An Indian security researcher has published today proof-of-concept exploit code for a recently discovered vulnerability impacting Google Chrome, Microsoft Edge, and other Chromium-based browsers like Opera and Brave. From a report: The researcher, Rajvardhan Agarwal, told The Record today that the exploit code is for a Chromium bug that was used during the Pwn2Own hacking contest that took place last week. During the contest, security researchers Bruno Keith (@bkth_) & Niklas Baumstark (@_niklasb) of Dataflow Security used a vulnerability to run malicious code inside Chrome and Edge, for which they received $100,000. Per contest rules, details about this bug were handed over to the Chrome security team so the bug could be patched as soon as possible. While details about the exact nature of the bug were never publicly disclosed, Agarwal told The Record he spotted the patches for this bug by looking at the source code commits to the V8 JavaScript engine, a component of the Chromium open-source browser project, which allowed him to recreate the Pwn2Own exploit, which he uploaded earlier today on GitHub, and shared on Twitter. However, while Chromium developers have patched the V8 bug last week, the patch has not yet been integrated into official releases of downstream Chromium-based browsers such as Chrome, Edge, and others, which are still vulnerable to attacks.

Google, Microsoft and the broader web community are working together to make it easier for developers to build websites that work seamlessly across browsers. From a report: They've teamed up for a cross-browser effort called #Compat2021, which aims to eliminate the top five browser compatibility pain points on the web for developers. The group identified the issues they decided to focus on based on usage data, number of bugs reports, survey feedback and test results. One of the most problematic issue that they want to address is with CSS Flexbox, since images as flex items are often stretched incorrectly and differently between browsers. They also want to improve CSS Grid so that it can be used to create animated grid layouts on Chromium and WebKit -- at the moment, the ability is only supported in Gecko. The group wants to work on sticky positioning so that any content that's stickied looks consistent across browsers, as well. Similarly, they want to make sure web elements maintain a consistent width-to-height ratio and that animations and 3D effects look the same whatever browser a user is on.

Microsoft is going to adjust its release cycles for Microsoft Edge to match the every-four-weeks release cadence for Chrome that Google announced last week. The Verge reports: "As contributors to the Chromium project, we look forward to the new 4-week major release cycle cadence that Google announced to help deliver that innovation to our customers even faster," Microsoft said in a blog post on Friday. The change will go into effect with Edge 94, which is targeted for a September release. Google has committed to making the switch with Chrome in Q3 with Chrome 94, but hasn't given a specific month like Microsoft has. Like Google, Microsoft is also offering enterprises the option of a longer release cycle enterprise customers. On that Extended Stable schedule, there will be a new release every eight weeks. However, a four-week cadence will be the default, Microsoft says. Brave, another Chromium-based browser, also said that it plans to match the new schedule.

Google and Microsoft engineers might collaborate on the Chromium browser code, but that hasn't stopped corporate politics between the pair. From a report: Google has launched a scathing attack on Microsoft today, accusing it of trying "to break the way the open web works in an effort to undercut a rival." Google is upset about what it believes is an attack by Microsoft to undermine the company's efforts to support journalism and publishers.

In January, Google threatened to remove its search engine from Australia, in response to a law that would force Google to pay news publishers for their content. Australia passed the law in February, just days after Google caved and cut a deal with News Corp. and other publishers that ensured its services continue to be available in Australia. In the middle of all of this, Microsoft was very public about its support of Australia's new law, and it even teamed up with European publishers to call for online platforms to reach deals to pay news outlets for content. Google isn't happy about Microsoft getting involved and this is the first big public spat we've seen since the Scroogled era. "They are now making self-serving claims and are even willing to break the way the open web works in an effort to undercut a rival," says Kent Walker, Google's head of global affairs, in a blog post. "This latest attack marks a return to Microsoft's longtime practices. Walker links to the Wikipedia entry for Fear, uncertainty, and doubt (FUD), and accuses Microsoft of muddying the waters to distract from recent security issues."

"It's no coincidence that Microsoft's newfound interest in attacking us comes on the heels of the SolarWinds attack and at a moment when they've allowed tens of thousands of their customers ... to be actively hacked via major Microsoft vulnerabilities," says Walker. "Microsoft was warned about the vulnerabilities in their system, knew they were being exploited, and are now doing damage control while their customers scramble to pick up the pieces from what has been dubbed the Great Email Robbery. So maybe it's not surprising to see them dusting off the old diversionary Scroogled playbook."

Support for Microsoft's original Edge browser is ending today. Legacy Edge, as it is now called, will no longer receive security updates, and anyone still using it should start the process of switching to something else. The Verge reports: Legacy Edge was originally codenamed "Spartan" and was included with Windows 10 as the operating system's default web browser before it was officially named Edge. The Edge mantle is being taken up by Microsoft's Chromium-based browser, which was in beta throughout 2019 and officially launched in January 2020. This means Edge (the old Edge, that is) survived just over a year alongside its replacement. Microsoft also says Legacy Edge will automatically be removed by the April Windows 10 update, with the new Edge being installed in its stead.

FastCompany has a feature story on Chrome OS, which has turned 10. The story talks about a new feature of Chrome OS: A new version of Chrome OS rolling out starting today will introduce a long-under-development Phone Hub feature that'll let you see and interact with notifications from your Android phone on your Chromebook, without any complex configuration or clunky software required. You'll also be able to silence your phone, adjust some of its settings, and see and access recent Chrome browser tabs you had open on the device right from your Chrome OS desktop.

Carefully examined clues in Google's open-source Chromium code suggest the system could eventually do even more -- with some indications that full-fledged phone-mirroring that would let you get access to all the apps and files on your phone from your Chromebook could be in the cards. I asked John Solomon's (VP and GM of Chrome OS at Google) colleague, Chrome OS Product Manager, Engineering, and UX Lead John Maletis, if and when such a capability might come online, and while he wouldn't outright confirm any future plans, he did allow that what we're seeing now is only scratching the surface. "You're just seeing the beginning," he says. "That little tiny Phone Hub real estate -- I would put a big 'Watch This Space' on it, because there's a lot of stuff we can and will do there." The publication also touched on Fuchsia, a new operating system that Google has been working on for several years: My final pressing question about the future of Chrome OS is simply how much of it there will be. In a familiar twist, the Android- and Chrome-OS-watching communities are once again filled with speculation that Google could be working to bring the two platforms together -- this time by way of a mysterious underdeveloped Google operating system known as Fuchsia.

Officially, Google says only that Fuchsia is an "open-source effort to create a production-grade operating system that prioritizes security, updatability, and performance" across a "broad range of devices." But the vague nature of its ultimate purpose along with some eyebrow-raising bits of progress in its development -- such as the recent move to allow the operating system to support both Android and Linux apps as native programs -- raise some interesting questions about what, exactly, Google is actually up to with the effort. Solomon declined to answer directly about if or how Fuchsia might one day replace or otherwise relate to Chrome OS (and there are certainly more nuanced, less black-and-white possibilities to consider), but he did offer up some broad thoughts on what Google hopes to accomplish as time wears on.

An anonymous reader quotes a report from Ars Technica: /e/ OS, the "open-source, pro-privacy, and fully degoogled" fork of Android, is coming to Canada and the USA. Of course, you've always been able to download the software in any region, but now (as first spotted by It's Foss News) the e Foundation will start selling preloaded phones in North America. Previously, /e/ only did business in Europe. Like normal, the e Foundation's smartphone strategy is to sell refurbished Samsung devices with /e/ preloaded. In the US, there are only two phones right now: the Galaxy S9 for $379.99 or a Galaxy S9+ for $429.99. North Americans still have reason to be jealous of Europe, where you can get /e/ preloaded on a Fairphone, which is also Europe-exclusive. These Samsung phones are used devices, but the site says the devices have "been checked and reconditioned to be fully working at our partner's facilities." The phones have a one-year warranty and are described as "Good-as-New" with "no surprises." An /e/ device means you'll be getting a fork of Android 10, and for ongoing support, the e Foundation says, "We aim to support with at least 3 years of software updates and security patches."

/e/ OS was founded by Gael Duval, the creator of Mandrake Linux, and the project describes itself as a "non-profit project in the public interest." /e/ is built a lot like a Linux distribution, in that it takes a curated collection of other open source projects, merges them into a single product, and does its best to fill in the remaining gaps. In this case, /e/ is based on LineageOS, the Android community's open source, device-ready version of Google's Android source code. The primary contribution of /e/ is filling in all the gaps left by the lack of Google apps, so there's an /e/ app store, an /e/ cloud storage and account system, and various Google-replacement apps like a Chromium-based browser, a fork of K-9 Mail for email, contacts, search, photos, etc. The company is even trying to build a Google Assistant replacement. Actually getting regular Android apps to run on a forked version of Android is a challenge. Google Play Services is built into many apps for things like push notifications, and there's a good chance that functionality won't work on /e/ OS. These apps will at least run on /e/ OS instead of exiting outright, thanks to the inclusion of MicroG, an open source project that hijacks Google API calls.

Brave Browser had a privacy issue that leaked the Tor onion URL addresses you visited to your locally configured DNS server, "exposing the dark web websites you visit...", writes Bleeping Computer.

Long-time Slashdot reader AmiMoJo quotes their report: To access Tor onion URLs, Brave added a "Private Window with Tor" mode that acts as a proxy to the Tor network. When you attempt to connect to an onion URL, your request is proxied through volunteer-run Tor nodes who make the request for you and send back the returned HTML. Due to this proxy implementation, Brave's Tor mode does not directly provide the same level of privacy as using the Tor Browser.

When using Brave's Tor mode, it should forward all requests to the Tor proxies and not send any information to any non-Tor Internet devices to increase privacy. However, a bug in Brave's "Private window with Tor" mode is causing the onion URL for any Tor address you visit to also be sent as a standard DNS query to your machine's configured DNS server. This bug was first reported in a Reddit post and later confirmed by James Kettle, the Director of Research at PortSwigger. BleepingComputer has also verified the claims by using Wireshark to view DNS traffic while using Brave's Tor mode.
Brave has since released an update which fixes the bug.

If you're one of the few people still using a PC with an x86 processor more than 15 years old, here's another reason to upgrade: the devices will not work with future Chrome releases, starting with version 89 of the world's most popular browser. TechSpot reports: The Chromium development team announced that CPUs older than the Intel Core 2 Duo and AMD Athlon 64 would not work with Chrome 89 and future versions as they do not meet the new minimum instruction set requirement of SSE3 (Supplemental Streaming SIMD Extensions 3) support. So, if you are still sporting an Intel Atom or Celeron M CPU, you'll soon be counting Chrome as one of the many programs that are incompatible with your potato-like rig. The devices will no longer attempt to install the browser, while running it will result in the software crashing. It's noted that the change only affects Windows as Chrome OS, Android and, Mac already require SSE3 support.

The Google-sponsored Chromium project has cleaned up its act, and the result is a marked decline in queries to DNS root servers. From a report: As The Register reported in August 2020, Chromium-based browsers generate a lot of DNS traffic as they try to determine if input into their omnibox is a domain name or a search query. Verisign engineers Matthew Thomas and Duane Wessels examined the resulting traffic and reached the conclusion that it accounted for up to 60 billion DNS queries every day. Wessels has since penned a new post that went unreported when it appeared on January 7 -- the day after the US Capitol riot -- but was today resurfaced by APNIC, the Regional Internet Registry for the Asia-Pacific region. In the post he says the Chromium team redesigned its code to stop junk DNS requests, and released the update in Chromium 87. The result? "Before the software release, the root server system saw peaks of ~143 billion queries per day," he wrote. "Traffic volumes have since decreased to ~84 billion queries a day. This represents more than a 41 per cent reduction of total query volume."

"The South African Revenue Service (SARS) has released this week its own custom web browser," reports ZDNet, "for the sole purpose of re-enabling Adobe Flash Player support, rather than port its existing website from using Flash to HTML-based web forms." To prevent the app from continuing to be used in the real-world to the detriment of users and their security, Adobe began blocking Flash content from playing inside the app starting January 12, with the help of a time-bomb mechanism... As SARS tweeted on January 12, the agency was impacted by the time-bomb mechanism, and starting that day, the agency was unable to receive any tax filings via its web portal, where the upload forms were designed as Flash widgets. But despite having a three and a half years heads-up, SARS did not choose to port its Flash widgets to basic HTML & JS forms, a process that any web developer would describe as trivial. Instead, the South African government agency decided to take one of the most mind-blowing decisions in the history of bad IT decisions and release its own web browser.

Released on Monday on the agency's official website, the new SARS eFiling Browser is a stripped-down version of the Chromium browser that has two features.

The first is to re-enable Flash support. The second is to let users access the SARS eFiling website.

As Chris Peterson, a software engineer at Mozilla, pointed out, the SARS browser only lets users access the official SARS website, which somewhat reduces the risk of users getting their systems infected via Flash exploits while navigating the web. But as others have also pointed out, this does nothing for accessibility, as the browser is only available for Windows users and not for other operating systems such as macOS, Linux, and mobile users, all of which are still unable to file taxes.

Tech blogger Paul Thurrott writes: Firefox 85 now protects users against supercookies, which Mozilla says is "a type of tracker that can stay hidden in your browser and track you online, even after you clear cookies. By isolating supercookies, Firefox prevents them from tracking your web browsing from one site to the next." It also includes small improvements to bookmarks and password management.

Unfortunately, Mozilla has separately — and much more quietly — stopped work on Site Specific Browser (SSB) functionality... This feature allowed users to use Firefox to create apps on the local PC from Progressive Web Apps and other web apps, similar to the functionality provided in Chrome, Microsoft Edge, and other Chromium-based web browsers. "The SSB feature has only ever been available through a hidden [preference] and has multiple known bugs," Mozilla's Dave Townsend explains in a Bugzilla issue tracker. "Additionally, user research found little to no perceived user benefit to the feature and so there is no intent to continue development on it at this time. As the feature is costing us time in terms of bug triage and keeping it around is sending the wrong signal that this is a supported feature, we are going to remove the feature from Firefox."
Thurrott's conclusion? "Mozilla is walking away from a key tenet of modern web apps and, in doing so, they are making themselves irrelevant."

Besides the intended differences, web browsers based on Chromium offer an underlying experience that's mostly identical to Chrome. Google recently discovered that users of third-party Chromium browsers have inadvertently been able to access data and other sync features reserved for Chrome. From a report: "Some" Chromium browsers today can leverage features and APIs that are "only intended for Google's use." This includes Click to Call and, notably, Chrome Sync. The latter is responsible for syncing bookmarks, extensions, history, settings, and more across signed-in devices running the first-party browser. As a result, users logged into Google sites on Chromium browsers are able to see their old bookmarks and other data from previous Chrome usage. This inadvertent access was discovered during a recent audit and Google will be "limiting access to [its] private Chrome APIs" from March 15th.

Microsoft is making a big change to its Windows 10 taskbar soon, with the addition of a news and weather widget. The Verge reports: The new feature is available to testers today, and it will allow Windows 10 users to access a feed of news, stocks, and weather information straight from the taskbar. You'll be able to quickly glance at the weather without having to open the Start menu, install a third-party app, or check online. The taskbar feature will pop out into a mini feed of content that can be personalized with the latest sports news, headlines, and weather information. Microsoft is using its Microsoft News network to surface news and content from more than 4,500 sources. The company has been curating this through artificial intelligence in recent months, and this particular feature will also learn what news is relevant to you when you dismiss or like stories in the feed.

This new taskbar feature will also require Microsoft's Chromium-based Edge to be installed on a PC. That means any link you click within the feature will force you into Edge to read it, and Microsoft is presenting content in the reading view by default. You can of course disable this new taskbar feature, and Microsoft says it will be an ad-free experience.

This week, Google acquired a company called Neverware that allows users to turn their old PCs and Macs into a Chromebook with its CloudReady software. Now, Google is planning to make CloudReady into an official Chrome OS release. Engadget reports: When that happens, Neverware says its existing users will be able to seamlessly upgrade to the updated software. Moreover, once that transition is complete, Google will support CloudReady in the same way that it currently does Chrome OS. In the immediate future, Neverware says it's business as usual. The Home Edition of CloudReady isn't changing, and the company says it's committed to supporting its existing education and enterprise customers. Moreover, there's no plan to change pricing at the moment, and Google will honor any current multi-year licenses.

Not only does this acquisition make a lot of sense from Google's perspective, but it's hard to see a downside for CloudReady users. The fact the operating system wasn't officially supported by Google was one of the few downsides to the software. It meant you couldn't install Android apps on CloudReady devices, even though it's based on Chromium OS. With this acquisition, support for Android apps becomes much more likely. Direct support from Google will also make the software more appealing to schools and businesses since they can get help directly from the company if they have any technical issues.

CNET reports: With the next version of Chrome, Google is moving ahead with a plan to improve privacy and security by reining in some abilities of extensions used to customize the browser. The move had angered some developers who expected earlier it would cripple ad blockers. Manifest v3, the programming interface behind Google's security plans, will arrive with Chrome 88 in mid-January, Google said Wednesday at the Chrome Dev Summit. Extensions using the earlier Manifest v2 will still work for at least a year...

Among other things, Manifest v3 limits the number of "rules" that extensions may apply to a web page as it loads. Rules are used, for example, to check if a website element comes from an advertiser's server and should therefore be blocked. Google announced the changes two years ago. Reducing the number of rules allowed angered creators of extensions like the uBlock Origin ad blocker and the Ghostery tracking blocker. They said the rules limits will stop their extensions from running their full lists of actions to screen ads or block tracking. That could let websites bypass extensions — and the preferences of people who installed them...

The shift brought on by Manifest V3 will spread to all browsers, to the detriment of ad blocking software, predicted Andrey Meshkov, co-founder and chief technology officer of AdGuard, an ad-blocking extension... Ghostery is working to update its extension for Manifest V3 but would rather spend its time on "real privacy innovations," President Jeremy Tillman said in a statement Wednesday. "We still have real misgivings that these changes have more to do with Google protecting its bottom line than it does with improving security for Chrome users...."

The importance of the Chrome team's choices are magnified by the fact that other browsers, including Microsoft Edge, Vivaldi , Opera and Brave, are built on its Chromium open-source foundation. Microsoft said it will embrace Manifest v3, too.
"Another Manifest v3 change is that extensions no longer may update their abilities by downloading code from third-party sites.

"The entire extension now must be distributed through the Chrome Web Store, a measure Google says improves security screens and speeds reviews."

Google is loosening control over the core of its Chrome browser, a move that helps Microsoft, Samsung and Brave build competitors while advancing the search giant's vision of the web. From a report: Over the past six months, Google welcomed a new outside developer into the leadership of its Chromium project, the software that powers the similarly named browser. The Alphabet subsidiary is also granting outsiders access to its previously proprietary software development system and allows outside features even when Google doesn't incorporate them into the flagship Chrome browser.

Chromium is open-source software, which means anyone can modify and use it. Even with open source projects, however, outsiders can have trouble convincing organizers to accept their changes and additions, making it harder to contribute and benefit. Google took pains to draw attention to the changes at the BlinkOn conference earlier this week. "It's really cool to see so many people and groups with different priorities coming together and finding solutions that not only meet their individual agendas but also advance the common goal of improving the web," said Danyao Wang, a Chrome engineer at Google.

Rudra Saraswat is the creator of the Ubuntu Unity distro (which uses the Unity interface in place of Ubuntu's GNOME shell).

But this week they released Ubuntu Web Remix, "a privacy-focused, open source alternative to Google Chrome OS/Chromium OS" using Firefox instead of Google Chrome/Chromium. Liliputing reports: If the name didn't give it away, this operating system is based on Ubuntu, but it's designed to offer a Chrome OS-like experience thanks to a simplified user interface and a set of pre-installed apps including the Firefox web browser, some web apps from /e/, and Anbox, a tool that allows you to run Android apps in Linux...

You don't get the long battery life, cloud backup, and many other features that make Chromebooks different from other laptops (especially other cheap laptops). But if you're looking for a simple, web-centric operating system that isn't made by a corporate giant? Then I guess it's nice to have the option.
Rudra Saraswat writes: An easy web-app (wapp) format has been created to package web-apps for the desktop. You can now create your own web apps using web technologies, package them for the desktop and install them easily.

An experimental wapp store can be found at store.ubuntuweb.co, for distributing web apps. Developers and packagers can do pull requests at gitlab.com/ubuntu-web/ubuntu-web.gitlab.io to contribute wapps.

According to Windows Latest, "Microsoft is A/B testing a new feature that is designed to nag users with fullscreen window-less Microsoft Edge recommendations in the OOBE screen." From the report: The nag will appear when users set up their PC, sign in to their system after applying updates, or when they click on a new ad banner within the Settings. [...] Microsoft is trying to convince users of rival browsers who are visiting Windows Settings of the benefits of trying the Chromium Edge. In the Settings app, there's a new banner that appears to be rolling out to non-Insiders. As you can see in the above screenshot, the advert appears across the top of the Settings app window, just above the settings options.

The banner states that you can "get even more out of Windows" and it surprisingly launches the OOBE (out of the box experience) screen. [...] This ad appeared only when our devices were set to use Google Chrome and Firefox as the default web browser. The user can easily close the advert by clicking the second option "Don't update your browser settings." If you try to skip the setup, the pop-up will appear again in future. Unfortunately, you cannot permanently disable these recommendations in Windows 10.

Mint's programmers, led by lead developer, Clement "Clem" Lefebvre, have built their own take on Google's open-source Chromium web browser. ZDNet reports: Some of you may be saying, "Wait, haven't they offered Chromium for years? Well, yes, and no. For years, Mint used Ubuntu's Chromium build. But then Canonical, Ubuntu's parent company, moved from releasing Chromium as an APT-compatible DEB package to a Snap. The Ubuntu Snap software packing system, along with its rivals Flatpak and AppImage, is a new, container-oriented way of installing Linux applications. The older way of installing Linux apps, such as DEB and RPM package management systems for the Debian and Red Hat Linux families, incorporate the source code and hard-coded paths for each program.

While tried and true, these traditional packages are troublesome for developers. They require programmers to hand-craft Linux programs to work with each specific distro and its various releases. They must ensure that each program has access to specific libraries' versions. That's a lot of work and painful programming, which led to the process being given the name: Dependency hell. Snap avoids this problem by incorporating the application and its libraries into a single package. It's then installed and mounted on a SquashFS virtual file system. When you run a Snap, you're running it inside a secured container of its own. For Chromium, in particular, Canonical felt using Snaps was the best way to handle this program. [...]

Lefebvre wrote, "The Chromium browser is now available in the official repositories for both Linux Mint and LMDE. If you've been waiting for this I'd like to thank you for your patience." Part of the reason was, well, Canonical was right. Building Chromium from source code is one really slow process. He explained, "To guarantee reactivity and timely updates we had to automate the process of detecting, packaging and compiling new versions of Chromium. This is an application which can require more than 6 hours per build on a fast computer. We allocated a new build server with high specifications (Ryzen 9 3900, 128GB RAM, NMVe) and reduced the time it took to build Chromium to a little more than an hour." That's a lot of power! Still, for those who love it, up-to-date builds of Chromium are now available for Mint users.