Google chrome Patch Archives

Important: Adobe will no longer update and distribute Flash Player after December 31, . Therefore, after this date, all versions of Chrome will stop supporting Flash content. You can read more about Adobe's plans to discontinue Flash player and your options in Adobe's blog post. Adobe is working with HARMAN, their exclusive licensing/distribution partner, to provide support for Flash Player in legacy browsers.

Chrome is designed to meet the needs of Chrome Enterprise customers, including integration with legacy web content. Companies that need to use a legacy browser to run Flash content after December 31 should use a HARMAN solution with Legacy Browser Support.

Chrome Browser updates

• User-Agent Client Hints will be introduced in Chrome 85
  As part of an ongoing effort to reduce bad actors’ ability to track users, Chrome plans to reduce the granularity of information that is part of the user agent string and expose that information through User-Agent Client Hints. In Chrome 84, we introduced User-Agent Client Hints for some users. This is an additive change only, and should not have any negative effect when interacting with any standards-compliant server.

  However, some servers may not be able to accept all characters in the User-Agent Client Hints headers, part of the broader Structured Headers emerging standard. If the addition of this header causes problems with servers that cannot be fixed quickly, you will be able to use the UserAgentClientHintsEnabled policy to disable the added headers. This is a temporary policy that will be removed in Chrome

  A full rollout of this change is planned in Chrome

• The default referrer policy will change in Chrome 85
  The HTTP referrer header provides the full URL of the initiating document alongside many navigation and subresource requests. In practice, it can reveal users’ browsing habits or identities. Chrome will improve user privacy and security by switching to strict-origin-when-cross-origin as the default policy, instead of no-referrer-when-downgrade. Web developers may specify a referrer policy on their documents if they need a different policy.

  The expected long-term fix is to update all web apps to preferably not depend on the full URL for the referrer, and where unavoidable, specify a referrer policy when they require something other than strict-origin-when-cross-origin. However, to help with the transition, enterprises will be able to use the ForceLegacyDefaultReferrerPolicy enterprise policy to revert to the old default behavior until Chrome  
  
  See more info and best practices.

• Chrome bit on Windows will be installed in "Program Files" instead of "Program Files (x86)"

  New installations of bit Chrome will be installed in "%ProgramFiles%" on Windows instead of "%ProgramFiles(x86)%". Existing installations won't be impacted.

• Improvements to user productivity in Chrome 85

  Chrome will be making several improvements to user productivity, including collapsible tab groups, tab previews, saving inputs in PDFs, and QR code sharing. You can read more about these improvements on the Keyword.

• Compiler optimization performance improvements in Chrome 85

  Chrome will use an improved compiler optimization technique called PGO (Profile-guided optimization) on Mac and Windows. Enterprises aren't expected to notice any changes, except how software interacts with Chrome in unexpected or unsupported ways. For example, code injection may not function as expected with this version of Chrome.

• Insecure downloads will be blocked from secure pages in Chrome 84 through Chrome 88

  By Chrome 88, downloads from insecure sources will no longer be allowed when started from secure pages. This change will be rolled out gradually, with different file types affected in different releases:    

• Executables—Users were warned in Chrome 84, and files will be blocked in Chrome
• Archives —Users will be warned in the Chrome developer console in Chrome 85, and files will be blocked in Chrome
• Other non-safe types (For example, PDFs)—Users will be warned in the Chrome developer console in Chrome 86, and files will be blocked in Chrome
• Other files—Users will be warned in the Chrome developer console in Chrome 87, and files will be blocked in Chrome

Warnings on Android will lag behind Desktop warnings by one release. For example, executables will show a warning starting in Chrome

The existing InsecureContentAllowedForUrls policy can be used to allow specific page URLs to download insecure files. You can read more details in our blog post.

• Wildcards are no longer supported in PluginsAllowedForUrls in Chrome 85

  In preparation for the Flash deprecation later this year, Chrome will be removing the ability for enterprises to define entries with wildcards in hostnames (For example, “https://*” or “https://[*.]pachasnack.com”) for the PluginsAllowedForUrls policy. If you're using hostname wildcards, you will need to explicitly specify which hostnames still require Flash. For example, “https://[*.]pachasnack.com” would need to be updated to match explicit entries like “pachasnack.com”. This change is intended to help determine which sites still require updating, with time to make an adjustment before support for Flash is removed completely in December,

• The Legacy Browser Support extension will be removed from the Chrome Web Store in Chrome 85

  Legacy Browser Support (LBS) is now built into Chrome, and the old extension is no longer needed. The Chrome team is planning to unpublish LBS from the Chrome Web Store in Chrome 85, and it will be removed from browsers in Chrome To continue using Legacy Browser Support, ensure that you're using Chrome's built-in policies, documented here.  The old policies set through the extension will no longer take effect when the extension is removed. 

  The Beta version of the extension (Extension ID ) will be removed in Chrome

• Cross-origin fetches will be disallowed from content scripts in Chrome Extensions in Chrome 85

  As part of an effort to improve Chrome Extension security, cross-origin fetches are being disallowed from content scripts in Chrome Extensions. Cross-Origin Read Blocking (CORB) has already applied to content scripts since M We plan to also enable CORS for content script requests starting in M We expect most extensions to be unaffected by the CORS change, but there is a chance that some requests initiated from content scripts may start to fail.

  Please test Chrome Extensions that your business depends on to make sure they work with the new behavior when Chrome is launched with the following cmdline flags (in or later):

  During the test, watch for fetches or XHRs that are initiated by content scripts and blocked by CORS. If extensions you depend on are affected, open a bug to add the affected extensions to a temporary allowlist which will exempt them from the change (the allowlist will be deprecated and removed in Chrome 87). The changes only affect fetches or XHRs for content types that are not blocked by CORB (such as images, JavaScript, and CSS) and only if the server does not approve the CORS request with an Access-Control-Allow-Origin response header.

• Improved resource consumption when a window is not visible in Chrome 85

  To save on CPU and power consumption, Chrome will detect when a window is covered by other windows and will suspend work painting pixels. A previous version of this feature had incompatibility issues with some virtualization software. Known bugs have been fixed, but if you experience any issues, you will be able to disable this feature using the NativeWindowOcclusionEnabled policy.

  Some users will see the change in Chrome 85, with a full rollout planned for Chrome

• Introduction of AutoLaunchProtocolsFromOrigins policy in Chrome 85

  The new AutoLaunchProtocolsFromOrigins policy allows you to specify combinations of external protocols and origins that should be launched automatically, without requiring user confirmation.

• Chrome on MacOS has additional protections for sensitive enterprise policies in Chrome 85

  Macs that are not managed by a UEM/EMM/MDM (or legacy MCX) will ignore sensitive enterprise policies that may be set by malware. This check already happens for sensitive policies on Windows, and will apply to the same set of policies on MacOS.

• Cross-Origin Resource Setting (CORS) enterprise policies are no longer available

  The CorsMitigationList and Cors​Legacy​Mode​Enabled policies have been removed in Chrome 84, as previously communicated.

• The ForceNetworkInProcess policy is now deprecated

  Chrome 73 introduced a change to move network activity into a separate process. We were aware of known incompatibilities with some third-party software that were injected into Chrome's process, so the ForceNetworkInProcess policy was provided as a temporary stop-gap to revert to the old behavior. The transition period for this change ended in Chrome 84, and the policy is no longer available.

• Certificates issued on or after September 01, must have a lifetime of days or less in Chrome 85

  As part of our ongoing commitment to ensuring user security, Google is reducing the maximum allowed lifetimes of TLS certificates. More details here.

• Chrome 85 uses the Windows-native spell checker for some users

  For Windows users that have the corresponding language packs installed on their system, Chrome will use the Windows-native spell checker. Users without the corresponding language pack will default to the Chrome spell checker.

  Some users will see this change in Chrome 85, with a full rollout planned in Chrome

• The Chrome Web Store tells users if an extension has been blocked by their admin in Chrome 85

  If you block an extension by policy, the Chrome Web Store extension listing will now show “Blocked by Admin” to the user.

• Chrome-on-iOS enterprise policies in Chrome 85

  Chrome supports a limited set of policies on iOS, configurable with unified endpoint management systems.

Chrome OS updates

• Separating Display Resolution and Refresh Rate for external monitors

  The "Displays" page in Settings has been updated to allow independent configuration of the resolution and the refresh rate for external monitors. This setting will be split automatically and users do not need to take any action.

  

• Sync Wi-Fi settings between devices

  To help users avoid repeatedly joining the same set of networks and typing in the same difficult-to-remember passwords on each of their Chrome OS devices, Wi-Fi Sync helps keep known networks in sync between a user's devices. This can be controlled using the SyncTypesListDisabled policy.

• Option for improved visuals for Select to Speak

  Select to speak lets users drag a box around a given area of text to have text in that area spoken aloud. We’ve now added the option to turn on screen shading behind the selected region of the screen. This screen shading will reduce distraction and help to enhance the user's focus on the core content being spoken aloud.

• Improved gesture support for handwriting keyboard

  When entering text using the handwriting keyboard, you can now use familiar gestures to edit your handwriting. Drawing a strikethrough will delete text, and a caret will give you space to insert text.

• Improved Print management UI

  Users can now manage their ongoing print jobs and view what has been completed.

   

• PIN printing for Hewlett-Packard^®, Ricoh^®, and Sharp^® printers

  Extended PIN printing is now available for all supported Hewlett-Packard^®, Ricoh^®, and Sharp^® printers that require a PIN to release the print job to a printer.

  

Admin console updates

• Updated Admin consoleDevices hub page

  The Devices hub in the Admin console is refreshed with a new look and feel, faster load times, and a brand new navigation structure on the left side of the page.

• View apps & extensions that are configured across all organizational units

  The apps & extensions page in the Admin console now supports “Include all organizational units.” Selecting this view will display all apps configured across all modes (User & browser, Devices, and Managed guest session) and all organizational units.

• Expanded ability to block system features

  Admins can now block system features at a granular level directly, without URL blocking. The Camera app, Chrome browser settings and Chrome OS settings are all configurable through policy.

• Connected devices policies for Android phones + Chrome OS devices

  User settingsConnected devices is a suite of features that allows Android phones and Chrome devices to work together seamlessly. Education organizations can enable Smart Lock and Click to Call. In addition, Enterprise organizations can enable Instant Tethering and Messages.

• Multi-select devices for clearing user profiles

  From the ChromeDevices list, admins can now multi-select devices to clear user profiles from all devices at the same time.

Additional policies now available in the Admin console

Many additional new policies are available in the Admin console, including:

• PrintingMaxSheetsAllowed

  User settingsPrintingMaximum sheets - Set a maximum number of pages for a single print job.

• PrintingMaxSheetsAllowed and PrintingPaperSizeDefault

  User settingsPrintingDefault printing page size - Set a default paper page size for print jobs. 

• AppCacheForceEnabled

  User settingsContentAppCache - Allow websites to use the deprecated AppCache browser feature.

• HardwareAccelerationModeEnabled

  User settingsHardwareGPU - Enable or disable GPU hardware acceleration

• ScrollToTextFragmentEnabled

  User settingsContentScroll to text fragment - Allow sites to scroll directly to a text fragment via URL

• HideWebStoreIcon

  Apps & extensionsAdditional settingsChrome Web Store app icon - Hide the Chrome Web Store app and footer link from the New Tab Page and Google Chrome OS app launcher.

New and updated policies (Chrome Browser and Chrome OS)

Coming soon

Note: The items listed below are experimental or planned updates. They might be changed, delayed, or canceled before launching to the Stable channel.

Upcoming Chrome Browser changes

• ITP will block third party cookies in Chrome on iOS14

  All Chrome versions on iOS14 will be subject to the new ITP (Intelligent Tracking Prevention) restriction in WebKit, which blocks third party cookies. Apple has provided more information on the changes here: 

• Single words will not be treated as intranet locations by default in Chrome 87

  By default, Chrome will improve user privacy by avoiding DNS lookups for single keywords entered into the address bar. However, this change to default behavior may interfere with enterprises that use single-word domains in their intranet. That is, a user typing "helpdesk" will no longer be directed to "https://helpdesk/".

  You will be able to control the behavior of Chrome via policy, including preserving the existing behavior (which will perform a search immediately and then ask the user if they're trying to reach the intranet site).

• Chrome will warn about mixed content forms in Chrome 86

  Web forms that load via HTTPS but submit their content via HTTP (unsecured) pose a potential risk to users' privacy. Chrome 85 showed a warning on such forms, telling the user that the form is insecure. Chrome will show an interstitial warning when the form is submitted, which will stop any data transmission, and the user will be able to choose to proceed or cancel the submission.

  You will be able to control this behavior using the InsecureFormsWarningsEnabled enterprise policy.

• The address bar will show the domain rather than the full URL for some users in Chrome 86

  To protect your users from some common phishing strategies, Chrome will begin showing only the domain in the address bar in Chrome This change makes it more difficult for malicious actors to trick users with misleading URLs. For example, pachasnack.com will appear only as pachasnack.com to the user.

  Although this change is designed to keep your users' credentials safe, you will be able to revert to the old behavior through the ShowFullUrls policy. This change will initially only roll out to some users, with a full rollout planned for a later release.

• Improved resource consumption for background tabs in Chrome 86

  To save on CPU and power consumption, Chrome will throttle the amount of CPU that background tabs can use. With this change, Chrome will only allow background tabs to wake up once per minute and to only use 1% CPU time.

  You will be able to control this behavior using the IntensiveWakeUpThrottlingEnabled policy.

• Insecure public pages no longer allowed to make requests to private or local URLs in Chrome 86

  Insecure pages will no longer be able to make requests to IPs belonging to a more private address space (as defined in CORS-RFC). For example, http://pachasnack.com will not be able to make requests targeting IP or IP A policy will be provided to turn off this mechanism, and another one to allow specific pages to make requests to more private IP Address Spaces.

• Chrome 86 will have a new way of indicating it should be updated

  To make it more clear that Chrome should be restarted to apply an update, users will see a new UI, with the word "Update."

  

• Chrome extensions will not be able to inject Flash content settings in Chrome 86

  Extensions will not be able to inject content settings for Flash. Admins should instead use policies to control Flash behavior on Chrome. See PluginsAllowedForUrls.

• The Chrome Cloud Management - Reporting Companion extension will cease functionality in Chrome 86

  The Chrome Cloud Management - Reporting Companion extension (ID ) is no longer necessary, as its functionality has been integrated into Chrome browser. If you are manually force-installing this extension, you can safely stop doing so. Please ensure that you've set "Enable managed browser cloud reporting" in the admin console instead.

  The extension will no longer function in Chrome

• The TLS13HardeningForLocalAnchorsEnabled enterprise policy will no longer function in Chrome 86

  As documented in the policy description, support for the TLS13HardeningForLocalAnchorsEnabled enterprise policy will be removed in Chrome As a result, the security feature will be enabled for all users, protecting your environment from certain TLS downgrade attacks.

  The policy was introduced as a temporary measure to mitigate implementation flaws with some TLS-intercepting proxies. If you had previously set this policy to take advantage of the migration period, please ensure your TLS-intercepting policies are up to date and compliant. You can test Chrome by ensuring it works without this policy set.

• More inclusive policy names will be introduced in Chrome 86 and 87

  Chrome will be moving to more inclusive policy names. The terms "whitelist" and "blacklist" will be replaced with "allowlist" and "blocklist". The following policies will be deprecated, and equivalent policies will be introduced for each: 

If you're already using the existing policies, they will continue to work, though you will see warnings in chrome://policy stating that they're deprecated.

• DTLS will be removed in Chrome 87

  DTLS , a protocol used in WebRTC for interactive audio and video, will be removed by default. Any applications that depend on DTLS (most likely gateways to other teleconferencing systems) should update to a more recent protocol. You can test if any of your applications will be impacted using the following command line flag when launching Chrome:

  If your enterprise needs additional time to adjust, a policy will be made available to temporarily extend the removal.

• Chrome will introduce a new permission chip UI in Chrome 87

  Permission requests can feel disruptive and intrusive when they lack context – which often happens when prompts appear as soon as a page loads or without prior priming. This leads to a common reaction where end users dismiss the prompt in order to avoid making a decision.

  Chrome is experimenting with a permissions chip in the address bar next to the lock, which is less intrusive overall. Since the prompt doesn't intrude in the content area, users who don't want to grant the permission no longer need to actively dismiss the prompt. Users who wish to grant permission can click on the chip to bring up the permission prompt.

• New PDF UI in Chrome 87

  Chrome will have an updated PDF viewer, including toolbar updates, table of contents, thumbnails, two-up view, and annotations viewing.

• Factor in scheme when determining if a request is cross-site (Schemeful Same-Site) in Chrome 88

  Chrome 88 will modify the definition of same-site for cookies such that requests on the same registrable domain but across schemes are considered cross-site instead of same-site. For example, pachasnack.come and pachasnack.come will be considered cross-site to each other.

  For enterprises that need extra time to adjust to these changes, policies will be made available.

Upcoming Admin console changes

• New Version Report and Update Controls

  There will be a new Version Report and Update Controls available in the Admin console. These features give increased visibility into the Chrome versions deployed in your enterprise and allows you to more granularly control how managed Chrome browsers update. If you would like to sign up to be a Trusted Tester for these features please enter your test domain and a contact email into this form.

Important: Adobe will no longer update and distribute Flash Player after December 31, , therefore Chrome will no longer support Flash content. You can read more about Adobe's plans to discontinue Flash player in Adobe's blog post. Adobe is working with HARMAN, their exclusive licensing/distribution partner, to provide support for Flash Player in legacy browsers.

Chrome is designed to meet the needs of Chrome Enterprise customers, including integration with legacy web content. Companies that need to use a legacy browser to run Flash content after December 31, can get set up with HARMAN and Legacy Browser Support.

Chrome Browser updates

• Updates to cookies with SameSite

  Starting on July 14, cookies that don’t specify a SameSite attribute will be treated as if they were SameSite=Lax. Cookies that still need to be delivered in a cross-site context must explicitly request SameSite=None. Cookies with SameSite=None must also be marked Secure and delivered over HTTPS. To reduce disruption, the updates will be enabled gradually, so different users will see it at different times. We recommend that you test critical sites using the instructions for testing.

  You will be able to revert to the legacy cookie behavior using policies until Chrome You can specify domains accessing cookies that require legacy semantics using LegacySameSiteCookieBehaviorEnabledForDomainList or control the global default with LegacySameSiteCookieBehaviorEnabled. For more details, visit Cookie Legacy SameSite Policies.

  This change started with Chrome 80, but was temporarily on hold in light of the COVID pandemic. It’s being set in motion again, and will take effect in Chrome 80 and more recent versions of Chrome.

• Insecure downloads will be blocked from secure pages in Chrome 84 through Chrome 88

  By Chrome 88, downloads from insecure sources will no longer be allowed when started from secure pages. This change will be rolled out gradually, with different file types affected in different releases:     

• Executables—Users will be warned in Chrome 84, and files will be blocked in Chrome
• Archives —Users will be warned in the Chrome developer console in Chrome 85, and files will be blocked in Chrome
• Other non-safe types (e.g. pdfs)—Users will be warned in the Chrome developer console in Chrome 86, and files will be blocked in Chrome
• Other files—Users will be warned in the Chrome developer console in Chrome 87, and files will be blocked in Chrome

Warnings on Android will lag behind Desktop warnings by one release. For example, executables will show a warning starting in Chrome

The existing InsecureContentAllowedForUrls policy can be used to allow specific page URLs to download insecure files. You can read more details in our blog post.

• Improved resource consumption when window is not visible

  To save on CPU and power consumption, Chrome will detect when a window is covered by other windows and will suspend work painting pixels. A previous version of this feature had an incompatibility with some virtualization software. Known bugs have been fixed, but if you experience any issues, you will be able to disable this feature using the NativeWindowOcclusionEnabled policy.

  Some users will see this feature in Chrome 84, with a full release planned in Chrome

• Chrome remembers user preferences when launching external protocols

  As requested by IT admins, users are able to select "always allow for this site" when opening an external protocol in Chrome The approval is scoped to the current origin, and is only available for secure origins.

• The URLWhitelist policy only allows external protocols for domain joined devices

  A recent release of Chrome changed the behavior of the URLWhitelist policy which lets you allow external protocols such as “callto:” or “ms-calendar”. To improve security on Windows^®, this policy only allows external protocols for devices joined to an Active Directory domain.

• Deprecation of TLS and TLS

  The Chrome team announced in October , plans for the deprecation of legacy TLS versions (TLS and ). In Chrome 84, we will mark sites that do not support TLS and above with a full-page warning telling users that the connection is not fully secure. 

  If users have sites affected by these changes and need to opt out, you can use the SSLVersionMin policy to turn off the security indicator and warning. To allow TLS and later without additional warnings, set the policy to tls1. The SSLVersionMin policy will work until January More details are available in our blog post.

• Improvements to Chrome downgrades

  When a managed Chrome browser updates to the next version, it will retain a snapshot of User Data. This is useful for admins when Sync is turned off and they need to rollback to a previous version of Chrome. The number of snapshots can be controlled using the UserDataSnapshotRetentionLimit policy and Chrome can function as it did before by setting UserDataSnapshotRetentionLimit to 0. For more details, visit Downgrade your Chrome version.

• Stronger consent for the search and new tab page

  Chrome will protect against extensions that attempt to change the user's preferences without their consent. After an extension changes the default search engine or the new tab page, Chrome will confirm the change with the user, and allow them to keep the change or revert back to the old settings.

  As an admin, you can control your employees' default search provider directly using the Default Search Provider and NewTabPageLocation policies. They will not trigger a confirmation dialog.

• User-Agent Client Hints

  As part of an ongoing effort to reduce bad actors’ ability to track users, Chrome plans to reduce the granularity of information that is part of the user agent string and expose that information through User-Agent Client Hints. In Chrome 84, we are introducing User-Agent Client Hints for some users. This is an additive change only, and should not have any negative effect when interacting with any standards-compliant server.

  However, some servers may not be able to accept all characters in the User-Agent Client Hints headers, part of the broader Structured Headers emerging standard. If the addition of this header causes problems with servers that cannot be fixed quickly, you will be able to use the UserAgentClientHintsEnabled policy to disable the added headers. Although, this is a temporary policy that will be removed in Chrome

  You can test your environment by enabling the "experimental web platform features" flag in Chrome. A wider rollout of this change is planned in Chrome

• Cross-Origin Resource Sharing (CORS) enterprise policies will no longer take effect

  The CorsMitigationList and Cors​Legacy​Mode​Enabled policies have been removed in Chrome 84, as previously communicated.

• The ForceNetworkInProcess policy is now deprecated

  Chrome 73 introduced a change to move network activity into a separate process. We were aware of known incompatibilities with some third-party software that were injected into Chrome's process, so the ForceNetworkInProcess policy was provided as a temporary stop-gap to revert to the old behavior. The transition period for this change ends in Chrome 84, and the policy is no longer available.

Chrome OS updates

• Camera app supports MP4 (H)

  Videos captured in the Chrome OS Camera app will now save as MP4 (H) videos. This makes it easier to use your recorded videos in other apps.

• Window management improvements for multiple monitors and split screen

  When in Overview mode you can now drag a window to the left or right edge to quickly set up a split screen. If you use multiple monitors, you can drag windows to other displays while in Overview mode.

• Adding search functionality to the ChromeVox menu

  For screen reader users, the ChromeVox menu is a one-stop-shop for learning about ChromeVox and accessing key information and commands. When ChromeVox is turned on, press Search + Period at any time to open the menu and explore options such as jump commands, speech options, and much more. As of Chrome 84, it's now possible to search within the ChromeVox menu to find what you are looking for even faster! Simply open the menu and your mouse cursor will automatically be placed in the Search field. You can either search for a given item, or use the arrow keys to navigate the menu options.

• Sheet Limit Policy for Native Printing

  Many organizations would like to limit the amount of paper used when printing. With the PrintingMaxSheetsAllowed policy, admins can limit the number of sheets used in a single print job for their managed devices users. For example, placing a limit on printing excessively large documents such as an entire digital textbook, ebook, or accidental print requests, prevents ink and paper waste.

• Chrome OS login/lock screen enterprise disclosure

  On the login screen, Chrome OS now shows an enterprise badge on managed profiles. This allows users to see at first glance whether their profile is managed or not.

• Crostini mic permission

  You can now give Crostini access to your microphone through Settings. If you're developing an Android app, you can test the microphone feature using the Android emulator.

Admin console updates

• Update controls are available for managed browsers

  In the Admin console, admins can now configure additional update policies for Chrome browsers that are managed by Chrome Browser Cloud Management. For example, you might want to allow or disable updates, pin a specific version of Chrome, roll back to a previous version of Chrome, set relaunch notifications, or control when Chrome checks for updates. The configuration details are further described in this help center article.

• Network file shares policy

  Admins can now configure network file shares for users under Chrome managementUser settingsNetwork file shares. These policies include configuration of SMB settings for NetBIOS discovery, NTLM authentication, and preconfiguring file shares so users can see them within the Files app on Chrome OS.

• Readable data in the devices export

  Timestamps in the device list’s CSV export file are now in a “human-readable” format. This format helps to make the timestamps easy for users to read. Previously, these columns contained the same value as reported through the Directory API.

• Domain-restricted apps & extensions from the Chrome Web Store

  In the Google Admin console, admins can now add domain-restricted apps & extensions from the Chrome Web Store. These apps are available under Chrome managementAppsAdd from Chrome Web StoreView private apps.

• Device screen resolution

  Admins can now configure the screen resolution and UI scaling for displays.  These settings are available under Chrome managementDevice settingsScreen settings.

• Dinosaur game policy

  When Chrome cannot connect to the internet it displays a “Dinosaur game” for users to play.  This game is disabled by default for domain-enrolled Chrome OS devices, but admins can enable it under Chrome managementUser settingsDinosaur game.

• Ignore proxy on captive portals policy

  Chrome OS can open captive portal authentication pages in a separate window that ignores all policies for the current user, including proxy settings. This policy only takes effect if a proxy is configured through policy in chrome://settings or by extensions. This policy is available under Chrome managementUser settingsIgnore proxy on captive portals.

• Display system info on the sign-in screen

  Your users can view system information such as serial numbers and OS versions on the sign-in screen by pressing Alt+V. Admins can allow or not allow access to this feature under Chrome managementDevice settingsSystem info on sign-in screen.

• Device accessibility policies

  In addition to the launch of advanced accessibility controls for users, a similar set of controls for the login screen allows admins to enable accessibility features remotely or restrict them when necessary. For example, restricting dictation features in hospitals or blocking certain features in classrooms to prevent disruption. See the full list of features below:

  • Spoken feedback
  • Select to speak
  • High contrast
  • Screen magnifier
  • Sticky keys
  • Virtual keyboard
  • Dictation
  • Keyboard focus highlighting
  • Caret highlight
  • Auto-click enabled
  • Large cursor
  • Cursor highlight
  • Primary mouse button
  • Mono audio
  • Accessibility shortcuts

New and updated policies (Chrome Browser and Chrome OS)

Coming soon

Note: The items listed below are experimental or planned updates. They might be changed, delayed, or canceled before launching to the Stable channel.

Upcoming Chrome Browser changes

• Wildcards no longer supported in PluginsAllowedForUrls in Chrome 85

  In preparation for the Flash deprecation later this year, Chrome will be removing the ability for enterprises to define entries with wildcards in hostnames (e.g., “https://*” or “https://[*.]pachasnack.com”) for the PluginsAllowedForUrlspolicy. If you're using hostname wildcards, you will need to explicitly specify which hostnames still require Flash. For example, “https://[*.]pachasnack.com” would need to be updated to match explicit entries like “pachasnack.com”. This change is intended to help determine which sites still require updating, with time to make an adjustment before support for Flash is removed completely in December,

• Compiler optimization performance improvements in Chrome 85

  Chrome will use an improved compiler optimization technique on Mac and Windows in Chrome Enterprises aren't expected to notice any changes, but software interacting with Chrome in unexpected or unsupported ways such as, code injection, may not function as expected with Chrome

  To ensure compatibility, you can test your environment with the Chrome 85 beta channel, starting July 23,

• The Legacy Browser Support extension will be removed from the Chrome Web Store in Chrome 85

  Legacy Browser Support (LBS) is now built into Chrome, and the old extension is no longer needed. The Chrome team is planning to unpublish LBS from the Chrome Web Store in Chrome 85, and it will be removed from browsers in Chrome To continue using Legacy Browser Support, ensure you're using Chrome's built-in policies, documented here.  The old policies set through the extension will no longer take effect when the extension is removed. If you run into issues using the built-in LBS policies please file a new issue report at pachasnack.com

• Cross-origin fetches will be disallowed from content scripts in Chrome Extensions in Chrome 85

  As part of an effort to improve Chrome Extension security, cross-origin fetches are being disallowed from content scripts in Chrome Extensions. Cross-Origin Read Blocking (CORB) has already applied to content scripts since M We plan to also enable CORS for content script requests starting in M We expect most extensions to be unaffected by the CORS change, but there is a chance that some requests initiated from content scripts may start to fail.

  Please test Chrome Extensions that your business depends on, to make sure they work with the new behavior when Chrome is launched with the following cmdline flags (in or later):

  During the test, watch for fetches or XHRs that are initiated by content scripts and blocked by CORS.  If extensions you depend on are affected, then please open bugs to add the affected extensions to a temporary allowlist to exempt them from the change. The changes only affect  fetches or XHRs for content types not blocked by CORB (such as images, JavaScript, and CSS), and only if the server does not approve the CORS request with an Access-Control-Allow-Origin response header.

• Improved resource consumption for background tabs in Chrome 85

  To save on CPU and power consumption, Chrome will throttle the amount of CPU that background tabs can use. With this change, Chrome will only allow background tabs to wake up once per minute and to only use 1% CPU time.

  You will be able to control this behavior using the IntensiveWakeUpThrottlingEnabled policy.

• Introduction of AutoLaunchProtocolsFromOrigins policy in Chrome 85

  The new AutoLaunchProtocolsFromOrigins policy will allow you to specify combinations of external protocols and origins that should be launched automatically, without requiring user confirmation.

• The SafeBrowsingExtendedReportingOptInAllowed policy will no longer take effect in Chrome 85

  The support of SafeBrowsingExtendedReportingOptInAllowed policy will be removed in Chrome Please use SafeBrowsingExtendedReportingEnabled policy instead. You can find the migration instructions on the deprecated policy page.

• Chrome on MacOS will have additional protection for sensitive enterprise policies in Chrome 85

  Macs that are not managed by a UEM/EMM/MDM (or legacy MCX) will ignore sensitive enterprise policies that may be set by malware. This check already happens for sensitive policies on Windows, and will apply to the same set of policies on MacOS.

• Single words will not be treated as intranet locations by default in Chrome 86

  By default, Chrome 86 will improve user privacy by avoiding DNS lookups for single keywords entered into the address bar, which could theoretically be read by a malicious actor. However, this change to default behavior will likely interfere with enterprises that use single-word domains in their intranet. That is, a user typing "helpdesk" will no longer be directed to "https://helpdesk/".

  You will be able to control the behavior of Chrome via policy. In addition to preserving the existing behavior (which will perform a search immediately and then ask the user if they're trying to reach the intranet site), you can also set the intranet site as Chrome's first action.

• Chrome will warn about mixed content forms in Chrome 86

  Web forms that load via HTTPS but submit their content via HTTP (unsecured) pose a potential risk to users' privacy. Chrome 85 will show a warning on such forms, telling the user that the form is insecure. Chrome will show an interstitial warning when the form is submitted, which will stop any data transmission, and the user will be able to choose to proceed or cancel the submission.

  You will be able to control this behavior using the DisableMixedFormsWarning enterprise policy.

• The address bar will show the registrable domain rather than the full URL for some users in Chrome 86

  To protect your users from some common phishing strategies, Chrome will begin showing only the registrable domain in the address bar in Chrome This change makes it more difficult for malicious actors to trick users with misleading URLs. For example, pachasnack.com will appear only as pachasnack.com to the user.

  Although this change is designed to keep your users' credentials safe, you will be able to revert to the old behavior through the ShowFullUrls policy. This change will initially only roll out to some users, with a full rollout planned for a later release.

• DTLS will be removed in Chrome 86

  DTLS , a protocol used in WebRTC for interactive audio and video, will be removed by default. Any applications that depend on DTLS (most likely gateways to other teleconferencing systems) should update to a more recent protocol. You can test if any of your applications will be impacted using the following command line flag when launching Chrome:

  If your enterprise needs additional time to adjust, a policy will be made available to temporarily extend the removal.

• Insecure public pages no longer allowed to make requests to private or local URLs in Chrome 86

  Insecure pages will no longer be able to make requests to IPs belonging to a more private address space (as defined in CORS-RFC). For example, http://pachasnack.com will not be able to make requests targeting IP or IP A policy will be provided to turn off this mechanism, and another one to allow specific pages to make requests to more private IP Address Spaces.

• Chrome extensions will not be able to inject Flash content settings in Chrome 86

  Extensions will not be able to inject content settings for Flash. Admins should instead use policies to control Flash behavior on Chrome. See PluginsAllowedForUrls.   

• More inclusive policy names will be introduced in Chrome 86

  Chrome will be moving to more inclusive policy names in Chrome The terms "whitelist" and "blacklist" will be replaced with "allowlist" and "blocklist". The following policies will be deprecated, and equivalent policies will be introduced for each: 

If you're already using the existing policies, they will continue to work, though you will see warnings in chrome://policy stating that they're deprecated.

• Factor in scheme when determining if a request is cross-site (Schemeful Same-Site) in Chrome 88

  Chrome 88 will modify the definition of same-site for cookies such that requests on the same registrable domain but across schemes are considered cross-site instead of same-site. For example, pachasnack.come and pachasnack.come will be considered cross-site to each other.

  For enterprises that need extra time to adjust to these changes, policies will be made available.

• The Chrome Browser Cloud Management reporting extension will cease functionality in Chrome 86

  The Chrome Browser Cloud Management reporting extension is no longer necessary, as its functionality has been integrated into Chrome browser. If you are manually force-installing this extension, you can safely stop doing so. Please ensure that you've set "Enable managed browser cloud reporting" in the admin console instead.

  The extension will no longer function in Chrome

Upcoming Admin console changes

• New Version Report and Update Controls

  There will be a new Version Report and Update Controls available in the Admin console. These features give increased visibility into the Chrome versions deployed in your enterprise and allows you to more granularly control how managed Chrome browsers update. If you would like to sign up to be a Trusted Tester for these features please enter your test domain and a contact email into this form.

Important: Adobe will no longer update and distribute Flash Player after December 31, , therefore Chrome will no longer support Flash content. You can read more about Adobe's plans to discontinue Flash player in Adobe's blog post. Adobe is working with HARMAN, their exclusive licensing/distribution partner to provide support for Flash Player in legacy browsers.

Chrome is designed to meet Chrome Enterprise customer needs, including integration with legacy web content. For companies that need to use a legacy browser to run Flash content after December 31, , HARMAN and Legacy Browser Supportcan get you up and running.

Chrome Browser updates

• Secure DNS

  The DNS requests of all users will autoupgraded to their DNS provider’s DNS-over-HTTPS (DoH) service if available (based on a list of known DoH-capable servers). This change will roll out gradually throughout Chrome You can disable DNS-over-HTTPS for your users with the DnsOverHttpsMode policy with Group Policy or in the Google Admin Console. Setting it to off will ensure that your users are not affected by Secure DNS.

• Flash Dialog Changes

  Chrome is adding the following warning text to the activation prompt for Flash Player, highlighting the industry wide end of support: "Flash Player will no longer be supported after December " Users will see this prompt, even if Flash is enabled by policy. To learn more, please visit Saying goodbye to Flash in Chrome.

• Legacy Browser Support improvements

  The Legacy Browser Support (LBS) functionality incorporates multiple improvements such as better Kerberos support, interoperability between the LBS extension and the LBS Cloud policies, and reducing the time it takes the user to switch between Chrome and the legacy browser.

• Introduction of tab groups for all users

  Starting in Chrome 80, some users were able to organize their tabs by grouping them together on the tab strip. Each group can have a color and a name to help your users keep track of their different tasks and workflows. This has been rolled out to Chrome, Mac^®, Windows^®, and Linux^® users throughout Chrome

• Changes to the ManagedBookmarks policy

  The ManagedBookmarks policy is subject to strict verification. In Chrome 83, if the name or URL fields are not populated in a string format as described by the policy, this policy might become invalid.

• If your users have any issues viewing the managed bookmarks, check to see if the policy has an error in chrome://policy, or if you're using Chrome Browser Cloud Management, you can check for errors in the Google Admin console. If you do see an error, make sure the Managed Bookmarks policy is using the string types listed above.

• Third-party cookies blocked by default for Incognito sessions

  Chrome now blocks third-party cookies by default during Incognito sessions, however you can enable third-party cookies on a site-by-site basis.

  You can control Chrome's behavior using the BlockThirdPartyCookies policy through Group Policy or the Google Admin console:

  • Not set—The user is able to control third-party cookies and they'll be blocked by default in Incognito sessions.
  • True —Third-party cookies blocked in both Incognito and standard sessions.
  • False—Third-party cookies will not be blocked, and the setting cannot be changed.

• Users can check all of their saved passwords for leaks

  In Chrome 79 we started warning users if their credentials had been compromised in a data leak when they logged into a website. Chrome 83 builds on this feature, allowing users to check on all of their saved passwords at once. This feature uses the same privacy-preserving system introduced in Chrome 79; it does not send plain-text passwords to Google.

  If you wish, you can prevent your users from accessing this feature by preventing Chrome from saving passwords using the Password​Manager​Enabled policy through Group Policy or the Google Admin console.

• Control over the variations framework

  Admins have more granular control over the update behaviors in Chrome In addition to the version controls that exist today, Chrome 83 allows you to configure Chrome variations with the ChromeVariations (Mac^®, Windows^®, and Linux^®) and DeviceChromeVariations (Chrome OS) policies. You can choose between:

  • Variations enabled—The default setting that allows all variations in Chrome.
  • Critical fixes only—Disables all experiments and progressive rollouts, but will still apply variations with immediate and important security or compatibility improvements.