Chromium Weekly Digest Logo

Chromium Weekly Digest

Week 11 of 2026 (2026-03-08 to 2026-03-13)

Chromium Weekly: 2026 Week 11

Overview

This week saw an exceptionally high volume of activity with 2,322 relevant commits out of 3,197 total. Development was dominated by a wave of significant breaking changes affecting core APIs, including a major asynchronous refactor of ui::Clipboard, numerous modifications to networking and Blink string APIs, and extensive cleanup of the ChromeOS crosapi interface. Key milestones include the enabling of the network service sandbox by default on Windows and the removal of several legacy web platform features and browser UI elements.

Major Breaking Changes

  • ⚠️ BREAKING BREAKING CHANGE: The ui::Clipboard API and its platform backends were refactored to be fully asynchronous. Synchronous methods like IsFormatAvailable were replaced with asynchronous equivalents like GetAllAvailableFormats, breaking most embedder and platform implementations. (54777b8) (9dc355d) (e316366)
  • ⚠️ BREAKING BREAKING CHANGE: Core Blink string APIs were modified for consistency across multiple commits. blink::String::Remove() was replaced by erase(), LowerASCII() by ToAsciiLower(), and several wtf:: utility functions were renamed. (f2bc5fe) (fcbc3d1) (42dbfc5) (4a0293f)
  • ⚠️ BREAKING BREAKING CHANGE: Core networking APIs were updated, breaking embedder implementations. ClientSocketPool::RequestSockets and PreconnectCompletionCallback now use different callback signatures, and HttpStream methods now return base::ByteSize. (ad97a90) (88f44d9) (5895f46)
  • ⚠️ BREAKING BREAKING CHANGE: The ANGLE D3D9 backend was removed. If D3D11 initialization fails, Chromium will now fall back directly to software rasterization (WARP), which may impact performance on systems that previously relied on the D3D9 fallback. (282348e)
  • ⚠️ BREAKING BREAKING CHANGE: The underlying type of the ui::KeyboardCode enum was changed, resulting in an ABI-breaking change that will affect embedders linking against pre-built Chromium binaries. (e9e9cf3)
  • ⚠️ BREAKING BREAKING CHANGE: Legacy ...V2 suffixed functions like HolderV2() and GetPrototypeV2() were removed from the public V8 API. Embedders must migrate to the modern, unsuffixed equivalents. (37e0529)

Web Platform & Rendering

  • The CSS attr() function grammar was updated to support <declaration-value>, and the @supports at-rule() feature was enabled by default, allowing developers to query for at-rule support directly in CSS. (e33187e) (8480cfa)
  • Several web platform APIs were removed, including the non-standard fireOnEveryPaint option from ResizeObserver, the discontinued GeolocationSensor API, and the legacy <command> element. (e0ce255) (f2a0ff6) (baff9bb)
  • Performance of CSS Grid layout was significantly improved by migrating key data structures to Oilpan, reducing data copying during layout calculations. (a1db64d)
  • Scaffolding for ML-KEM support was added to the WebCrypto API, and the Direct Sockets API now supports Source-Specific Multicast (SSM) for isolated web apps. (4e0b148) (0302377)
  • Several features were stabilized and their runtime flags removed, including Web App Manifest localization, the ServiceWorkerAutoPreload feature, and multiple flags for CSS Anchor Positioning. (0c74d0b) (d500868) (eb959bb)

Security & Privacy

  • The network service sandbox is now enabled by default on Windows, a major security milestone that significantly hardens the browser by restricting the privileges of the network process. (a0ad012)
  • A browser-side validation check was added to RunJavaScriptDialog() to enforce the allow-modals sandbox attribute, preventing a compromised renderer from showing dialogs without permission. (7e25766)
  • The Authorization header is now correctly stripped from fetch() keepalive requests during cross-origin redirects, preventing potential credential leakage and aligning with web specifications. (5fb6646)
  • The behavior of navigator.storage.estimate() in Incognito mode was changed to prevent privacy leaks by no longer revealing discrepancies in storage capacity that could be used to detect Incognito. (c48f71d)

Android, iOS & ChromeOS

  • ⚠️ BREAKING BREAKING CHANGE: The ChromeOS crosapi interface between Ash and Lacros saw extensive refactoring. Methods were removed from the LocalPrinter interface, and the mojo-based CrosDisplayConfigController and launcher_search.mojom interfaces were removed in favor of C++ equivalents. (ee69dea) (774ba09) (a8ba571) (0a8a8c8)
  • ⚠️ BREAKING BREAKING CHANGE: Numerous public Java APIs on Android were changed or removed, including the removal of SyncPromoController, the renaming of SigninManagerImpl's package, and signature changes to MediaDrmBridge and ClickWithMetaStateCallback. (0db58b8) (737d3e3) (a2ece5c) (1f83783)
  • Several features were enabled by default on Android, including RobustWindowManagement for multi-window handling and touchpad overscroll gestures for back/forward navigation. (87f844d) (232064f)
  • On iOS, Reader Mode translation is now enabled by default, and many UI components were modernized to use initWithWindowScene instead of the deprecated UIWindow initializer. (b53956f) (a687976)
  • On Linux, Chrome Remote Desktop has removed support for SysV init systems and now relies exclusively on systemd. (cd7f371)

Services, Extensions & UI

  • ⚠️ BREAKING BREAKING CHANGE: The public AutofillClient interface was modified to use more specific failure notifications, and the FormFieldData struct was updated to include selected_option_text, breaking consumers of these APIs. (b1627f2) (95b08b3)
  • A significant effort continued to migrate extension API tests from Manifest V2 to Manifest V3, covering APIs such as nativeMessaging, omnibox, context_menus, and printerProvider. (36f2f4c) (b2f7a35) (868a121)
  • The browser UI was simplified with the complete removal of several features, including the Tab Search container from the tab strip, the "Click to Call" page action, and the legacy Price Tracking controller. (d43a49d) (47aad4d) (e34e396)
  • Autofill support for loyalty cards was launched and its feature flag removed, making the functionality available by default. (9d45f2f)

Build System & Code Health

  • The ongoing effort to modularize //chrome/browser continued, with components like trusted_vault, page_info, sharing_hub, and performance_monitor being moved into their own build targets to improve dependency hygiene. (d031ef5) (f7272c2) (563c9a0) (5e70d3b)
  • The GRIT resource compiler (grit.py) was optimized to speed up builds, gaining a multiprocessing output phase and skipping slow garbage collection on exit. (d4c945b) (757fea0)
  • The C++ style guide was updated to allow the use of std::ranges::to, enabling more modern and concise container conversions in the codebase. (df05b07)
Daily Summaries (6)
← Back to all summaries