Chromium Weekly Digest Logo

Chromium Weekly Digest

Week 12 of 2026 (2026-03-15 to 2026-03-20)

Chromium Weekly: 2026 Week 12

Overview

This week was characterized by an exceptionally high number of breaking changes across the entire Chromium stack, impacting core APIs, web platform behavior, and embedder interfaces. Out of 3,273 total commits, 2,467 were identified as relevant, with major updates to ICU, fundamental C++ utilities, and numerous public interfaces requiring significant developer attention. Several features were also removed or enabled by default, marking shifts in the platform's evolution.

Core APIs & Infrastructure

  • ⚠️ BREAKING BREAKING CHANGE: The base::span two-argument constructor now performs bounds checking by default, which can cause runtime CHECK failures in existing code. Callers must be updated to explicitly pass base::unchecked to retain the old behavior. (4aa6967)
  • ⚠️ BREAKING BREAKING CHANGE: A new pure virtual method, GetTextSelectionBounds, was added to the public content::WebContents interface. All classes inheriting from WebContents must now implement this method to compile. (8020df7)
  • ⚠️ BREAKING BREAKING CHANGE: The JNI generator's naming convention for calling static Java methods from C++ has changed. The J prefix on the JNI struct is removed, so calls like JMyClassJni::foo() must be updated to MyClassJni::foo(). (fa5d1a7) (62719ab)
  • ⚠️ BREAKING BREAKING CHANGE: Numerous public interfaces were broken, including the removal of RequestPermissions from content::PermissionControllerDelegate, making ui::PlatformClipboard::IsSelectionOwner asynchronous, and changing the signature of views::WidgetObserver methods. (4035ccf) (f56f565) (6ba9721)
  • ⚠️ BREAKING BREAKING CHANGE: The bundled xdg-mime and xdg-settings utilities have been removed. Production Linux builds must now ensure the host system has a sufficiently modern version of xdg-utils installed, changing a long-standing dependency assumption. (4258ce4)
  • Several features and their associated APIs were removed from the codebase, including the TabOrganizationService, the Android 'Screenshot Monitor' feature, and the Android 'Search Resumption Module'. (4a44e72) (4144a97) (4830d98)

Web Platform & Blink

  • ⚠️ BREAKING BREAKING CHANGE: The ICU library was rolled to version 78.2. This is a major behavioral change for stable web APIs, affecting timezone formatting (e.g., 'GMT' becomes 'GMT+0'), IDNA processing, and date formats in multiple locales, which may break web content relying on specific Intl API outputs. (f72d48e) (3ae9984)
  • ⚠️ BREAKING BREAKING CHANGE: The behavior of several stable web APIs has changed. document.createEvent() now throws for non-standard types, Element.scrollParent on <body> returns the scrolling element instead of null, and location.ancestorOrigins now returns a cached object. (a112e48) (90bd81c) (8ab1ce0)
  • ⚠️ BREAKING BREAKING CHANGE: The SuppressPointerStreamAfterDrag feature is now enabled by default, altering the standard behavior of pointer events after a drag-and-drop operation, which can break web applications that rely on the previous event stream. (58ccecd)
  • The @revert CSS at-rule is now enabled for stable release. Additionally, the CSS Color 5 alpha() function and light-dark() support for images have been implemented behind experimental flags. (2263d72) (38994fc) (d4665c3)
  • The Rust-based JPEG parser is now enabled by default, and foundational code for the WebXR Mesh API was added behind a feature flag. (5c98c56) (919794c)

Security & Networking

  • A DNS rebinding vulnerability in the DevTools WebSocket handler was fixed by validating the Host header, a critical fix for users of --remote-allow-origins=*. (7bdbd07)
  • Local Network Access (LNA) checks are now enabled by default for WebTransport and WebSockets, enhancing security for local devices by requiring explicit permission for public websites to access them. (53bd4f6)
  • The Device-Bound Session Credentials (DBSC) feature has graduated from its origin trial and is now enabled by default. (ebf37aa)
  • A 15-minute throttling window has been introduced for approximate geolocation updates to mitigate the risk of a site reconstructing a user's precise location from frequent samples. (7d99a69)
  • Certificate Transparency (CT) policy will now ignore Signed Certificate Timestamps (SCTs) delivered via OCSP-stapled responses by default. (4d1a2f7)

Graphics & Media

  • ⚠️ BREAKING BREAKING CHANGE: The public media::AudioDecoderConfig API was refactored. The Initialize method signature was changed to use ChannelLayoutConfig, and legacy constructors were removed, breaking both C++ calls and mojom wire compatibility. (62da318) (c9acbb5)
  • ⚠️ BREAKING BREAKING CHANGE: The public gpu::GLES2Interface saw significant churn, with several methods related to SharedImage copying being added and then removed within the week, breaking embedders who adopted the new APIs. (fe5ea1e) (eeb6937) (5a7ae68)
  • To reduce video stuttering in WebRTC, a new SharedMediaContextProvider bound to the Media Thread is now used for video scaling, avoiding contention with the main thread. (d1b8e21)

Extensions

  • ⚠️ BREAKING BREAKING CHANGE: Nine methods have been removed from the chrome.passwordsPrivate extension API as part of a migration to Mojo. Extensions using methods like isAccountStorageActive() or deleteAllPasswordManagerData() will break. (17f18ce)
  • ⚠️ BREAKING BREAKING CHANGE: The extensions::DisplayInfoProvider API was changed from asynchronous to synchronous. SetDisplayLayout and GetDisplayLayout now return their results directly instead of using callbacks. (a2e1c0b) (7b0fc8f)
  • A significant performance bottleneck during browser shutdown was fixed by optimizing the removal of filtered event listeners, which could previously delay shutdown by tens of seconds for extensions with many listeners. (dec6118)

Platform-Specific Updates

  • ⚠️ BREAKING BREAKING CHANGE: On macOS, the public base::mac::SystemSettingsPane enum was refactored to support upcoming OS versions, renaming and removing several values. Embedders using OpenSystemSettingsPane() must update their code. (6c38bdc)
  • ⚠️ BREAKING BREAKING CHANGE: The ChromeOS display configuration API, cros_display_config.mojom, underwent significant refactoring. Several methods were changed from asynchronous to synchronous, and mojom types were replaced with internal C++ structs, breaking clients of this stable interface. (911fc29) (69dad59) (a957de3)
  • On iOS, a new public ScreenshotProtectionAPI was introduced to allow developers to mark specific UIViews for obfuscation during screen captures. Additionally, passkey navigator.credentials.get() requests now support AbortSignal for cancellation. (7c86673) (b8f3208)
Daily Summaries (6)
← Back to all summaries