or in any other text input by enabling dictation in the taskbar, clicking the Mic button, and speaking. To see or change your dictation language, select Settings > Accessibility > Keyboard and text input > Dictation > Language.  For more information on dictation, see this Help Center article.

   

• Show wildcard URLs in Data Controls reporting 

  ChromeOS Data Control rules allow admins to define source and destination URLs as a wildcard (*) value. ChromeOS data control events are reported under the Chrome audit report and can be viewed in the Admin console or other platforms through the Chrome Reporting Connector. When examining log events, the URL that triggered the rule is now reported, instead of the wildcard.

Admin console updates

   

• Custom configurations for IT admins   

  The Custom Configurations page allows IT admins to configure Chrome policies that are not yet in the Admin console, using JSON scripts. As a result, all Chrome policies are now configurable in Chrome Enterprise Core, either using the Settings page or the Custom Configurations page. You can also use the page to configure extension installation mode not supported in the Admin console, such as normal_installed. This feature is available for browsers enrolled at the machine-level. 

  • As early as Chrome 126 on Android, iOS, Linux, MacOS, Windows: Trusted Tester access
  • As early as Chrome 127 on Android, iOS, Linux, MacOS, Windows: Feature rolls out

   

• Interactive setup guides for Chrome Enterprise Core   

  The Chrome Enterprise team introduces new interactive setup guides for browser management in the Admin console, where administrators can choose a journey they’re interested in and get hands-on training in related Chrome setup guides. For example, the guides can be used to learn how to:

  • Create test organizational units
  • Turn on reporting
  • Enroll browsers
  • Apply browser policies
  • Configure extension settings
  • Create an admin user

  These guides are ideal for new administrators or for administrators who wish to learn new journeys.

  
  • As early as Chrome 126: Feature rolls out

 

   

• New policies in Admin console   
   

  Policy Name	Pages	Supported on	Category/Field
  DeviceExtendedAutoUpdateEnabled	Device	ChromeOS	Device update settings
  LocalUserFilesAllowed	Users & Browser	ChromeOS	User experience
  ScreenCaptureLocation	Users & Browser	ChromeOS	User experience

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

    

• Entrust certificate distrust  

  In response to sustained compliance failures, Chrome is changing how publicly-trusted TLS server authentication, that is, website, certificates issued by Entrust will be trusted by default in Chrome 127 and greater on Windows, macOS, ChromeOS, Android, and Linux.  iOS policies do not allow use of the Chrome Root Store in Chrome for iOS.

  Specifically: 

  - TLS certificates validating to the Entrust root CA certificates included in the Chrome Root Store and issued:

      - after October 31, 2024, will no longer be trusted by default.

      - on or before October 31, 2024, will be unaffected by this change. 

  Should a Chrome user or enterprise explicitly trust any of the affected Entrust certificates on a platform and version of Chrome relying on the Chrome Root Store, for example, explicit trust is conveyed through a Windows Group Policy Object, the SCT-based constraints described above will be overridden and certificates will function as they do today.  

  For additional information and testing resources, see Sustaining Digital Certificate Security - Entrust Certificate Distrust.

  To learn more about the Chrome Root Store, see this FAQ.

  • Chrome 127 on Android, ChromeOS, Linux, Mac, Windows: All versions of Chrome 127 and higher that rely on the Chrome Root Store will honor the blocking action, but the blocking action will only begin for certificates issued after October 31, 2024.
  • Chrome 130 on ChromeOS, Linux, Mac, Windows: The blocking action will begin for certificates issued after October 31, 2024. This will also affect Chrome 127, 128 and 129.

    

• App-bound encryption for cookies  

  To improve the security of cookies on Windows, the encryption key used for cookie encryption will be further secured by binding it to Chrome's application identity. This can help protect against malware that might attempt to steal cookies from the system. This does not protect against an attacker who is able to elevate privilege or inject into Chrome's processes.

  An enterprise policy, ApplicationBoundEncryptionEnabled, is available to disable application-bound encryption.

  • Chrome 127 on Windows 

    

• Chrome extension telemetry integration with Chronicle  

  We plan to collect relevant extension telemetry data from within Chrome, for managed profiles and devices, and send it to Chronicle. Chronicle will analyze the data to provide insight and context on risky activity.

  • Chrome 127 on ChromeOS, LaCrOS, Linux, Mac, Windows

    

• Generating insights for DevTools console warnings and errors  
  In Chrome 125, a new Generative AI (GenAI) feature became available for unmanaged users:  Generating insights for Chrome DevTools Console warnings and errors. These insights provide a personalized description and suggested fixes for the selected errors and warnings. Initially, this feature is only available to users (18+) in English. Admins can control this feature by using the DevToolsGenAiSettings policy.
  • Chrome 125 on ChromeOS, Linux, Mac, Windows: Feature becomes available to unmanaged users globally, except Europe, Russia, and China.
  • Chrome 127 on ChromeOS, Linux, Mac, Windows: Feature becomes available to managed Chrome Enterprise and Education users in supported regions.

    

• Migrate extensions to Manifest V3 before June 2025  

  Extensions must be updated to leverage Manifest V3. Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. Beginning June 2024, starting with Chrome 127 pre-stable versions, Chrome will gradually disable Manifest V2 extensions running in the browser. An enterprise policy, ExtensionManifestV2Availability , can be used to test Manifest V3 in your organization ahead of the migration. Additionally, machines on which the policy is enabled will not be subject to the disabling of Manifest V2 extensions until the following year, June 2025, at which point the policy will be removed.

  You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Enterprise Core. Read more on the Manifest timeline, including:

  • Chrome 127 on ChromeOS, LaCrOS, Linux, Mac, Windows: Chrome will gradually disable Manifest V2 extensions on user devices. Only those with the ExtensionManifestV2Availability enterprise policy enabled would be able to continue using Manifest V2 extensions in their organization.
  • Chrome 139 on ChromeOS, LaCrOS, Linux, MacOS, Windows: Remove ExtensionManifestV2Availability policy.

    

• Network Service on Windows will be sandboxed  

  To improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions. You can report any issues you encounter.

  • Chrome 127 on Windows: Network Service sandboxed on Windows

    

• Simplified sign-in and sync experience on Android  

  Chrome will launch a simplified and consolidated version of sign-in and sync in Chrome on Android. Chrome sync will no longer be shown as a separate feature in settings or elsewhere. Instead, users can sign in to Chrome to use and save information like passwords, bookmarks and more in their Google Account, subject to the relevant enterprise policies.

  As before, the functionality previously part of Chrome sync that saves and accesses Chrome data in the Google Account can be turned off via SyncTypesListDisabled. Sign-in to Chrome can be disabled via BrowserSignin as before.

  Note that the changes do not affect users’ ability to sign in to Google services on the web (like Gmail) without signing in to Chrome, their ability to stay signed out of Chrome, or their ability to control what information is synced with their Google Account.

  The changes are virtually identical to the simplified sign-in and sync experience launched on iOS in 117.

  • Chrome 127 on Android

   

• Telemetry about pages that trigger keyboard and pointer Lock APIs  

  When an Enhanced Safe Browsing user visits a page that triggers keyboard or pointer lock API, attributes of that page will be sent to Safe Browsing.

  If the telemetry is sent and the page seems to be malicious, users will see a Safe Browsing warning and their keyboard or pointer will be unlocked if they were locked.

  • Chrome 127 on Android, ChromeOS, LaCrOS, Linux, MacOS, Windows, Fuchsia

    

• Updated password management experience on Android  
  On Chrome on Android, some users who are signed-in to Chrome but don't have Chrome sync enabled will be able to use and save passwords in their Google Account. Relevant enterprise policies such as BrowserSignin, SyncTypesListDisabled and PasswordManagerEnabled will continue to work as before and can be used to configure whether users can use and save passwords in their Google Account.
  • Chrome 127 on Android

    

• Watermarking  

  This feature will allow admins to overlay a watermark on top of a web page if navigating to it triggers a specific DLP rule. It will contain a static string displayed as the watermark. Watermarking will be available to Chrome Enterprise Premium customers. 

  • Chrome 124 on Linux, Mac, Windows: Trusted Tester access
  • Chrome 127 on Linux, Mac, Windows: Feature rolls out

     

• Automatic Fullscreen content setting  

  A new Automatic Fullscreen content setting permits Element.requestFullscreen() without a user gesture, and permits browser dialogs to appear without exiting fullscreen.

  The setting is blocked by default and sites cannot prompt for permission. New UI controls are limited to Chrome's settings pages (chrome://settings/content/automaticFullScreen) and the site info bubble. Users can allow Isolated Web Apps, and enterprise admins can allow additional origins with the AutomaticFullscreenAllowedForUrls policy. 

  Combined with Window Management permission and unblocked popups (chrome://settings/content/popups), this unlocks valuable fullscreen capabilities:

  - Open a fullscreen popup on another display, from one gesture

  - Show fullscreen content on multiple displays from one gesture

  - Show fullscreen content on a new display, when it's connected

  - Swap fullscreen windows between displays with one gesture

  - Show fullscreen content after user gesture expiry or consumption

  • Chrome 127 on Windows, Mac, Linux

    

• Cross-site ancestor chain bit for CookiePartitionKey of partitioned cookies  

  Chrome 127 will add a cross-site ancestor bit to the keying of the partitioned cookie's CookiePartitionKey. This change unifies the partition key with the partition key values used in storage partitioning and adds protection against clickjacking attacks by preventing cross-site embedded frames from having access to the top-level-site's partitioned cookies.

  If an enterprise experiences any breakage with embedded iframes, they can use the CookiesAllowedForUrls policy or use SameSite=None cookies without the Partitioned attribute and then invoke the Storage Access API (SAA) to ensure that embedded iframes have access to the same cookies as the top level domain.

  • Chrome 127 on Windows, Mac, Linux

    

• Deprecate mutation events  

  Synchronous mutation events, including DOMSubtreeModified, DOMNodeInserted, DOMNodeRemoved, DOMNodeRemovedFromDocument, DOMNodeInsertedIntoDocument, and DOMCharacterDataModified, negatively affect page performance, and also significantly increase the complexity of adding new features to the Web. These APIs were deprecated from the spec in 2011, and were replaced (in 2012) by the much better-behaved Mutation Observer API. Usage of the obsolete mutation events must be removed or migrated to Mutation Observer. Starting in Chrome 124, a temporary enterprise policy, MutationEventsEnabled, will be available to re-enable deprecated or removed mutation events. If you encounter any issues, file a bug here.

  Mutation event support will be disabled by default starting in Chrome 127, around July 30, 2024. Code should be migrated before that date to avoid site breakage. If more time is needed, there are a few options:

  • The Mutation Events Deprecation Trial can be used to re-enable the feature for a limited time on a given site. This can be used through Chrome 134, ending March 25, 2025.
  • A MutationEventsEnabled enterprise policy can also be used for the same purpose, also through Chrome 134.

  Please see this blog post for more detail. Report any issues here.

  • Chrome 127 on Windows, Mac, Linux, Android

   

• Keyboard-focusable scroll containers  

  Making scroll containers focusable using sequential focus navigation greatly improves accessibility. Today, the tab key doesn't focus scrollers unless tabIndex is explicitly set to 0 or more.

  By making scrollers focusable by default, users who can't (or don't want to) use a mouse will be able to focus clipped content using a keyboard's tab and arrow keys. This behavior is enabled only if the scroller does not contain any keyboard focusable children. This logic is necessary so we don't cause regressions for existing focusable elements that might exist within a scroller like a <textarea>.

  • Chrome 127 on Windows, MacOS, Linux, Android

    

• Support for not condition in Service Worker static routing API  

  The Service Worker static routing API is an API used for routing the request to the network, the Service Worker fetch handler, or directly looking up from cache, and so on.  Each route consists of a condition and a source, and the condition is used for matching the request.

  For Chromium implementations, the or condition is the only supported condition.  However, to write the condition more flexibly, supporting the not condition is expected, which matches the inverted condition inside.

  • Chrome 127 on Windows, Mac, Linux, Android

    

• Ad-hoc code signatures for PWA shims on macOS  

  Code signatures for the application shims that are created when installing a Progressive Web App (PWA) on macOS are changing to use ad-hoc code signatures that are created when the application is installed. The code signature is used by macOS as part of the application's identity. These ad-hoc signatures will result in each PWA shim having a unique identity to macOS; currently every PWA looks like the same application to macOS.

  This will address problems when attempting to include multiple PWAs in the macOS Open at Login preference pane, and will permit future improvements for handling user notifications within PWAs on macOS.

  • Chrome 128 on Mac

    

• Deprecate Safe Browsing Extended reporting  

  Safe Browsing Extended reporting is a feature that enhances the security of all users by collecting telemetry information from participating users that is used for Google Safe Browsing protections. The data collected includes URLs of visited web pages, limited system information, and some page content. However, this feature is now superseded by Enhanced protection mode. We suggest users switch to Enhanced protection to continue providing security for all users in addition to enabling the strongest security available in Chrome. For more information, see Safe Browsing protection levels.

  
  • Chrome 128 on Android, iOS, ChromeOS, Linux, Mac, Windows: Deprecation of Safe Browsing Extended reporting

    

• Chrome will no longer support macOS 10.15  

  Chrome will no longer support macOS 10.15, which is already outside of its support window with Apple. Users have to update their operating systems in order to continue running Chrome browser. Running on a supported operating system is essential to maintaining security. If run on macOS 10.15, Chrome continues to show an infobar that reminds users that Chrome 129 will no longer support macOS 10.15.

  • Chrome 129 on Mac: Chrome no longer supports macOS 10.15

    

• User link capturing on PWAs  

  Web links automatically direct users to installed web apps. To better align with users' expectations around installed web apps, Chrome makes it easier to move between the browser and installed web apps. When the user clicks a link that could be handled by an installed web app, Chrome adds a chip in the address bar to suggest switching over to the app. When the user clicks the chip, this either launches the app directly, or opens a grid of apps that can support that link. For some users, clicking a link always automatically opens the app.

  • Chrome 121 on Linux, MacOS, Windows: When some users click a link, it always opens in an installed PWA, while some users see the link open in a new tab with a chip in the address bar, clicking on which will launch the app. A flag is available to control this feature: chrome://flags/#enable-user-link-capturing-pwa.
  • Chrome 129 on Linux, Mac, Windows: Launch to 100% of Stable with either a default on (always launch apps on link clicks) or a default off (always open in a tab, only launch if the user clicks on chip on address bar).
  

    

• Deprecate the includeShadowRoots argument on DOMParser  

  The includeShadowRoots argument was a never-standardized argument to the DOMParser.parseFromString() function, which was there to allow imperative parsing of HTML content that contains declarative shadow DOM. This was shipped in Chrome 90 as part of the initial shipment of declarative shadow DOM. Since the standards discussion rematerialized in 2023, the shape of DSD APIs changed, including this feature for imperative parsing. To read more, see details of the context on the related standards, and information is also available on the related deprecations of shadow DOM serialization and shadow root attribute.
  Now that a standardized version of this API, in the form of setHTMLUnsafe() and parseHTMLUnsafe() will ship in Chrome 129, the non-standard includeShadowRoots argument needs to be deprecated and removed. All usage should shift accordingly:
  Instead of:
    (new DOMParser()).parseFromString(html,'text/html',{includeShadowRoots: true});
  This can be used instead:
    document.parseHTMLUnsafe(html);

  • Chrome 129 on Linux, Mac, Windows, Android

    

• Insecure form warnings on iOS  

  Chrome 125 blocks form submissions from secure pages to insecure pages on iOS. When Chrome detects an insecure form submission, it will display a warning asking the user to confirm the submission. The goal is to prevent leaking form data over plain text without user's explicit approval. A policy called InsecureFormsWarningsEnabled is available to control this feature.

  • Chrome 125 on iOS: Feature rolls out
  • Chrome 130 on iOS: InsecureFormsWarningsEnabled policy will be removed

    

• Private network access checks for navigation requests: warning-only mode  

  Before a website A navigates to another site B in the user's private network, this feature does the following:

  1. Checks whether the request has been initiated from a secure context

  2. Sends a preflight request, and checks whether B responds with a header that allows private network access.

  There are already features for subresources and workers, but this one is for navigation requests specifically.

  These checks protect the user's private network. Since this feature is the warning-only mode, we do not fail the requests if any of the checks fail. Instead, a warning will be shown in the DevTools, to help developers prepare for the coming enforcement.

  • Chrome 130 on Windows, Mac, Linux, Android

    

• Remove enterprise policy used for legacy same site behavior  

  In Chrome 79, we introduced the InsecureFormsWarningsEnabled policy to revert the SameSite behavior of cookies to legacy behavior on the specified domains. The LegacySameSiteCookieBehaviorEnabledForDomainList policy’s lifetime has been extended and will be removed on the milestone listed below.

  • Chrome 132 on Android, ChromeOS, Linux, Mac, Windows: Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy

    

• X25519Kyber768 key encapsulation for TLS  

  Starting in Chrome 124, Chrome enables by default on all desktop platforms a new post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard (ML-KEM). This protects network traffic from Chrome with servers that also support ML-KEM from decryption by a future quantum computer. This is exposed as a new TLS cipher suite. TLS automatically negotiates supported ciphers, so this change should be transparent to server operators. This cipher will be used for both TLS 1.3 and QUIC connections.

  However, some TLS middleboxes might be unprepared for the size of a Kyber (ML-KEM) key encapsulation, or a new TLS ClientHello cipher code point, leading to dropped or hanging connections. This can be resolved by updating your middlebox, or disabling the key encapsulation mechanism via the temporary PostQuantumKeyAgreementEnabled enterprise policy, which will be available through the end of 2024. However, long term, post-quantum secure ciphers will be required in TLS and the enterprise policy will be removed. Post-quantum cryptography is required for CSNA 2.0.

  Please see this blog post for more detail.

  • Chrome 124 on Windows, Mac, Linux
  • Chrome 135 on Android

Upcoming ChromeOS changes

   

• Snap groups on ChromeOS  

  As early as ChromeOS 127, Snap groups will allow you to group windows on ChromeOS. A snap group is formed when a user pairs two windows for a split-screen. The windows can then be brought back together, resized simultaneously, or moved as a group.

   

• Read aloud in Reading Mode  

  As early as ChromeOS 127, Read Aloud will bring Google's high quality voices to Chrome Reading Mode for users to leverage Text to Speech to read content on the web. The goal of Read Aloud is to help people who have difficulty reading to understand long-form text. The new Read Aloud feature in Reading Mode on Chrome desktop allows users to hear the text they are reading, which improves focus and comprehension.

 

Upcoming Admin console changes

   

• Filter for popular and recently added settings with policy tags 

  The Admin console will soon provide options to filter settings by recently added and popular. With these new filters, you’ll be able to see our newest settings as well as see some of our most popular and relevant Chrome settings.

  
  • As early as Chrome 126 on Android, iOS, Linux, Mac, Windows: Trusted Tester access
  • As early as Chrome 127 on Android, iOS, Linux, Mac, Windows: Feature rolls out

   

• Chrome browser managed profile reporting 
  Chrome Enterprise Core will introduce new Chrome browser managed profile reporting in the Admin console. This feature will provide a new Managed profile listing and detail pages. On these pages, IT administrators will be able to find reporting information on managed profiles such as profile details, browser versions, policies applied, and more.
  • As early as Chrome 127 on Android, Linux, MacOS, Windows: Early Trusted Tester access
  • As early as Chrome 130 on Android, iOS, Linux, MacOS, Windows: Feature rolls out

   

• Group based policy for Chrome browser 

  As an administrator, you will be able to use Google groups to add managed Chrome browsers to groups and set User & browser policies and Extension settings to a group of browsers. Managed browsers can be assigned to multiple groups, which allows IT administrators to have more flexibility to manage Chrome browsers using cloud management.

  • As early as Chrome 126 on Android, Linux, MacOS, Windows: Trusted Tester access
  • As early as Chrome 127 on Android, iOS, Linux, MacOS, Windows: Feature rolls ou

Chrome browser updates	Security/ Privacy	User productivity/ Apps	Management
Chrome Third-Party Cookie Deprecation (3PCD)	✓
Automatic deep file scanning for Enhanced Safe Browsing users	✓
Chrome Desktop support for Windows ARM64			✓
Chrome updater changes			✓
Chrome Security Insights	✓	✓	✓
Chrome bandwidth updates			✓
Extensions Safety Check	✓
Insecure form warnings on iOS	✓
Legacy Browser Support for Edge upgraded to Manifest V3			✓
Remove enterprise policy used for Base URL inheritance	✓
Send download reports without explicit user decision	✓		✓
Tab Groups on Tab Grid		✓
UI Automation accessibility framework provider on Windows		✓
Update Google Play Services to fix issues with account passwords		✓
Extending Storage Access API (SAA) to non-cookie storage	✓
Interoperable mousemove default action		✓
Remove window-placement alias for permission and permission policy descriptors			✓
Default Search Engine choice screen		✓	✓
Generating insights for Chrome DevTools Console warnings and errors			✓
New and updated policies in Chrome browser			✓
Removed policies in Chrome browser			✓
ChromeOS updates	Security/ Privacy	User productivity/ Apps	Management
SAML always-on VPN fix			✓
ChromeOS Passpoint settings	✓
ChromeOS Audio Bluetooth telephony			✓
Add PrivateIP to DoH with identifiers	✓
Gallery video playback speed control UI		✓
Reduce Animations toggle for ChromeOS		✓
Captive Portal sign-in window	✓
Install dialog for PWAs			✓
Warn users before disconnecting Bluetooth HID	✓		✓
Admin console updates	Security/ Privacy	User productivity/ Apps	Management
Inactive browser deletion in Chrome Enterprise Core	✓		✓
ChromeOS device enrollment and token generation redesign			✓
New ZTE pre-provisioning token features	✓
Expanded token management features	✓		✓
URL-keyed anonymized data collection in Managed Guest Session	✓
New policies in the Admin console			✓
Upcoming Chrome browser changes	Security/ Privacy	User productivity/ Apps	Management
Deprecate Safe Browsing Extended reporting	✓
Extract text from PDFs for screen reader users		✓
Network Service on Windows will be sandboxed	✓
Removing support for UserAgentClientHintsGREASEUpdateEnabled	✓
Tab Groups on iPad		✓
Telemetry about pages that trigger keyboard and pointer Lock APIs	✓
Updated password management experience on Android	✓	✓
Watermarking	✓
Align navigator.cookieEnabled with spec	✓
Automatic fullscreen content setting		✓
Keyboard-focusable scroll containers	✓
Cross-site ancestor chain bit for CookiePartitionKey of partitioned cookies			✓
App-bound encryption for cookies	✓
Chrome extension telemetry integration with Chronicle	✓
Migrate extensions to Manifest V3 before June 2025	✓	✓	✓
Simplified sign-in and sync experience on Android		✓
Deprecate mutation events	✓
Remove enterprise policy used for legacy same site behavior			✓
User link capturing on PWAs		✓	✓
X25519Kyber768 key encapsulation for TLS	✓
Chrome will no longer support macOS 10.15	✓		✓
Deprecate the includeShadowRoots argument on DOMParser	✓
Private network access checks for navigation requests: warning-only mode			✓
Upcoming ChromeOS changes	Security/ Privacy	User productivity/ Apps	Management
New policy to control Kiosk wake and sleep times			✓
Show wildcard URLs in Data Controls Reporting			✓
Upcoming Admin console changes	Security/ Privacy	User productivity/ Apps	Management
Policy parity: Custom Configurations for IT admins			✓
Interactive setup guides for Chrome Enterprise Core			✓
Legacy Technology report			✓

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.

Chrome browser updates

   

• Chrome Third-Party Cookie Deprecation (3PCD)  

  Third party cookies will be restricted in a future release of Chrome. Currently, they are restricted by default for 1% of Chrome users to allow sites to preview the user experience without third-party cookies. Most enterprises are excluded from this group automatically and admins can use the BlockThirdPartyCookies and CookiesAllowedForUrls policies to re-enable third-party cookies if needed.

  End users can use the eye icon in the omnibox to temporarily re-enable third-party cookies for 90 days on a given site when necessary. See this help article for more details on how to toggle these settings for the desired configuration. Bounce tracking protections are enforced when the bouncing site is not permitted to use 3P cookies, and are controllable with the same policies. Enterprise SaaS integrations used in a cross-site context for non-advertising use cases can register for the third-party deprecation trial or the first-party deprecation trial for continued access to third-party cookies for a limited period of time.

  For more details on how to prepare, provide feedback and report potential site issues, refer to our updated landing page on preparing for the end of third-party cookies.

  • Starting in Chrome 120 on ChromeOS, Linux, macOS, Windows
    1% of global traffic has third-party cookies disabled. Enterprise users are excluded from this automatically where possible, and a policy is available to override the change.

   

• Automatic deep file scanning for Enhanced Safe Browsing users  

  Deep scanning of downloads for Enhanced Safe Browsing users has been launched since Chrome 91. At that time, users had to consent to each file they wanted deep-scanned automatically. Starting in Chrome 125, users no longer have to do that. Deep scanning is performed automatically as part of the improved protections offered by Enhanced Safe Browsing. Admins wishing to disable this feature can ensure their users are not in Enhanced Safe Browsing mode at all with the SafeBrowsingProtectionLevel policy, or disable deep scans with SafeBrowsingDeepScanningEnabled. 

  • Chrome 125 on LaCrOS, Linux, Mac, Windows: Feature rolls out

   

• Chrome Desktop support for Windows ARM64  

  Chrome rolled out support for Windows ARM64. Enterprise installers are coming soon, and the ARM64 version can be downloaded at google.com/chrome. If you encounter any issues, file a bug here. At this time, other versions of Chrome running on ARM64 devices will not be automatically upgraded. Please re-install Chrome if you're running on an ARM64 device.

  • Chrome 125 on Windows: New Enterprise installers will be available towards mid-May

   

• Chrome updater changes  

  We are in the process of rolling out a new version of Google Update. As part of this change, the location for GoogleUpdate.exe on Windows changes and it is renamed updater.exe. Note that the previous path continues to persist until the transition is fully completed. GoogleUpdate.exe is also modified to point to updater.exe.

  * Previous: %PROGRAMFILES(X86)%\Google\Update\GoogleUpdate.exe
  * Current: %PROGRAMFILES(X86)%\Google\GoogleUpdater\<VERSION>\updater.exe

  • Chrome 125 on Windows: These changes appear on Windows

   

• Chrome Security Insights  

  If you have Chrome Enterprise Core (Chrome Browser Cloud Management) and Workspace Enterprise Standard or Workspace Enterprise Plus with assigned licenses, you can now enable Chrome Security Insights. This tool allows you to monitor insider risk and data loss for Chrome activity. For more information, see Monitoring for insider risk and data loss.

  • Chrome 125 on ChromeOS, Linux, Mac, Windows

   

• Chrome bandwidth updates  

  Chrome introduces a new mechanism for updating certain Chrome components, which might result in extra bandwidth used within your fleet. You can control this with the GenAILocalFoundationalModelSettings policy.

  • Chrome 125 on Linux, Mac, Windows

   

• Extensions Safety Check  

  The Extensions Safety Check notifies users about extensions that might contain malware, policy violations, and extensions that have been unpublished long ago. It provides an interface for users to review these extensions and decide to keep or remove each flagged extension. 

  To expand the usefulness and the scope of this feature, Chrome 125 adds new triggers so that other potentially risky extensions can also be reviewed by users. There are two new extension types that we now flag for the user to review. 

  -  Extensions that are not installed from the Chrome Web Store 

  -  Extensions that violate store policy by using deceptive installation tactics and are considered unwanted software

  Any extensions that are force-installed, installed by policy, version-pinned or blocked by policy are ignored and not flagged by these trigger criteria.

  • Chrome 125 on ChromeOS, Linux, Mac, Windows: During rollout, the two new triggers will be added to the extension safety check found on the chrome://extensions/ page

   

• Insecure form warnings on iOS  

  Chrome 125 blocks form submissions from secure pages to insecure pages on iOS. When Chrome detects an insecure form submission, it displays a warning asking the user to confirm the submission. The goal is to prevent leaking form data over plain text without user's explicit approval. A policy InsecureFormsWarningsEnabled is available to control this feature.

  • Chrome 125 on iOS: Feature rolls out
  • Chrome 130 on iOS: InsecureFormsWarningsEnabled policy will be removed

   

• Legacy Browser Support for Edge upgraded to Manifest V3  

  Legacy Browser Support for Edge is upgraded to Manifest V3. This is a major update with a possibility for bugs, so you can try the Beta version of this extension today. We encourage you to test it in your environment. If you encounter any issues, file a bug here.

  • Chrome 125 on Linux, Mac, Windows: Microsoft Edge Add-ons Store doesn't support gradual rollouts, so this will roll out 0%=>100% in one step. Target release date is May 30th, so ~2 weeks into Chrome 125's lifecycle.

   

• Remove enterprise policy used for Base URL inheritance  

  In Chrome 114, we introduced NewBaseUrlInheritanceBehaviorAllowed to prevent users or Google Chrome variations from enabling NewBaseUrlInheritanceBehavior, in case compatibility issues were discovered. Chrome 125 removes the temporary NewBaseUrlInheritanceBehaviorAllowed policy.

  • Chrome 125 on Android, ChromeOS, Linux, Mac, Windows: NewBaseUrlInheritanceBehaviorAllowed policy will be removed.

   

• Send download reports without explicit user decision  

  The Client Safe Browsing Report is a telemetry report sent to Safe Browsing when a warning is shown in Chrome. Today, download reports are sent when users discard or bypass a download warning. Based on the learnings from the initial tailored warning experiment, many download warnings are not explicitly discarded or bypassed. Reports are not sent for these warnings, so Safe Browsing doesn't have visibility on the effectiveness of these warnings. This feature aims to close this telemetry gap by sending reports when the download is auto-discarded or the browser is closed. 

  • Chrome 125 on ChromeOS, LaCrOS, Linux, Mac, Windows

   

• Tab Groups on Tab Grid  

  Chrome for iPhone users can create and manage tab groups on their tab grids. This helps users stay organized, reduce clutter and manage their tasks more efficiently. 

  • Chrome 125 on iOS

   

• UI Automation accessibility framework provider on Windows  

  Starting in Chrome 126, Chrome will start directly supporting accessibility client software that uses Microsoft Windows's UI Automation accessibility framework. Prior to this change, such software interoperated with Chrome by way of a compatibility shim in Microsoft Windows. This change is being made to improve the accessible user experience for many users. It provides complete support for Narrator, Magnifier, and Voice Access; and will improve third-party apps that use Windows's UI Automation accessibility framework. Users of Chrome will find reduced memory usage and processing overhead when used with accessibility tools. It will also ease development of software using assistive technologies.
  Starting in Chrome 125, administrators can use the UiAutomationProviderEnabled enterprise policy to either force-enable the new provider (so that all users receive the new functionality), or disable the new provider. This policy will be supported through Chrome 136, and will be removed in Chrome 137. This one-year period is intended to give enterprises sufficient time to work with third-party vendors so that they may fix any incompatibilities resulting from the switch from Microsoft's compatibility shim to Chrome's UI Automation provider. 

  • Chrome 125 on Windows: The UiAutomationProviderEnabled policy is introduced so that administrators can enable Chrome's UI Automation accessibility framework provider and validate that third-party accessibility tools continue to work.
  • Chrome 126 on Windows: The Chrome variations framework will be used to begin enabling Chrome's UI Automation accessibility framework provider for users. It will be progressively enabled to the full stable population, with pauses as needed to address compatibility issues that can be resolved in Chrome. Enterprise administrators may continue to use the UiAutomationProviderEnabled policy to either opt-in early to the new behavior, or to temporarily opt-out through Chrome 136.
  • Chrome 137 on Windows: The UiAutomationProviderEnabled policy will be removed from Chrome. All clients will use the browser's UI Automation accessibility framework provider.

   

• Update Google Play Services to fix issues with account passwords  

  Users with old versions of Google Play Services might be unable to access the passwords saved to their Google accounts. These users now see warnings to update Google Play Services in the password management surface to access their account passwords again. This is part of an ongoing migration that only affects Android users of Google Password Manager.

  • Chrome 125 on Android

   

• Extending Storage Access API (SAA) to non-cookie storage  

  Chrome extends the Storage Access API to allow access to unpartitioned cookie and non-cookie storage in a third-party context. The current API only provides access to cookies, which have different use-cases than non-cookie storage. The API can be used as follows (JS running in an embedded iframe):

  // Request a new storage handle via rSA (this should prompt the user)
  let handle = await document.requestStorageAccess({all: true});

  // Write some cross-site localstorage
  handle.localStorage.setItem("userid", "1234");

  // Open or create an indexedDB that is shared with the 1P context
  let messageDB = handle.defaultBucket.indexedDB.open("messages");

  The same flow would be used by iframes to get a storage handle when their top-level ancestor successfully called rSAFor, just that in this case the storage-access permission was already granted and thus the rSA call would not require a user gesture or show a prompt, allowing for hidden iframes accessing storage. 

  • Chrome 125 on Windows, Mac, Linux, Android

   

• Interoperable mousemove default action  

  Canceling mousemove does not prevent text selection or drag-and-drop. Chrome allowed canceling mousemove events to prevent other APIs like text selection (and even drag-and-drop in the past). This does not match other major browsers; nor does it conform to the W3 UI Events specification.

  With this feature, text selection is no longer the default action of mousemove. Text selection and drag-and-drop can still be prevented through canceling selectstart and dragstart events respectively, which are spec-compliant and fully interoperable.

  • Chrome 125 on Windows, Mac, Linux, Android

   

• Remove window-placement alias for permission and permission policy descriptors  

  Chrome 125 removes the window-placement alias for permission and permission policy descriptors. All instances of window-placement are replaced with window-management, which better describes the related API functionality. This is a follow-up to Window Management API feature enhancements and renaming from Multi-Screen Window Placement API; for more details, see Chrome Platform Status.

  • Chrome 125 on Windows, Mac, Linux

   

• Default Search Engine choice screen  

  As part of our Digital Markets Act (DMA) compliance, Google is introducing choice screens for users to choose their default search engine within Chrome. The choice from the prompt controls the default search engine setting, currently available at chrome://settings/search.

  For enterprises that have chosen to have their administrator set their enterprise users’ search settings using the enterprise policies DefaultSearchProviderEnabled and DefaultSearchProviderSearchUrl, those policies continue to control their enterprise’s search settings. Where the administrator has not set their enterprise users’ search settings by policy, enterprise users might see a prompt to choose their default search engine within Chrome.

  Read more about these policies and the related atomic group.

  • Chrome 120 on iOS, ChromeOS, LaCrOS, Linux, MacOS, Windows: 1% users might start getting the choice screen with Chrome 120. 
  • Chrome 125 on iOS, ChromeOS, LaCrOS, Linux, MacOS, Windows: full roll-out for applicable users.

   

• Generating insights for Chrome DevTools Console warnings and errors  

  In Chrome 125, a new Generative AI (GenAI) feature becomes available for unmanaged users:  Generating insights for Chrome DevTools Console warnings and errors. These insights provide a personalized description and suggested fixes for the selected errors and warnings. Initially, this feature is only available to users (18+) in English. Admins can control this feature by using the DevToolsGenAiSettings policy. 

  • Chrome 125 on ChromeOS, Linux, Mac, Windows: Feature becomes available to unmanaged users globally, except Europe, Russia, and China. 
  • Chrome 127 on ChromeOS, Linux, Mac, Windows: Feature becomes available to managed Chrome Enterprise & Education users in supported regions.

   

• New and updated policies in Chrome browser  

  Policy	Description
  EnterpriseLogoUrl	Enterprise Logo URL: URL to an image that is used as an enterprise badge for the profile.
  EnterpriseBadgingTemporarySetting	Control the visibility of enterprise badging.
  ApplicationBoundEncryptionEnabled	Enable Application-bound encryption
  UiAutomationProviderEnabled	Enable the browser's UI Automation accessibility framework provider on Windows
  ToolbarAvatarLabelSettings	Managed toolbar avatar label setting

   

• Removed policies in Chrome browser  

  Policy	Description
  NewBaseUrlInheritanceBehaviorAllowed	Allows enabling the feature NewBaseUrlInheritanceBehavior

ChromeOS updates

   

• Always-on VPN SAML fix 

  To better support Enterprise customers who use VPN in always-on strict  mode, where no user traffic can get to the internet except via the VPN, and SAML authentication, we've added a new policy AlwaysOnVpnPreConnectUrlAllowlist. This policy allows you to specify URLs users are allowed to go to before the VPN has connected, so that your SAML services are reachable to authenticate the user to the VPN via the system browser.

   

• ChromeOS Passpoint settings 

  You can now view and manage Wi-Fi Passpoint in ChromeOS Settings. You can view and remove your installed passpoint subscription under the passpoint detailed page.

   

• ChromeOS Audio Bluetooth telephony 

  ChromeOS now supports call control buttons on compatible Bluetooth headsets, including answering, rejecting or terminating a call, and muting the microphone.

   

• Add PrivateIP to DoH with identifiers 

  A network identifier was added to the secure DNS URI templates with identifiers policy. Admins can now configure a new placeholder in the DNS URI templates, which is replaced with the device local IP addresses when the users are connected to managed networks.

   

• Gallery video playback speed control UI 

  ChromeOS Gallery video player now has a playback speed menu to control the playback rate.

   

• Reduce Animations toggle for ChromeOS 

  A reduced animations setting is now available on ChromeOS. This setting is available under Accessibility > Display and Magnification > Reduced Animations. Customers who experience motion sickness, distractions or other types of discomfort when seeing animations can benefit from changing this setting.

   

• Captive portal sign-in window 

  ChromeOS 125 allows easier captive portal sign-in with a dedicated window. The window opens as a tabless popup window; the URL is shown but it is not editable.

  

   

• Install dialog for PWAs 

  ChromeOS 125 enables an installation dialog for web apps. This feature unblocks web app installation scenarios and is part of the work to create a more predictable, accessible, and trustworthy install surface for web apps.

   

• Warn users before disconnecting Bluetooth HID 

  In ChromeOS 125 and later, Chromeboxes and Chromebases display a notification to prevent unintended Bluetooth device disconnections. This notification appears when you attempt to disable Bluetooth while only Human Interface Devices (HIDs) like keyboards or mice connected via Bluetooth are active.

Admin console updates

   

• Inactive browser deletion in Chrome Enterprise Core   

  Starting in April 2024 until June 2024, the Inactive period for browser deletion policy has started to roll out and automatically delete enrolled browsers in the Admin console that have been inactive for more than the inactivity period of time determined by the policy. When releasing the policy, the inactivity period of time has a default value of 540 days. Meaning that by default, all enrolled browsers that have been inactive for more than 540 days are deleted from your account. Administrators can change the inactive period value using this policy. The maximum value to determine the browser inactivity period is 730 days and the minimum value is 28 days (learn more). 

  
  If you lower the set policy value, it might have a global impact on any currently enrolled browsers. All impacted browsers will be considered inactive and, therefore, be irreversibly deleted. To ensure the deleted browsers re-enroll automatically next time they restart, set the Device Token Management policy value to Delete token before lowering the value of this policy. The enrollment tokens on these browsers need to still be valid at the time of the restart.

   

• ChromeOS device enrollment and token generation redesign   

  Beginning in April 2024, the zero-touch enrollment experience has been enhanced with a new enrollment entry point, token creation guide, the ability to specify SKU and partner permissions and improved token management

   

• New ZTE pre-provisioning token features   

  Pre-provisioning tokens have gained the following features:
  • Support for Kiosk & Signage Upgrade by allowing zero-touch enrollment pre-provisioning tokens to be created using either Chrome Enterprise Upgrade or Kiosk & Signage Upgrade
  • Ability for pre-provisioning partners to specify custom fields (asset ID, location, and user)
  • Multiple tokens per organizational unit

   

• Expanded token management features   

  The Enrollment Tokens page has been updated with the following features:
  • The page has been added to the left navigation panel for easier access
  • Tokens are now filterable based on status, creation user, annotation and upgrade type
  • A new button allows admins to copy the token and Customer ID with one click
  • Additional columns provide more information about the token
  • 

   

• URL-keyed anonymized data collection in Managed Guest Session   

  The policy for URL-keyed anonymized data collection, UrlKeyedAnonymizedDataCollectionEnabled, is available in the Admin console. This policy will be enforced starting June 1st and will remain disabled until then.

   

• New policies in Admin console   
   

  Policy Name	Pages	Supported on	Category/Field
  DevToolsGenAiSettings	Users & Browsers	Chrome ChromeOS	Generative AI
  UiAutomationProviderEnabled	Users & Browsers	Chrome	Accessibility
  ContextualGoogleIntegrationsEnabled	Users & Browsers	ChromeOS	User experience
  ContextualGoogleIntegrationsConfiguration	Users & Browsers	ChromeOS	User experience
  ApplicationBoundEncryptionEnabled	Users & Browsers	Chrome	Security
  DeviceExtensionsSystemLogEnabled	Device	ChromeOS	User and device reporting
  EnterpriseBadgingTemporarySetting	Users & Browser	Chrome	General
  EnterpriseLogoUrl	Users & Browser	Chrome	General
  ToolbarAvatarLabelSettings	Users & Browser	Chrome	General
  DeviceDlcPredownloadList	Device	ChromeOS	Other settings

Coming soon

Note: The items listed below are experimental or planned updates. They might change, be delayed, or canceled before launching to the Stable channel.

 

Upcoming browser changes

    

• Deprecate Safe Browsing Extended reporting  

  Safe Browsing Extended reporting is a feature that enhances the security of all users by collecting telemetry information from participating users that is used for Google Safe Browsing protections. The data collected includes URLs of visited web pages, limited system information, and some page content. However, this feature is now superseded by Enhanced protection mode. We suggest users switch to Enhanced protection to continue providing security for all users in addition to enabling the strongest security available in Chrome. For more information, see Safe Browsing protection levels. 

  • Chrome 126 on iOS, ChromeOS, Linux, MacOS, Windows: Deprecation of Safe Browsing Extended Reporting
   

    

• Extract text from PDFs for screen reader users  

  Chrome browser is launching an Optical character recognition (OCR) AI reader for PDFs, creating the first browser built-in PDF screen reader for inaccessible documents, further filling the gap in accessibility for low vision and blind users across the web.

  This feature leverages Google's OCR models to extract, compartmentalize, and section PDF documents to make them more accessible. A local machine intelligence library will be added that uses Screen AI technology to analyze screenshots or the accessibility tree, and extract more information to help assistive technology, such as texts (OCR) and main content of the page.

  • Chrome 126 on ChromeOS, Linux, MacOS, Windows
  

    

• Network Service on Windows will be sandboxed  

  To improve security and reliability, the network service, already running in its own process, will be sandboxed on Windows. As part of this, third-party code that is currently able to tamper with the network service may be prevented from doing so. This might cause interoperability issues with software that injects code into Chrome's process space, such as Data Loss Prevention software. The NetworkServiceSandboxEnabled policy allows you to disable the sandbox if incompatibilities are discovered. You can test the sandbox in your environment using these instructions and report any issues you encounter.

  • Chrome 125 on Windows: Network Service sandboxed on Windows.

    

• Removing support for UserAgentClientHintsGREASEUpdateEnabled  

  Deprecate the UserAgentClientHintsGREASEUpdateEnabled policy since the updated GREASE algorithm has been on by default for over a year and then eventually remove it.

  • Chrome 124 on Android, ChromeOS, Linux, Mac, Windows: Policy is deprecated
  • Chrome 126 on Android, ChromeOS, Linux, Mac, Windows: Policy is removed

    

• Tab Groups on iPad  

  Chrome for iPad users can create and manage tab groups. This helps users stay organized, reduce clutter and manage their tasks more efficiently.

  • Chrome 126 on Android

   

• Telemetry about pages that trigger keyboard and pointer Lock APIs  

  When an Enhances Safe Browsing user visits a page that triggers keyboard or pointer lock API, attributes of that page will be sent to Safe Browsing. If the telemetry is sent and the page seems to be malicious, users will see a Safe Browsing warning and their keyboard or pointer will be unlocked if they were locked.

  • Chrome 126 on Android, ChromeOS, LaCrOS, Linux, MacOS, Windows, Fuchsia

    

• Updated password management experience on Android  
  On Chrome on Android, some users who are signed-in to Chrome but don't have Chrome sync enabled will be able to use and save passwords in their Google Account. Relevant enterprise policies such as BrowserSignin, SyncTypesListDisabled and PasswordManagerEnabled will continue to work as before and can be used to configure whether users can use and save passwords in their Google Account.
  • Chrome 126 on Android

    

• Watermarking  

  This feature will allow admins to overlay a watermark on top of a webpage if navigating to it triggers a specific DLP rule. It will contain a static string displayed as the watermark. Watermarking will be available to Chrome Enterprise Premium customers. 

  • Chrome 124 on Linux, Mac, Windows: Trusted Tester access
  • Chrome 126 on Linux, Mac, Windows: Feature rolls out

     

• Align navigator.cookieEnabled with spec  

  navigator.cookieEnabled currently indicates if “the user agent attempts to handle cookies” in a given context. A change in Chrome, shipping as part of third-party cookie deprecation (3PCD), would cause it to indicate whether unpartitioned cookie access is possible (causing it to return false in most cross-site iframes). We should restore the prior behavior of navigator.cookieEnabled which indicated only if cookies were enabled or disabled for the site and rely on the cross-vendor function document.hasStorageAccess to indicate if unpartitioned cookie access is possible.

  • Chrome 126 on Windows, Mac, Linux, Android

    

• Automatic fullscreen content setting  

  A new Automatic Fullscreen content setting permits Element.requestFullscreen() without a user gesture, and permits browser dialogs to appear without exiting fullscreen.

  The setting is blocked by default and sites cannot prompt for permission. New UI controls are limited to Chrome's settings pages (chrome://settings/content/automaticFullScreen) and the site info bubble. Users can allow Isolated Web Apps, and enterprise admins can allow additional origins with the AutomaticFullscreenAllowedForUrls policy.

   

  Combined with Window Management permission and unblocked popups (chrome://settings/content/popups), this unlocks valuable fullscreen capabilities:

  - Open a fullscreen popup on another display, from one gesture

  - Show fullscreen content on multiple displays from one gesture

  - Show fullscreen content on a new display, when it's connected

  - Swap fullscreen windows between displays with one gesture

  - Show fullscreen content after user gesture expiry or consumption

   

  • Chrome 128 on Android, ChromeOS, Linux, MacOS, Windows: Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy

    

• Cross-site ancestor chain bit for CookiePartitionKey of partitioned cookies  

  Chrome 125 adds a cross-site ancestor bit to the keying of the partitioned cookie's CookiePartitionKey. This change unifies the partition key with the partition key values used in storage partitioning and adds protection against clickjacking attacks by preventing cross-site embedded frames from having access to the top-level-site's partitioned cookies.
  If an enterprise experiences any breakage with embedded iframes, they can use the CookiesAllowedForUrls policy or use SameSite=None cookies without the Partitioned attribute and then invoke the Storage Access API (SAA) or use the Cross-Origin Resource Sharing (CORS) to ensure that embedded iframes have access to the same cookies as the top level domain.

  • Chrome 126 on Windows, Mac, Linux

   

• Keyboard-focusable scroll containers  

  Making scroll containers focusable using sequential focus navigation greatly improves accessibility. Today, the tab key doesn't focus scrollers unless tabIndex is explicitly set to 0 or more.

  By making scrollers focusable by default, users who can't (or don't want to) use a mouse will be able to focus clipped content using a keyboard's tab and arrow keys. This behavior is enabled only if the scroller does not contain any keyboard focusable children. This logic is necessary so we don't cause regressions for existing focusable elements that might exist within a scroller like a <textarea>.

  • Chrome 127 on Windows, MacOS, Linux, Android

    

• App-Bound encryption for cookies  

  To improve the security of cookies on Windows, the encryption key used for cookie encryption will be further secured by binding it to Chrome's application identity. This can help protect against malware that might attempt to steal cookies from the system. This does not protect against an attacker who is able to elevate privilege or inject into Chrome's processes.
  An enterprise policy ApplicationBoundEncryptionEnabled is available to disable Application Bound Encryption.

  • Chrome 127 on Windows

    

• Chrome extension telemetry integration with Chronicle  

  Collect relevant extension telemetry data from within Chrome (managed profiles + devices) and send it to Chronicle. Chronicle will analyze the data to provide instant analysis and context on risky activity.

  • Chrome 127 on ChromeOS, LaCrOS, Linux, Mac, Windows

   

• All extensions must be updated to leverage Manifest V3 by June 2025  

  Extensions must be updated to leverage Manifest V3. Chrome extensions are transitioning to a new manifest version, Manifest V3. This will bring improved privacy for your users—for example, by moving to a model where extensions modify requests declaratively, without the ability to see individual requests. This also improves extension security, as remotely hosted code will be disallowed on Manifest V3. 

  Beginning June 2024, Chrome will gradually disable Manifest V2 extensions running in the browser. An Enterprise policy - ExtensionManifestV2Availability - is available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. Additionally, machines on which the policy is enabled will not be subject to the disabling of Manifest V2 extensions until the following year - June 2025 - at which point the policy will be removed.

  You can see which Manifest version is being used by all Chrome extensions running on your fleet using the Apps & extensions usage page in Chrome Enterprise Core. Read more on the Manifest timeline, including: 

  • Chrome 110 on ChromeOS, LaCrOS, Linux, MacOS, Windows: Enterprise policy ExtensionManifestV2Availability is available to control whether Manifest v2 extensions are allowed. The policy can be used to test Manifest V3 in your organization ahead of the migration. After the migration the policy will allow you to extend the usage of Manifest V2 extensions.
  • Chrome 127 on ChromeOS, LaCrOS, Linux, MacOS, Windows: Chrome will gradually disable Manifest V2 extensions on user devices. Only those with the ExtensionManifestV2Availability enterprise policy enabled would be able to continue using Manifest V2 extensions in their organization.
  • Chrome 139 on ChromeOS, LaCrOS, Linux, MacOS, Windows: Remove ExtensionManifestV2Availability policy.

    

• Simplified sign-in and sync experience on Android  

  Chrome will launch a simplified and consolidated version of sign-in and sync in Chrome on Android. Chrome sync will no longer be shown as a separate feature in settings or elsewhere. Instead, users can sign in to Chrome to use and save information like passwords, bookmarks and more in their Google Account, subject to the relevant enterprise policies.

  As before, the functionality previously part of Chrome sync that saves and accesses Chrome data in the Google Account can be turned off via SyncTypesListDisabled. Sign-in to Chrome can be disabled via BrowserSignin as before.

  Note that the changes do not affect users’ ability to sign in to Google services on the web (like Gmail) without signing in to Chrome, their ability to stay signed out of Chrome, or their ability to control what information is synced with their Google Account.

  The changes are virtually identical to the simplified sign-in and sync experience launched on iOS in 117.

  • Chrome 127 on Android

    

• Intent to deprecate: mutation events  

  Synchronous mutation events, including DOMSubtreeModified, DOMNodeInserted, DOMNodeRemoved, DOMNodeRemovedFromDocument, DOMNodeInsertedIntoDocument, and DOMCharacterDataModified, negatively affect page performance, and also significantly increase the complexity of adding new features to the Web. These APIs were deprecated from the spec in 2011, and were replaced (in 2012) by the much better-behaved Mutation Observer API. Usage of the obsolete mutation events must be removed or migrated to Mutation Observer. Starting in Chrome 124, a temporary enterprise policy, MutationEventsEnabled, will be available to re-enable deprecated or removed mutation events. If you encounter any issues, file a bug here.

  Mutation event support will be disabled by default starting in Chrome 127, around July 30, 2024. Code should be migrated before that date to avoid site breakage. If more time is needed, there are a few options:

  - The Mutation Events Deprecation Trial can be used to re-enable the feature for a limited time on a given site. This can be used through Chrome 134, ending March 25, 2025.

  - A MutationEventsEnabled enterprise policy can also be used for the same purpose, also through Chrome 134.

  Please see this blog post for more detail.

  • Chrome 127 on Windows, Mac, Linux, Android

    

• Remove enterprise policy used for legacy same site behavior  

  In Chrome 79, we introduced the LegacySameSiteCookieBehaviorEnabledForDomainList policy to revert the SameSite behavior of cookies to legacy behavior on the specified domains. The LegacySameSiteCookieBehaviorEnabledForDomainList policy’s lifetime has been extended and will be removed on the milestone listed below.

  • Chrome 128 on Android, ChromeOS, Linux, Mac, Windows: Remove LegacySameSiteCookieBehaviorEnabledForDomainList policy

    

• User link capturing on PWAs  

  Web links automatically direct users to installed web apps. To better align with users' expectations around installed web apps, Chrome makes it easier to move between the browser and installed web apps. When the user clicks a link that could be handled by an installed web app, Chrome adds a chip in the address bar to suggest switching over to the app. When the user clicks the chip, this either launches the app directly, or opens a grid of apps that can support that link. For some users, clicking a link always automatically opens the app.

  • Chrome 121 on Linux, MacOS, Windows: When some users click a link, it always opens in an installed PWA, while some users see the link open in a new tab with a chip in the address bar, clicking on which will launch the app. A flag is available to control this feature: chrome://flags/#enable-user-link-capturing-pwa.
  • Earliest in Chrome 127 on Linux, MacOS, Windows: We will launch to 100% of Stable with either a default on (always launch apps on link clicks) or a default off (always open in a tab, only launch if user clicks on chip on address bar).
  

    

• X25519Kyber768 key encapsulation for TLS  

  Starting in Chrome 124, Chrome enables by default on all desktop platforms a new post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard (ML-KEM). This protects network traffic from Chrome with servers that also support ML-KEM from decryption by a future quantum computer. This is exposed as a new TLS cipher suite. TLS automatically negotiates supported ciphers, so this change should be transparent to server operators. This cipher will be used for both TLS 1.3 and QUIC connections.

  However, some TLS middleboxes might be unprepared for the size of a Kyber (ML-KEM) key encapsulation, or a new TLS ClientHello cipher code point, leading to dropped or hanging connections. This can be resolved by updating your middlebox, or disabling the key encapsulation mechanism via the temporary PostQuantumKeyAgreementEnabled enterprise policy, which will be available through the end of 2024. However, long term, post-quantum secure ciphers will be required in TLS and the enterprise policy will be removed. Post-quantum cryptography is required for CSNA 2.0.

  Please see this blog post for more detail.

  • Chrome 124 on Windows, Mac, Linux
  • Chrome 128 on Android

    

• Chrome will no longer support macOS 10.15  

  Chrome will no longer support macOS 10.15, which is already outside of its support window with Apple. Users have to update their operating systems to continue to use Chrome browser. Running on a supported operating system is essential to maintaining security. If run on macOS 10.15, Chrome continues to show an infobar that reminds users that Chrome 129 will no longer support macOS 10.15.

  • Chrome 129 on macOS: Chrome no longer supports macOS 10.15

    

• Deprecate the includeShadowRoots argument on DOMParser  

  The includeShadowRoots argument was a never-standardized argument to the DOMParser.parseFromString() function, which was there to allow imperative parsing of HTML content that contains declarative shadow DOM. This was shipped in Chrome 90 as part of the initial shipment of declarative shadow DOM. Since the standards discussion rematerialized in 2023, the shape of DSD APIs changed, including this feature for imperative parsing. To read more, see details of the context on the related standards, and information is also available on the related deprecations of shadow DOM serialization and shadow root attribute. 

  Now that a standardized version of this API, in the form of setHTMLUnsafe() and parseHTMLUnsafe() will ship in Chrome 124, the non-standard includeShadowRoots argument needs to be deprecated and removed. All usage should shift accordingly:

  Instead of:

    (new DOMParser()).parseFromString(html,'text/html',{includeShadowRoots: true});

  This can be used instead:

    document.parseHTMLUnsafe(html);

  • Chrome 129 on Windows, Mac, Linux, Android

    

• Private network access checks for navigation requests: warning-only mode  

  Before a website A navigates to another site B in the user's private network, this feature does the following:

  1. Checks whether the request has been initiated from a secure context

  2. Sends a preflight request, and checks whether B responds with a header that allows private network access.

  
  There are already features for subresources and workers, but this one is for navigation requests specifically. The above checks are made to protect the user's private network. Since this feature is the warning-only mode, we do not fail the requests if any of the checks fails. Instead, a warning will be shown in the DevTools, to help developers prepare for the coming enforcement.

  • Chrome 130 on Windows, Mac, Linux, Android

Upcoming ChromeOS changes

 

   

• New policy to control Kiosk wake and sleep times  

  As early as ChromeOS 126, we will introduce a new kiosk device policy that will allow Admins to schedule when a device will wake and sleep. For more details, see Kiosk settings.

   

• Show wildcard URLs in Data Controls reporting  

  ChromeOS Data Control rules allow admins to define source and destination URLs as a wildcard ( * ) value. ChromeOS data control events are reported under the Chrome audit report and can be viewed in the Google Admin console or other platforms through the Chrome Reporting Connector. When examining log events, the URL that triggered the rule is now reported, instead of the wildcard.

 

Upcoming Admin console changes

   

• Policy parity: Custom Configurations for IT admins 

  The Custom Configurations page allows IT admins to configure Chrome policies that are not yet in the Admin console, using JSON scripts. As a result, all Chrome policies are now configurable in Chrome Enterprise Core in the Admin console, either using the Settings page or the Custom Configurations page. You can also use the page to configure extension installation mode not supported in the Admin console, such as “normal_installed”.

  • As early as Chrome 126 on Android, iOS, Linux, Mac, Windows: Trusted Tester access
  • As early as Chrome 127 on Android, iOS, Linux, Mac, Windows: Feature rolls out

   

• Interactive setup guides for Chrome Enterprise Core 
  The Chrome Enterprise team is introducing new interactive setup guides for browser management in the Admin console, where administrators can choose a journey they’re interested in exploring and get hands-on training directly in Chrome Setup Guides. For example, the guides can be used to learn how to:
  • Creating test organizational units
  • Turn on reporting
  These guides are ideal for new administrators or for administrators who wish to learn new journeys.
  • Enroll browsers
  • Apply browser policies
  • Configure extension settings
  • Create an admin user
  
  
  • As early as Chrome 125: Trusted Tester access
  • As early as Chrome 126: Feature rolls out

       

• Legacy Technology report 

  As early as Chrome 127, the Legacy Technology report will be available in the Admin console and it will proactively report websites (both internal and external) that are using technology that will be deprecated, for example, third-party cookies, SameSite cookie changes, and older security protocols like TLS 1.0/1.1 and third-party cookies. This information will enable IT administrators to work with developers to plan required tech migrations before the deprecation feature removals goes into effect.

  This feature is currently released in our Trusted Tester program. If you’re interested in helping us test this feature, you can sign up for the Chrome Enterprise Trusted Tester program here.
  • As early as Chrome 127 on Linux, MacOS, Windows: Legacy Technology report will be available in the Admin console.
  

Chrome browser updates	Security/ Privacy	User productivity/ Apps	Management
Chrome Enterprise Premium product launch	✓		✓
Chrome Browser Cloud Management is now Chrome Enterprise Core	✓		✓
Watermarking (trusted tester)	✓
Chrome Third-Party Cookie Deprecation (3PCD)	✓
Permissions prompt for Web MIDI API	✓
Two Chrome extensions will be upgraded to Manifest V3	✓		✓
Chrome Installer/Updater changes			✓
Bookmarks and reading list improvements on Android		✓
Default Search Engine choice screen		✓	✓
Deprecate enterprise policy used for throttling			✓
Chrome Desktop support for Windows ARM64			✓
Remove enterprise policy used for GREASE			✓
Deprecate and remove Web SQL	✓
Chrome bandwidth updates			✓
Form controls support direction value in vertical writing mode		✓
Remove enterprise policies used for TLS handshake and RSA key usage			✓
Shadow root cloneable attribute	✓
Local passwords stored in Play services on Android	✓
X25519Kyber768 key encapsulation for TLS	✓
Save to Drive and to Photos		✓
Device bound session credentials google.com prototype	✓
Windows ClearType Text Tuner integration		✓
New and updated policies in Chrome browser			✓
Removed policies in Chrome browser			✓
ChromeOS updates	Security/ Privacy	User productivity/ Apps	Management
WebHID permission delegation	✓
WiFi QoS on ChromeOS			✓
Scanning DLC	✓
Increase the max size for the mouse pointer slider		✓
Fast Pair for HID	✓
Extension Cache Invalidation for managed guest login screen	✓
Instant reboot in Managed Guest Session			✓
ChromeOS carrier lock	✓
Admin console updates	Security/ Privacy	User productivity/ Apps	Management
Inactive browser deletion in Chrome Enterprise Core			✓
New filter on the App details page			✓
New policies in the Admin console			✓
Upcoming Chrome browser changes	Security/ Privacy	User productivity/ Apps	Management
UI Automation accessibility framework provider on Windows		✓
Keyboard-focusable scroll containers	✓
Interoperable mousemove default action		✓
Network Service on Windows will be sandboxed	✓
Telemetry about pages that trigger keyboard and pointer lock APIs	✓
Extending Storage Access API (SAA) to non-cookie storage	✓
Remove window-placement alias for permission and permission policy descriptors			✓
Cross-site ancestor chain bit for CookiePartitionKey of partitioned cookies	✓
Extract text from PDFs for screen reader users		✓
Deprecate Safe Browsing Extended reporting	✓
Remove enterprise policy used for Base URL inheritance		✓
App-Bound encryption for cookies			✓
Intent to deprecate: Mutation Events	✓
User link capturing on PWAs		✓
All extensions must be updated to leverage Manifest V3 by June 2025	✓	✓	✓
Remove enterprise policy used for legacy same site behavior			✓
Chrome will no longer support MacOS 10.15			✓
Deprecate the includeShadowRoots argument on DOMParser			✓
Upcoming ChromeOS changes	Security/ Privacy	User productivity/ Apps	Management
ChromeOS Passpoint settings			✓
New policy to control Kiosk wake and sleep times			✓
Upcoming Admin console changes	Security/ Privacy	User productivity/ Apps	Management
Policy parity: Custom Configurations for IT admins			✓
Legacy Technology report			✓

 

DOWNLOAD Release notes (PDF)

↑ back to top

The enterprise release notes are available in 9 languages. You can read about Chrome's updates in English, German, French, Dutch, Spanish, Portuguese, Korean, Indonesian, and Japanese. Allow 1 to 2 weeks for translation for some languages.