Chrome 135 is out with security updates and new features

Google Chrome 135 Stable is now available for all supported platforms. The new version of Google's browser is a security and feature update.

Users on unmanaged devices should receive the update automatically. Desktop users may speed up the installation by selecting Menu > Help > About Google Chrome, or by loading the address chrome://settings/help directly in the address bar.

Chrome should pick up the update automatically when the page is opened. A restart is required to finish the update.

Chrome 135: security changes

Google says that it fixed 14 security issues in the desktop version of Chrome and the mobile Android version.  Nine of the security issues were reported by external researchers, and only those are revealed publicly by Google. The aggregate severity rating is high, which means that there are not any critical issues that were reported openly to Google.

Google does not mention exploits in the wild, which means that the company has not seen signs of malware actors exploiting one of the vulnerabilities already in attacks.

Chrome 135 includes a new privacy feature: HTST Tracking Prevention.

Websites and services may use HTTP Strict Transport Security (HSTS) to declare themselves accessible only through security connections. It is declared by sites via the Strict-Transport-Security HTTP response header field and may also be declared through other means.

The anti-tracking feature in Chrome prevents third-parties from using the feature for tracking. This is done by disallowing HSTS upgrades for sub-resource requests in Chrome.

Here is a simple example of how HSTS can be used for tracking:

• Any hostname may declare HSTS.
• Trackers can load content from several subresources on a webpage and create a unique identifier using declarations. Think long binary code that can unique identify a user.
• When a user visits a site that loads the subresources, the tracker can identify users by observing which connections are made via HTTP and which via HTTPS.

Fun fact: we covered HSTS tracking in Firefox back in 2015 already.

Other changes in Chrome 135

The new browser version includes a number of other changes that users need to know about:

• Enhanced Protection users benefit from "on-device Large Language Models (LLMs) to identify scam websites". The LLM is collecting security-related signals from the webpage and sending them to Safe Browsing. This rolled out in Chrome 134, but Chrome 135 is now showing warnings to the user based on the verdict of its Safe Browsing server.
• Google says that the password form detection has improved thanks to "new client-side Machine Learning", which better parses forms on the web.
• Extensions may now be saved to a Google Account. This rolls out to some users only and is shown only when new extensions do get installed.
• Incognito Mode blocks third-party cookies. Our tip, just block all third-party cookies instead.

Developers may check out the beta release notes on the Chrome for Developers website for development-related changes.

Now You: do you use Chrome or have it installed? What is your take on the changes and features? Something there for you? Feel free to leave a comment down below.

Advertisement