Chromium Blog: April 2020

Keeping spam off the Chrome Web Store

Wednesday, April 29, 2020

Since the introduction of the Chrome Web Store in 2011, it has become the largest catalog of browser extensions with over 200,000 available to all of our users. This has helped millions of users to customize their browsing experience on Chrome in ways we could have never imagined, from niche utilities to companies building businesses around the platform’s capabilities.

In response, our abuse systems and review teams have been hard at work ensuring that the Chrome Web Store is free from abuse, as many of our developers have noticed an increase in review times lately. However, the increase in adoption of the extension platform has also attracted spammers and fraudsters introducing low-quality and misleading extensions in an attempt to deceive and trick our users into installing them to make a quick profit. We want to ensure that the path of a user discovering an extension from the Chrome Web Store is clear and informative and not muddled with copycats, misleading functionalities or fake reviews and ratings. Therefore, in order to keep the quality of our inventory high and help users find what they want, we’re introducing some updates to our spam policy:

Developers or their affiliates should not publish multiple extensions that provide duplicate experiences or functionality on the Chrome Web Store.

Extensions should not have misleading, improperly formatted, non-descriptive, irrelevant, excessive, or inappropriate metadata, including but not limited to the extension’s description, developer name, title, icon, screenshots, and promotional images. Developers must provide a clear and well-written description. Unattributed or anonymous user testimonials in the app's description are also not allowed.

Developers must not attempt to manipulate the placement of any extensions in the Chrome Web Store. This includes, but is not limited to, inflating product ratings, reviews, or install counts by illegitimate means, such as fraudulent or incentivized downloads, reviews and ratings.

Extensions with a single purpose of installing or launching another app, theme, webpage, or extension are not allowed.

Extensions that abuse, or are associated with the abuse of, notifications by sending spam, ads, promotions, phishing attempts, or unwanted messages that harm the user’s browsing experience are not allowed. Extensions that send messages on behalf of the user without giving the user the ability to confirm the content and intended recipients are also not allowed.

The new policy can be found in our updated Developer Program Policies.

Developers must comply with this policy by August 27th 2020. After that date, extensions that violate the updated policy may be taken down and disabled. You can learn more about these changes and how they may apply to you in our Spam policy FAQ.

Posted by Rebecca Soares and Benjamin Ackerman, Chrome Policy and Anti-Abuse Team

Chrome 83 Beta: Cross-site Scripting Protection, Improved Form Controls, and Safe Cross-origin Resource Sharing

Friday, April 17, 2020

ChromeStatus.com Trusted Types for DOM ManipulationElement.innerHTMLContent-Security-Policy: require-trusted-types-for 'script'; report-uri //my-csp-endpoint.example Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types Improved Form Controls

Improving form controls in Microsoft Edge and ChromiumUpdates to Form Controls and Focus New Cross-Origin PoliciesCross-Origin-Embedder-PolicyCross-Origin-Opener-Policy

Performance.measureMemory()

JS Self-Profiling API

document.domainMaking your website "cross-origin isolated" using COOP and COEP Origin TrialsOrigin Trials dashboardOrigin Trials Guide for Web Developers Native File SystemThe Native File System API: Simplifying access to local files Performance.measureMemory()Performance.measureMemory()

Analysis of correlation between memory usage and user metrics

Detection of memory regressions

Evaluation of feature launches in A/B tests

Memory optimization.

Monitor your web page's total memory usage with performance.measureMemory() Prioritized Scheduler.postTask()Scheduler.postTask()user-blockinguser-visiblebackgroundTaskController WebRTC Insertable StreamsWebRTC Insertable Streams APIMediaStreamTrackRTCPeerConnection Other features in this release ARIA AnnotationsNew ARIA annotations<mark> 'auto' keyword for '-webkit-appearance' CSS property-webkit-appearance a new auto keyword-webkit-appearanceappearance Barcode Detection API<image><video><canvas>Google Play ServicesThe Shape Detection API: a picture is worth a thousand words, faces, and barcodes CSS Color Adjust: color-scheme meta tagprefers-color-schemeImproved dark mode default styling with the color-scheme CSS property and the corresponding meta tag display:inline-grid/grid/inline-flex/flex for <button>displayinline-gridgridinline-flexflexnow function with the <button> elementDemo ES Modules for shared workers ('module' type option)moduleWhat about shared workers Improvements to font-display: optionalfont-display

Setting font-display to optional no longer causes relayout

Web font preloading is allowed to slightly block rendering (for all font-display values), so that if the font loads fast enough, we don't need to render with fallback.

font-display: optionalPrevent layout shifting and flashes of invisibile text (FOIT) by preloading optional fonts IndexedDB relaxed durability transactionsIDBDatabase.transaction()durability"default""strict""relaxed""default"IDBTransaction.durabilityconst iDBTransaction = database.transaction( [ "storeName" ], "readwrite", { durability: "relaxed" } ); Out-Of-Renderer Cross-Origin Resource Sharing Reversed range for <input type=time>now supports reversed ranges for <input> elementstypetime Support "JIS-B5" and "JIS-B4" @pagenow supports two page sizes for the @page rule

"JIS-B5": 182mm wide by 257mm high

"JIS-B4": 257mm wide by 364mm high

@supports selector() feature query function@supportsfeature detection for CSS selectors@supports selector(::before) { div { background: green }; } WebRTC RTCPeerConnection.canTrickleIceCandidatescanTrickleIceCandidates RTCRtpEncodingParameters.maxFramerateThis encoding parameterRTCRtpSender.setParameters()RTCRtpEncodingParameters.maxFrameratemaxFramerate RTCRtpSendParameters.degradationPreferenceRTCRtpSendParametersdegradationPreferencedegradationPreference"maintain-framerate""maintain-resolution""balanced" WebXR DOM Overlaytwosamples JavaScriptlist of recent features fractionalSecondDigits option for Intl.DateTimeFormatadds the fractionalSecondDigits propertyIntl.DateTimeFormatDateTimeFormat Deprecations, and Removalscurrent deprecationsprevious removals Disallow Downloads in Sandboxed iframesprevents downloads in sandboxed iframes'allow-downloads'Posted by Joe Medley

Temporarily rolling back SameSite Cookie Changes

Friday, April 3, 2020

More detailsChrome 80 in FebruaryongoinggraduallySameSite Updates page

Chromium Blog

Keeping spam off the Chrome Web Store

Chrome 83 Beta: Cross-site Scripting Protection, Improved Form Controls, and Safe Cross-origin Resource Sharing

Temporarily rolling back SameSite Cookie Changes

Labels