M65 Enterprise Release Notes Each new Chrome release contains thousands of improvements. The Chrome Enterprise Release Notes highlight new features and changes that may be of particular interest to people who manage Chrome browser deployments in their enterprise.

New in M65 Chrome Policies This section outlines the changes made to Chrome policies in this release. AlwaysAuthorizePlugins

This policy was deprecated.

AbusiveExperience InterventionEnforce

Allows you to set whether sites with abusive experiences should be prevented from opening new windows or tabs.

AdsSettingForIntrusive AdsSites

Allows you to set whether ads should be blocked on sites with intrusive ads.

DeviceLoginScreenAutoSelect CertificateForUrls

Automatically select client certificates for these sites on the sign-in screen (Available on Chrome OS)

DisablePluginFinder

This policy was deprecated.

RestrictAccountsToPatterns

Restrict accounts that are visible in Google Chrome (Available on Android)

SecondaryGoogleAccountSign Allow Multiple Sign-in Within the Browser (Available on Chrome inAllowed OS) SecurityKeyPermitAttestation

URLs/domains automatically permitted direct Security Key attestation

SpellcheckEnabled

If this policy is not set or is enabled, the user is allowed to use spellcheck.

SpellcheckLanguage

Policy to force enable spellcheck languages.

ThirdPartyBlockingEnabled

Policy to enable third party software injection blocking. (Available on Windows)

UnsafelyTreatInsecureOriginA sSecure

Origins to be treated as secure context.

WebDriverOverrides IncompatiblePolicies

Allow WebDriver to override incompatible policies.

Ignore for cross origin URLs To avoid user-mediated information leakage, Chrome will start to ignore the presence of the download attribute on anchor elements with cross-origin attributes. (additional information)

Support for TLS 1.3 The latest version of the Transport Layer Security (TLS) protocol (TLS 1.3 draft 23) is enabled by default in this release. (additional information) Users of Cisco Firepower devices configured to perform TLS man-in-the-middle interception in “Decrypt—Resign/SSL Decryption Enabled” mode should reference Cisco’s knowledge-base article to better understand and work around any connection failures.

Coming Soon (Future Releases) Redirect protection (TBD) We will be rolling out a new security feature that blocks redirects from cross-domain iframes. To test whether some sites used in your enterprise are affected, you can visit these sites with the #enable-framebusting-needs-sameorigin-or-usergesture flag enabled. (navigate to chrome://flags/)

Continuation of distrust of Symantec Certificates (M66) Following our announcement to gradually phase out trust in Symantec’s PKI, Chrome will remove trust in Symantec-issued certificates issued prior to June 1, 2016. Chrome’s Developer Tools Console will show a warning for sites using certificates from Symantec that will no longer be trusted in future releases. This warning indicates what version, if any, that the currents sites certificate will be distrusted.

Additional information can be found in this Chrome Administrator Product Forum post. Changes to Autoplay (M66) Chrome is changing the policy for when sites can autoplay media with sound. Administrators using M65 who wish to see how the new policy interacts with sites used by their enterprise can set the #autoplay-policy flag to “Document user activation is required”. (navigate to chrome://flags/) (additional information)

Reducing Chrome crashes caused by third-party software (M66) Chrome will begin showing a warning to users after a crash that will display third-party software that is injecting code into Chrome, guiding them to update or remove that software.

Unencrypted Sites will show “Not Secure” Indicator (M68) For the past several years, we’ve moved toward a more secure web by strongly advocating that sites adopt HTTPS encryption. Within the last year, we’ve also helped users understand that HTTP sites are not secure by gradually marking a larger subset of HTTP pages as “not secure”. Beginning in July 2018 with the release of Chrome 68, Chrome will mark all HTTP sites as “not secure”.

Additional resources to stay informed To obtain more information about the changes in each release, along with a schedule for when these should be available in the Beta and Stable channels, please visit Chrome Platform Status. More detailed information about new releases can also be found in the Chrome Release Blog. We appreciate any feedback you are able to provide related to the Chrome Enterprise Release Notes.