Google Chrome Releases

Dev Channel Update: Usability and stability fixes

2009-07-10T14:49:00.000-07:00

Google Chrome 3.0.193.0 has been released to the Dev channel for Windows.

Highlights in this release:

Fixed issue 15199 where new windows are opened off screen, in certain conditions, for dual monitor users.
Fixed issue 16052 where a tab would close if a new url was navigated to too quickly during a page load.
Alerts/authentication windows are no longer wrapped by an OS window.
Windowed plugins like Flash no longer hang after a print dialog is displayed.
Updated V8 to 1.2.13.2 to fix some crashes

More details are available in the release notes and the log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Anthony Laforge

Google Chrome Program Manager

Dev Channel Update: More progress on Mac and Linux

2009-07-08T13:20:00.000-07:00

Google Chrome 3.0.192.x has been released to the Dev channel for Windows, Linux and Mac.

Highlights in this release:

(Mac) Enabled support for the Mac OS X spellchecking service.
(Mac) First cut at popup blocking for Mac.
(Linux) Accelerator keys like ctl-C for copy should work again.
(Linux) Initial support of complex text (e.g. Arabic). Bug reports welcome.
(Linux) Initial GTK theme support.
(Linux) IME support.
(Extensions) Breaking API Change: page_actions.icon renamed to
page_action.icons and changed from a single string to an array of
strings.
(All) Added support for exporting/ importing bookmarklet bookmarks, thanks to Thiago.
(All) Fixed Acid3 Test 48: LINKTEST

Known issues:

Issue 15199: New windows open off screen, in certain conditions, for dual montior users.
Issue 16052: Tab closes if a new url is navigated to quickly during a page load.

More details are available in the release notes and the log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Anthony Laforge

Google Chrome Program Manager

Dev update: Animated GIF Fix

2009-07-06T15:35:00.000-07:00

Google Chrome 3.0.191.3 has been released to the Dev channel for Windows, Linux and Mac.

Highlights in this release:

Animated GIFs fixed.
Extensions changes, see Dev Channel Visible Changes post to the Chromium-Extensions mailing list.
Printing fixes for Windows.
Try out the New New Tab Page by using the command line switch --new-new-tab-page. Don't wait for the new new new tab page, get yours today!
Linux now supports IME for non-roman script languages.
Fixes for misbehaving proxy servers.
"Save As" now available on Mac.
More details are available in the release notes and the log of all revisions.

Known issues:

Issue 15846: (Mac) Google docs : shortcut to save a document (Command+S) is not implemented
Issue 15844: (Linux) Bookmarks bar context menus disabled on first open of bookmark manager
Issue 15845: (Linux) Bookmarks that do not fit in the bookmarks bar cannot be accessed
Issue 15848: Thumbnails on New Tab Page don't have spacing in between

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Google Chrome

Dev update: Bug fixes

2009-06-24T12:04:00.000-07:00

Google Chrome 3.0.190 has been released to the Dev channel (Mac: 190.0, Windows: 190.1, Linux: 190.2).

Highlights in this release:

Mostly bug and crash fixes.
Linux: Fixed the browser crashing because of missing fonts. (Issue 13007)
Lots of progress filling in missing features on Mac and Linux. Random samples:

Linux: HTTP authentication now works.
Linux: Render the contents of tabs while dragging.
Linux: You can import and export bookmarks.
Mac: You can download more than one item in a tab.
Mac: A (preliminary) download shelf at the bottom of the window shows your downloads.
Mac: Added the Restore Closed Tabs item to the File menu.

The --enable-monitor-profile flag converts web pages from sRGB to your current default monitor profile. It does not handle embedded color profiles in images. (Issue 4938)
The 'Print selection' option on the Print dialog works on Windows. (Issue 1682)

Known issues:

You cannot drag bookmarklets (javascript: URLs) to the bookmarks bar. (Issue 12290)
When you install an extension, two separate toolstrips appear. The problem will go away when you restart the browser. (Issue 14941)

More details are available in the release notes and the log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Mark Larson

Google Chrome Program Manager

Stable, Beta update: Security fix

2009-06-22T10:19:00.000-07:00

Google Chrome 2.0.172.33 has been released to the Stable and Beta channels. This release fixes a critical security issue and two other networking bugs.

CVE-2009-2121: Buffer overflow processing HTTP responses

Google Chrome is vulnerable to a buffer overflow in handling certain responses from HTTP servers. A specially crafted response from a server could crash the browser and possibly allow an attacker to run arbitrary code.

More info: http://code.google.com/p/chromium/issues/detail?id=14508 (This issue will be made public once a majority of users are up to date with the fix.)

Severity: Critical. An attacker might be able to run code with the privileges of the logged on user.

Credit: This issue was found by the Google Chrome security team.

Other issues

This release also fixes two other network issues:

- NTLM authentication to Squid proxies fails when trying to connect to HTTPS sites (Issue 8771)

- Browser crash when loading some HTTPS sites (Issue 13226)

Mark Larson

Google Chrome Program Manager

Dev Channel Update

2009-06-17T16:08:00.000-07:00

Google Chrome 3.0.189.0 has been released to the Dev channel for Windows, Mac OS X, and Linux.

Highlights for this release:

Lots of crash fixes and code stabilization.
All extensions now require signing, all unsigned extensions have been disallowed.
Extensions are, at least for the moment, disabled in incognito mode.
Fixed a session history bug which prevented proper backward and forward operation for certain sites.

Version Changes:

V8 - 1.2.8

The release notes are available as well as a detailed list of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Dev Channel Update: 3.0.187.1

2009-06-11T15:40:00.000-07:00

Yesterday's Dev Channel update (3.0.187.0) for Windows had a critical bug which crashes the browser when you use the wrench or page menus. This release fixes that issue.

If you already have 3.0.187.0 you cannot get to About Google Chrome to force an update. You have a couple of choices to get the update.

Wait. If you wait about 5 hours Google Chrome will check for an update and install it for you.
Uninstall Google Chrome and reinstall from http://www.google.com/chrome/eula.html?extra=devchannel

The Mac and Linux builds were not affected by this bug so they are not being updated.

We apologize for the problem and we are making changes to our process to try and avoid issues like this in the future. The dev channel is always going to be a little risky but we agree that major features like this should not go out broken.

Jonathan Conradt

Engineering Program Manager

Dev Channel Update: 3.0.187.0

2009-06-10T18:28:00.000-07:00

Note: This release has been stopped. The browser crashes whenever you click on a menu item. We'll be releasing a fix later today. [mal, 11 June 2009]

Google Chrome 3.0.187.0 has been released to the Dev channel for Windows, Mac OS X, and Linux.

Highlights for this release:

Linux: Import passwords from Firefox. (Issue: 11191)
On Mac use Keychain for passwords. (Issue: 11745)
Fix regression where Omnibox would drop characters during rapid typing. (Issue: 13428)
The web inspector is now working again. (Issue 13411)
Fix browser hang due to plugin deadlock. (Issue: 12624)
--enable-user-scripts is working again. (Issue 13290)
Clicking an extension toolstrip no longer selects the first tab. (Issue 13547)
Extension buttons now show after install (Issue 13609)
Increase the maximum number of cookies to 3000. This matches Firefox. (Issue: 8850)
When the contents don't have title, use URL for the name of bookmark entry. (Issue: 5965)
Move download shelf from per-tab to per-window. (Issue: 9025)
Improved support for Squid proxies. (Issue: 8771)
Fixes a flash plugin hang on Google Finance ticker symbols in a background tab. (Issue: 12993)

Version Changes:

V8 - 1.2.7

The release notes are available as well as a detailed list of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug athttp://code.google.com/p/chromium/issues/entry.

Jonathan Conradt

Engineering Program Manager

Stable update: 2 WebKit security fixes

2009-06-09T12:47:00.000-07:00

Google Chrome's Stable channel has been updated to version 2.0.172.31 to fix two security issues in WebKit.

CVE-2009-1690 Memory corruption

A memory corruption issue exists in WebKit's handling of recursion in certain DOM event handlers. Visiting a maliciously crafted website may lead to a tab crash or arbitrary code execution in the Google Chrome sandbox. This update addresses the issue through improved memory management.

Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.

Mitigations:

A victim would need to visit a page under an attacker's control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.

CVE-2009-1718 Drag and drop information leak

An issue exists in WebKit's handling of drag events. This may lead to the disclosure of sensitive information when content is dragged over a maliciously crafted web page. This update addresses the issue through improved handling of drag events.

Severity: Medium. An attacker might be able to read data belonging to another web site, if a user can be convinced to select and drag data on an attacker-controlled site.

Mark Larson

Google Chrome Program Manager

Dev Channel Release

2009-06-04T14:01:00.000-07:00

Google Chrome 3.0.183.1 has been released to the Dev channel.

Highlights for this release:

Fixed issue where non-media types such as text would display a media player. (Issue: 12777)
New Downloads page shows the remaining time left for downloads. (Issue: 9607)
Various fixes for right-to-left langugages
Multiple crash and usability fixes.

Known Issue:

Google Chrome crashes on Windows XP when you click the "Reset to default theme" button (Issue 13075).

Version Changes:

V8 - 1.2.6.1

The release notes are available as well as a detailed list of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Anthony Laforge

Technical Program Manager

Dev update: Larger fonts

2009-05-28T17:30:00.000-07:00

Google Chrome 3.0.182.3 has been released to the Dev channel.

The people have spoken. The small font issue affecting most non-English languages has been fixed (issue 12309).

Mark Larson
Google Chrome Program Manager

Dev Channel Release 3.0.182.2

2009-05-27T16:37:00.000-07:00

[Edits: Google chrome now supports the video tag. Also adding a note about the known issue with small fonts. --mal, 27 May 2009]

Google Chrome 3.0.182.2 has been released to the Dev channel.

Highlights for this release:

Google Chrome now supports the video tag.
--auto-spell-correct flag will fix common typos like "teh" for "the" in the blink of an eye.
Various bits of UI clean-up (toolbar and dangerous download bar paint issues).
Multiple crash fixes.

Known Issue:

The font in the browser's user interface is very small in most non-English languages. This will be fixed in the next Dev channel update. (Issue 12309).

Version Changes:

WebKit - 531.0
V8 - 1.2.5.1
Gears - 0.5.21.0

The release notes are available as well as a detailed list of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

Anthony Laforge
Technical Program Manager

Beta update: V8 experiment

2009-05-22T12:19:00.001-07:00

Google Chrome 2.0.172.30 has been released to the Beta channel. The changes in this release since 172.27 are

complete translations in all languages
an experimental change in the V8 JavaScript engine that might improve page load times for pages with a lot of JavaScript.
a fix for a crash when using the French spell check dictionary (Issue 8551)
a fix for a crash when visiting a site with more than 50 feed links (Issue 12075)

You can join the Beta channel by downloading the Google Chrome Beta channer installer.

--Mark Larson

Google Chrome Program Manager

Stable Update: Google Chrome 2.0.172.28

2009-05-21T11:00:00.000-07:00

We're promoting 2.0.172 from Beta to the Stable channel today.

We've made a lot of changes to stuff you never see, such as a newer version of WebKit for rendering web pages, a new network stack, and improvements to speed up the V8 Javascript engine.

There are some new features like removing Most Visited sites from the New Tab page, form autofill, and full screen mode.

We're also proud to announce that Google Chrome is now available in 50 languages. We added Bengali, Gujarati, Kannada, Malayalam, Marathi, Oriya (on Windows Vista only), Tamil, and Telugu in this release.

You can read more about it here.

--Mark Larson

Google Chrome Program Manager

Dev Channel Update: 2.0.181.1

2009-05-20T14:29:00.000-07:00

Google Chrome has been updated to 2.0.181.1 on the dev channel. This release contains many localization, crash, and ui behavior fixes.

Version Changes:

WebKit - 530.11
V8 - 1.2.4.1
Gears - 0.5.21.0

Changes:

Fixed a common crash when using a French spell-check dictionary. (Issue: 8551)
Fixed a regression where maximizing Chrome turned the tab-background black. (Issue: 11695)
Improved remote desktop (RDP) performance by using the standard dotted rectangle when moving a tab out. (Issue: 805)
The command line debugger has been replaced by a graphical debugger using the WebKit inspector scripts tab to debug JavaScript running in V8.
It is now possible to set proxy setting from the command-line. See the issue for more information. (Issue: 266)

Jonathan Conradt

Engineering Program Manager

Beta Update: Bug fixes and translations

2009-05-14T17:08:00.000-07:00

Google Chrome 2.0.172.27 has been released to the Beta channel. This release adds translations for all new features in all supported languages. We've made a number of fixes to improve reliability and updated the version of Gears to 0.5.19.0.

You can install the current Beta channel release from http://www.google.com/intl/en/landing/chrome/beta/.

Please report bugs at http://code.google.com/p/chromium/issues/list.

Mark Larson

Google Chrome Program Manager

Dev Channel Updated with Bug Fixes

2009-05-12T17:01:00.000-07:00

Google Chrome has been updated to 2.0.180.0 on the dev channel.

Version Changes:

WebKit	530.9
V8	1.2.2.1

Visible changes:

[r14827] Support PgUp/PgDn in Omnibox for "first entry/last entry." (Issue: 6857)
[r15115] Tell the user if Chrome is not the default browser. (Issue: 9049)
[r15702] You can choose to allow pop-ups from a site. (Issue: 11440)

Other changes of note:

[r14891] Fix for crashing when zoomed into street level on maps.yahoo.com (Issue: 2044)
[r14731] Patch from Mohamed Mansour for systems without an installed printer. (Issue: 6835)
[r15020] Stop the location bar from flashing white when navigating from one HTTPS site to another. (Issue: 11157)
[r15214] Fix for common issues around opening a new window. (Issues: 6377, 6192, 835)
Lots of work around Extensions. (See r15417, r15271, r15310)

No Dev update this week

2009-05-08T21:23:00.000-07:00

[Edit, 11 May 2009: Change 'bandwidth' to 'test capacity'. Sometimes the colloquial jargon we use at work translates imprecisely for a public audience.]

We were not able to issue a Dev channel release this week. Our test team did a great job in qualifying two Stable udpates and a Beta update this week, and we just didn't have the test capacity to push a Dev channel release.

We'll get an update out early next week. Stay tuned for some exciting new features we hope to land in the Dev channel.

Mark Larson
Google Chrome Program Manager

Beta Update

2009-05-08T16:01:00.000-07:00

Google Chrome's Beta channel has been updated to 2.0.172.23. This release includes about 200 changes pulled in from the releases subsequent to 2.0.172.2.

Some highlights for this release:

Lots of UI tweaks, bug, and stability fixes!
Added the ability to remove most visited thumbnails from the New Tab page. (Issue: 685)
Autocomplete now pulls suggestions from search engines that support the functionality, and retains a history of those searches. For example, if you have searched from wikipedia.org in the past, start typing wikipedia.org in the omnibox, press the Tab key then a search term and suggestions and past searches will appear for Wikipedia. (Issue: 3636)
Added a confirmation box when closing the browser with in progress downloads. (Issue: 1028)
Added "Reopen closed tab" and create "New Tab" to the context menu on the tab bar. (Issue: 2144)

Please report bugs at http://code.google.com/p/chromium/issues/list.

A detailed list of changes in this release is in the release notes.

Anthony Laforge, PMP

Google Chrome

Stable Update: Bug fix

2009-05-07T15:39:00.000-07:00

Edit 13 May 2009: Disclosing that this release contains the fix for CVE-2009-0945, an issue in WebKit code that also affects Apple's Safari web browser. We did not want to disclose this until Apple's fix for Safari users was released.

Google Chrome's Stable channel has been updated to version 1.0.154.65 to fix a crash during startup for a small percentage of users.

CVE-2009-0945 Denial of service in SVG

A memory corruption issue exists in WebKit's handling of SVGList objects. Visiting a maliciously crafted website may lead to arbitrary code execution. The arbitrary code would be limited by the Google Chrome sandbox.

More info: http://code.google.com/p/chromium/issues/detail?id=9019

Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.

Mitigations:

A victim would need to visit a page under an attacker's control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.

Mark Larson

Google Chrome Program Manager

Stable Update: Security Fix

2009-05-05T16:07:00.001-07:00

Google Chrome's Stable channel has been updated to version 1.0.154.64 to fix two security issues discovered by internal Google testing.

This release also contains

A new notification at startup that makes it easier to set Google Chrome as the default browser. If you don't want Google Chrome to be the default browser, you can click 'Don't ask again'.
A new version of Gears (0.5.16.0)

Security Fixes

CVE-2009-1441: Input validation error in the browser process.

A failure to properly validate input from a renderer (tab) process could allow an attacker to crash the browser and possibly run arbitrary code with the privileges of the logged on user. To exploit this vulnerability, an attacker would need to be able to run arbitrary code inside the renderer process.

More info: http://code.google.com/p/chromium/issues/detail?id=10869

Severity: Critical. An attacker might be able to run code with the privileges of the logged on user.

Mitigation: An attacker would need to be able to run arbitrary code in the renderer process.

CVE-2009-1442: Integer overflow in Skia 2D graphics.

A failure to check the result of integer multiplication when computing image sizes could allow a specially-crafted image or canvas to cause a tab to crash and it might be possible for an attacker to execute arbitrary code inside the (sandboxed) renderer process.

More info: http://code.google.com/p/chromium/issues/detail?id=10736

Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.

Mitigations:

A victim would need to visit a page under an attacker's control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.

Mark Larson

Google Chrome Program Manager

Dev Update: UI Tweaks and crash fixes

2009-04-30T11:19:00.000-07:00

Google Chrome 2.0.177.1 has been released to the Dev channel.

It includes a number of fixes and a couple UI tweaks. For example, if you have searched from wikipedia.org in the past, start typing wikipedia.org in the omnibox, press the Tab key then a search term and suggestions and past searches will appear for Wikipedia. Other fixes include:

[r14196] Scrollbars, Home/End work again in Gmail (Issue: 10009)
[r14377] Flash (and other plugins) can be installed without restarting the browser. (Issue: 10574)
[r14137] Fix hang seen in plugin process, including the new O3D plugin. (Issue: 10711)
[r13934] On some sites text disappears or is never drawn. For example, on Google Calendar, the titles for all day events do not display. (Issue: 9904)

Detailed release notes are available. You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

--Jonathan Conradt

Google Chrome Program Manager

Stable Update: Security Fix

2009-04-23T11:59:00.000-07:00

Edit (24 April): Removed "Such an attack only works if Chrome is not already running."

Google Chrome's Stable channel has been updated to 1.0.154.59 to fix a security issue:

CVE-2009-1412 ChromeHTML protocol handler same-origin bypass
An error in handling URLs with a chromehtml: protocol could allow an attacker to run scripts of his choosing on any page or enumerate files on the local disk under certain conditions.

If a user has Google Chrome installed, visiting an attacker-controlled web page in Internet Explorer could have caused Google Chrome to launch, open multiple tabs, and load scripts that run after navigating to a URL of the attacker's choice.

See http://code.google.com/p/chromium/issues/detail?id=9860 for more details.

Affected versions: 1.0.154.55 and earlier

Severity: High. This allows universal cross-site scripting (UXSS) without user interaction under certain conditions.

Credit: Roi Saltzman (roisa@il.ibm.com) Security Researcher at IBM Rational Application Security Research Group

--Mark Larson
Google Chrome Program Manager

Beta update: Fix text disappearing and non-admin launch

2009-04-20T16:58:00.000-07:00

Google Chrome 2.0.172.8 has been released to the Beta channel to fix two major issues:

[Issue 9904] On some sites text disappears or is never drawn. For example, on Google Calendar, the titles for all day events do not display.
[Issue 10656] Google Chrome Beta does not launch after the update to 172.6. This affects users who installed Google Chrome through Google Pack, joined the Beta channel, and do not run as an administrator.

There are no other changes in this release.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry.

--Mark Larson

Google Chrome Program Manager

Dev Update: Remove Thumbnails from the New Tab Page

2009-04-16T11:20:00.000-07:00

Google Chrome's Dev channel has been updated to 2.0.174.0.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

Notable Changes:

Ability to remove thumbnails from the New Tab Page (feature still in development). (Issue: 685)
Added "Undo Tab Close" and "New Tab" to the context menu on the tab bar. (Issue: 2144)
It is no longer possible to cut or copy from a password text-field. (Issue: 9425)
Ctrl+Shift+Arrow allows change in text direction in RTL UIs. Also now support Ctrl+Shift text alignment based on which side of the keyboard those keys are pressed.(Issues: 9762, 9763)

Last Week's Known Issues Fixed:

Fixed issue where Google Calendar widget was not showing events. (Issue: 8935)

Known Issues:

Text disappears in certain web applications. For example, labels on all day events in Google calendar do not appear except when moused over. (9904)
Mouse wheel scrolling does not scroll windows that aren't focused. (9647)
Vertical scrollbar disappears when maximizing and resizing window in Gmail. (10009)
Delete history from Incognito mode does not refersh the history page. (Issue: 9984)
IME issue, form autofill pop-up overlaps the IME candidate window. (Issue: 9596)

Let us know about the issues you find by filing a bug, but please search the open issues first.

A detailed list of changes in this release is in the release notes.

-- Anthony Laforge

Google Chrome Program Manager