Google announced that, starting with version 64, the Chrome browser will prevent pages from redirecting to third-party content in unexpected ways.

Iframe Redirects

Google said that one in five Chrome feedback reports mention encountering some type of unwanted content. The company noted that it’s taking user feedback seriously, so beyond Chrome’s existing pop-up blocker and autoplay protections, it will bring three new protections over the next few releases of Chrome that are designed to stop unwanted content.

One piece of feedback from Chrome users is that sometimes a page will navigate to a different page unexpectedly. Google found that often this is not even what the page’s author intended, as the behavior is created by third-party content embedded on the page that wasn’t supposed to redirect visitors to another page.

To address this issue, Chrome 64 will stop such iframe redirects and then show the user an information bar explaining that the redirect was blocked. Chrome will prevent the redirect only if it happens automatically and the user wasn’t interacting with the frame.

Redirects Enabled By User Interaction

Even when the user interacts with the frame, things can go wrong. Some websites open content the user tried to access in a new tab and then redirect the main page to a different website, for example, which effectively bypasses Chrome’s pop-up blocker.

Starting with Chrome 65, this type of behavior will also be curbed by Chrome. When the main tab tries to redirect to another website, Chrome will prevent it from doing so and will also show the user an information bar. This new protection will allow the user to check out the opened content in the new page while also staying on the original page.

Overlay Redirects

Google noted that there are other types of abusive experience that are difficult to automatically detect. Sometimes websites have overlays on them that capture all clicks and redirect users to another site, or the redirect links are embedded within the play button of a video player.

Starting next January, Chrome’s pop-up blocker will prevent these sites from opening new windows or tabs. To help site owners ensure that their websites won’t be blocked from opening content in new tabs or windows, Google has released the Abusive Experiences Report. The tool will warn the site owners if Chrome’s new protections will prevent content on their websites so they can take the appropriate action to remove such content from their websites.

Google announced that it has removed all trust in WoSign and StartCom certificates from Chrome and Android, following the discovery that the two certificate authorities misbehaved.

WoSign/StartCom Go Rogue

About a year ago, Mozilla uncovered that a Chinese Certificate Authority (CA) called WoSign had a number of technical and management failures, which included bypassing previous restrictions by browser vendors on distributing SHA-1 certificates.

The browser vendors had previously agreed not to accept SHA-1 certificates that were issued after January 2016. However, WoSign backdated its certificates so it could continue to issue SHA-1 certificates that would still be supported by the browsers (for legacy reasons).

Mozilla also found out that WoSign had secretly acquired a smaller CA, StartCom, which was against its CA policies.

WoSign previously denied both allegations, until Mozilla and others came up with sufficient evidence to show that the allegations were indeed true. The level of deception coming from WoSign was also what prompted Mozilla to plan a progressive removal of WoSign and StartCom’s certificates. Apple and Google followed with a similar plan.

Plans To Distrust WoSign/StartCom Certificates

Mozilla started phasing out these certificates in Firefox 51, while Google did the same thing starting with version 56 of Chrome, both of which came out last Fall. Google now seems ready to completely eliminate the support for WoSign and StartCom certificates from its browser.

Google initially whitelisted the top 1 million websites for using the WoSign/StartCom certificates, but it gradually reduced the length of that whitelist over the course of several Chrome releases. Starting with version 61 --we’re now at 59--Google will completely remove support for WoSign and StartCom certificates from Chrome.

This means that websites that are still using these certificates by the time Chrome 61 comes out will appear broken in the browser and won’t load for users of that particular Chrome version (as well as all the other versions coming afterward). Google recommended sites that still use WoSign and StartCom certificates to immediately replace them so as to not risk disruption of service for potentially a large portion of their users.

No More Mr. Nice Browser Vendor

Over the past couple of years, Google has shown that it’s not willing to compromise the security of its users if some of the CAs misbehave, no matter how large they are. Google has taken some severe measures against both WoSign and Symantec, one of the largest CAs, to ensure that they properly validate their certificates and follow the rules. This may have also led Symantec to consider the sale of its CA business.

The CA rules are important, because without them, the whole HTTPS security ecosystem could collapse. If users can’t trust the HTTPS connections to be secure anymore, then they may not make certain transactions or communications over the internet. Alternatively, they could switch to alternative encryption communications protocols, which may come with their own benefits and compromises.

The decisions to punish CAs by some of the major browser vendors, such as Google and Mozilla, must not have come easy. Banning a CA from the browser could easily turn into a PR battle if thousands of websites' users can't visit anymore because of broken certificates.

Ultimately, it’s still the site operators' responsibility to educate themselves on their certificates' security and ensure that their users’ connections to the site are protected. That includes not using certificates from CAs that don’t follow the rules or replacing them when necessary.

Google has also been promoting (and soon requiring) support for the Certificate Transparency certificate logging and monitoring system, which should make it much easier to identify when a CA is issuing problematic certificates. It should also encourage CAs to behave and to properly audit their own systems to ensure everything works as it should and that bad actors (whether hackers or malicious employees) aren’t abusing their systems to issue forged certificates.

Google announced that its Portable Native Client (PNaCl) solution for making native code run inside the browser will be replaced by the new cross-browser web standard called WebAssembly.

NaCl And PNaCl

Around the same time Google introduced Chrome OS in 2011, it also announced Native Client (NaCl), a sandboxing technology that runs native code inside the browser. This was initially supposed to make Chrome OS a little more useful offline compared to only running web apps that required an internet connection.

Two years later, Google also announced PNaCl, which was a more portable version of NaCl that could work on ARM, MIPS, and x86 devices. NaCl, on the other hand, only worked on x86 chips.

Even though Google open sourced PNaCl, as part of the Chromium project, Mozilla ended up creating its own alternative called “asm.js,” an optimized subset of JavaScript that could also compile to the assembly language. Mozilla thought that asm.js was far simpler to implement and required no API compatibility, as PNaCl did.

As these projects seemed to go nowhere, with everyone promoting their own standard, the major browser vendors seem to have eventually decided on creating WebAssembly.

WebAssembly

WebAssembly can give web apps near-native performance, offers support for more CPU features, and is simpler to implement in browsers and use by developers. Chrome 57 and Firefox 52 already support WebAssembly, and Microsoft’s Edge and Apple’s Safari support it in the preview versions of their browsers.

Google said that going forward, its native code efforts will focus on using WebAssembly. Meanwhile, PNaCl will be deprecated by the end of the first quarter of 2018. Chrome apps and extensions will continue to support it for a while longer. However, Chrome previously announced the deprecation of Chrome apps, too.

Google published a list of recommendations for developers who want to port their apps from PNaCl to WebAssembly, as well as a roadmap for WebAssembly features that will be supported in future versions of Chrome.

Chrome has long been criticized for using too much power and draining notebook battery life, but Google has been taking some steps lately to improve the browser's efficiency. The latest includes limiting background tabs to using only 1% of the CPU’s performance.

Chrome’s High Power Usage

Both Apple and Microsoft have taken advantage of the fact that Chrome isn’t that efficient in terms of power usage. This may not have put too much of a dent on Chrome’s growing market share, but it did negatively impact its image. It seems Google has taken notice of that, and over the past few months, the Chrome team has been working on making their browser more efficient.

Right now, according to Google, background tabs represent as much as a third of Chrome’s overall power usage. That’s quite significant for browser tabs that are effectively being unused.

New Background Throttling Policy

The recently released Chrome 57 aims to improve that by limiting the timing fire rate for individual background tabs that use excessive amounts of power. Chrome, like other browsers, has limited timers in the background to only run once per second.

Via the new throttling policy, Chrome 57 will delay timers to limit average CPU loads to 1% of a core, if an application uses too much CPU in the background. Tabs that play audio or are maintaining real-time connections such as WebSockets or WebRTC will not be affected. Google found that the new throttling policy can lead to 25% fewer busy background tabs.

Background Tab Suspension Roadmap

Chrome’s background suspension roadmap also shows that it will also start throttling loading tasks later this year, without any disruptions to the user experience.

In 2018, Chrome should be able to fully suspend background tabs, unless developers explicitly opt out of this feature. However, around 2020, Chrome will also remove the opt-out mechanism, so all background tabs will be suspended if they’ve remained unused for a few minutes.

A similar policy of complete suspension for the mobile version of Chrome will be enabled later this year, as on mobile, restricting power use is much more important than on the desktop.

Four years ago, Google introduced the idea of Chrome apps. These were web apps that would work as if they were native apps with offline capabilities. However, Google recently announced it would no longer support Chrome apps because they are used by only 1% of Chrome users.

The idea of Chrome apps was mainly introduced to help Chrome OS feel more like a real operating system. You could continue using Chrome apps even when you were disconnected from the Internet. Your changes would be saved locally, and then, if needed, they'd be synced to the web service as well.

Chrome apps also had other capabilities that regular apps or browser extensions didn’t have, such as more direct access to system hardware (USB, Bluetooth, cameras, etc). You could also use the Chrome app outside of of the Chrome browser, as if it was a standalone application.

Google even worked on helping developers port existing C++ applications to Chrome through the Native Client sandboxing technology. Google didn’t specifically address Native Client apps in its latest announcement, but with Chrome apps being deprecated soon, and with Android native apps also coming to Chrome OS, supporting Native Client apps may not make much sense in the future. Multiple browser vendors are also working on a standardized alternative to Native Client, called WebAssembly, which may help speed up the demise of Native Client support in Chrome as well.

Starting in late 2016, new Chrome apps will only be shown in Chrome OS. Existing apps will work in the Chrome browser on all the desktop platforms until the second half of 2017. In early 2018, only Chrome OS will be able to load Chrome apps. It’s possible that many enterprise and institutional customers of Chromebooks are already depending on some Chrome apps, so Google will probably support them on Chrome OS for a few more years.

Developers of Chrome apps, such as Open WhisperSystems with its Signal for Desktop client, will have to either transition to a similar solution, such as Electron or NW.js, or give up on the “native” web app idea completely and write regular native applications instead.

Back in May, Google said it would start blocking Flash by the end of the year. The company reiterated that today, while also adding that it will begin “de-emphasizing” Flash content in Chrome as soon as next month, when Chrome 53 arrives.

Although Flash used to be quite an important tool for developers in the early days of the web when they couldn’t do too much with HTML, things have changed significantly since then. Over the years, Flash became one of the top targets for malware makers. That happened in part because the plugin was so popular with users and worked in all browsers, but also because it had too much vulnerable code that keeps getting exploited to this day.

Beyond the security issues on the desktop, Flash also had performance and battery life issues on mobile platforms, which is one of the reasons why Steve Jobs famously promised to never adopt it for iOS. Google and Adobe tried to optimize Flash for Android, but it eventually became obvious that even with dual-core processors arriving in high-end smartphones at the time, Flash was not made to work well on mobile. Adobe eventually stopped supporting Flash on Android altogether.

The vast majority of users, whether on mobile or on the desktop, are now using a browser that supports an extensive range of HTML5 capabilities that can match Flash. Therefore, browser vendors, as well as many users, believe that it’s now time to put an end to Flash content on the web.

Starting with version 53 next month, Chrome will begin to block invisible Flash content (such as page analytics). This reportedly represents 90 percent of the Flash content on the web and slows down web pages.

Mozilla has already begun to block flash and promised to block it by default sometime in 2017. Apple will begin blocking Flash by default, too, in the next version of macOS, which should be available this fall. Google said that Chrome 55 will also block all Flash content by default by the end of this year. All websites will then show the HTML5 version by default, with the exception of Flash-only websites.

After blocking Flash ads last year, the Chrome team is ready to start blocking Flash content by default on most websites. Only the top 10 sites will get an extra year exemption, and after that their Flash content would be blocked as well. Browser users will still be able to manually play Flash inside Chrome for a while longer.

Last year, Chrome began block auto-playing Flash ads, as they would consume too much power, and they can also represent as a security risk. Not long before that, Mozilla had to block all Flash content by default for a short period, because of multiple critical Flash vulnerabilities that affected Firefox users.  

Flash has been a major source of critical vulnerabilities impacting hundreds of millions of browser users. For the most part, Chrome’s sandboxing could protect against those vulnerabilities, but not all browsers have sandboxing that can contain the Flash vulnerabilities, and even if they do, the protection may not be as potent.

After the aforementioned one-year extension, the top 10 sites will get the same treatment as all the other sites with Flash content. The ten sites include YouTube.com, Yahoo.com, VK.com, Live.com, Yandex.ru, OK.ru, Twitch.tv, Amazon.com, and Mail.ru.

Chrome will continue to support Flash for an indeterminate period of time, so users can still activate it on sites on which it is blocked by default if they deem it necessary. The sites that require Flash to run will prompt visitors with a choice to allow Flash or keep it disabled.

On some sites, such as Pandora.com, visitors are now automatically prompted to download Flash from Adobe’s site when they find that Flash can’t be played by default. Once the Flash blocking policy goes into effect, Chrome will intercept this type of request and instead prompt the visitors with an “Allow Flash Player…” info bar. Meanwhile, enterprises will be given the option to “Always run Flash content.”  

Google also said that in the future, the term “plugin” will be replaced by the term “Flash Player,” as that will be the last supported plugin in Chrome.

Adobe itself has begun encouraging developers to stop creating Flash content and focus on HTML5 instead, so it’s likely that Flash won’t be around much longer in other browsers, either.

Lucian Armasu is a Contributing Writer for Tom's Hardware. You can follow him at @lucian_armasu. 

Follow us on Facebook, Google+, RSS, Twitter and YouTube.

Google Chrome has a Data Saver feature on the mobile version of the browser that reduces the amount of data used every time you visit a webpage. Recently, the company made an additional improvement to the service, which it claimed reduces data usage up to 70 percent.

The improvement is a somewhat obvious move. Images on a webpage take up a heavy portion of data, and this update halts image loading when Data Saver detects a slow connection. Once the page’s text is ready, you have the option to load all the images onto the page or select the images you want to see.

Data Saver works by optimizing the contents of each page on Google’s proxy servers before the data is sent to your phone. A connection between the smartphone and Google’s servers is opened, the user requests a page, and then the page is optimized for data reduction through the server before it arrives on your smartphone. However, if you visit secure pages (URLs that start with "https") or browse in Incognito mode, Data Saver won’t compress the data.

For now, the updated Data Saver feature will begin rolling out in India and Indonesia, two countries that might have reduced and unreliable mobile data coverage. The company said that it will come to more countries in the coming months, but based on the initial release, Google will first bring the feature to markets that desperately need the feature.

______________________________________________________________________

Rexly Peñaflorida II is a Contributor at Tom’s Hardware. He writes news on tech and hardware, but mostly focuses on gaming news. As a Chicagoan, he believes that deep dish pizza is real pizza and ketchup should never be on hot dogs. Ever. Also, Portillo’s is amazing.

Follow Rexly Peñaflorida II @Heirdeux. Follow us on Facebook, Google+, RSS, Twitter and YouTube .

Last week, Google's security engineers wrote a post about an intermediate certificate authority (CA) called MCS Holdings that issued some unauthorized digital certificates for Google's domains. The intermediate certificate for MCS Holdings was issued by CNNIC, China's main root certificate authority. Google believes CNNIC is also responsible for that forged certificate and has decided to remove it from Chrome.

The Problem With Rogue CAs

When a certificate authority issues false certificates that allow for unsecure connections and traffic interception, browser vendors usually respond by banning that CA and revoking its issued certificates.

This sort of policy is important because the security model of the Web is rather vulnerable, having to depend on thousands of random certificate authorities and a few root CAs. These root CAs may even have strong ties to their local governments, and depending on the government, their intentions may not always be to the benefit of everyone on the Web.

If browser vendors would allow the rogue CAs to break Internet security, even after they catch them doing it, then it could create a domino effect, and the security of the Web could fall apart. More CAs could start taking risks and forging certificates for various benefits, knowing that the browser vendors won't punish them.

Also, if more people would see that their browsers continue to trust less trustworthy certificate authorities, they would eventually stop trusting HTTPS connections, too (which are useful for secure online banking, e-commerce, and stopping traffic interception, among many other things).

Therefore, banning bad CAs seems like the most reasonable thing to do within the current security model of the Web as a deterrent for other CAs to avoid the same mistake.

Banning The CNNIC Root CA

Although this is usually expected to happen, few thought Google or any other browser vendor would go as far as to ban not just MCS Holdings, but also China's root certificate authority, CNNIC. Yet, this is exactly what Google has just announced.

In a future update, the CNNIC root certificate will be revoked. For the time being, Google will continue to allow CNNIC's certificates to be used in Chrome through a publicly disclosed whitelist. After that, before it asks for reinclusion in the Chrome root store, CNNIC must adopt the Certificate Transparency system that Google has been proposing for the past few years.

Certificate Transparency

Although right now Google can quickly identify when forged certificates are issued for its domains, thanks to certificate pinning in Chrome, this solution isn't scalable and usually works only for Google's own websites. For that reason, Google came up with the Certificate Transparency project, which provides an "open framework for monitoring and auditing SSL certificates in nearly real time."

The main goals of Certificate Transparency are:

Make it impossible (or at least very difficult) for a CA to issue an SSL certificate for a domain without the certificate being visible to the owner of that domain.Provide an open auditing and monitoring system that lets any domain owner or CA determine whether certificates have been mistakenly or maliciously issued.Protect users (as much as possible) from being duped by certificates that were mistakenly or maliciously issued.

Because it's an open framework, anyone can verify the basic components that make Certificate Transparency work. This open system should bring a certain degree of improvement to the current CA model where it's hard to even know when a certificate against a certain site has been forged.

China's CNNIC responds

Although Google seems to imply that CNNIC has already agreed to implement Certificate Transparency for its certificates before it's reincluded in Chrome, the root CA responded publicly today by using a completely different tone:

“1. The decision that Google has made is unacceptable and unintelligible to CNNIC, and meanwhile CNNIC sincerely urge that Google would take users' rights and interests into full consideration.2. For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected."

Other Browser Vendors Have Yet To React

Although Chrome is arguably the most popular web browser today (especially when including its mobile market share), it still has only about a third of the browser market. For this move to be completely effective, Mozilla, Apple and Microsoft might have to do what Google did and remove CNNIC from their certificate root store.

Right now, Mozilla seems to be at least considering limiting CNNIC new certificates in its browser. However, it doesn't currently plan to remove CNNIC from the root store, unless the Chinese root CA doesn't agree to its set of requests in order to have some form of verification for its certificates.

Do not remove the CNNIC root, but Reject certificates chaining to CNNIC with a notBefore date after a threshold date Request that CNNIC provide a list of currently valid certificates, and publish that list so that the community can recognize any back-dated certs Allow CNNIC to re-apply for full inclusion, with some additional requirements (to be discussed on this list) If CNNIC's re-application is unsuccessful, then their root certificates will be removed

Apple has been in a security promotion campaign lately and has even had some security troubles in China. Therefore, it wouldn't be too far-fetched for the company to follow in Google's footsteps. At the same time, Apple is seeing rapid growth for its iPhones in China, so it remains to be seen whether it will back Google on this, or whether it will compromise in order to maintain a good relationship with the Chinese government there and not harm its sales in any way.

China hasn't always treated Microsoft well either, especially more recently when the government announced the banning of Windows 8 from government institutions. However, Microsoft has a relatively long history of giving in to China's censorship or surveillance requests, so it's once again hard to predict whether the company would follow Google's bold move to ban CNNIC from Internet Explorer (and Project Spartan).

As usual, when security is involved, the weakest leak can make the whole system fall apart. In the same way, having some of the major browser vendors fail to agree to punish the rogue certificate authorities for issuing fake certificates could set a dangerous precedent.

Follow us @tomshardware, on Facebook and on Google+.

Google software engineer Lucas Ballard updated the company's Online Security Blog with news that the Chrome web browser, Google Search and Google Ads now provide even more protection against malicious sites and unwanted software.

News of the beefed-up Safe Browsing service arrives after Google rolled out a feature in October 2013 that warns users about a potential threat when clicking on a download link. When users click on the link within the Chrome browser, a warning pops up saying that the file may "harm your browsing experience," and the download is blocked unless the user clicks the "Dismiss" button.

The company also rolled out a "reset browser settings" button, which allows users to return Chrome to its default settings with the click of a button. To access the button, Chrome users simply need to hit the Settings icon in the top-right corner, select "Settings" and expand "Show Advanced Settings" to reveal "Reset Settings." Users can then click on the "Reset Settings" button.

According to Ballard, the Chrome browser will now show a new red warning when the user clicks on a link that's listed in the Safe Browsing blacklist. "Attackers on (website) might attempt to trick you into installing programs that harm your browsing experience," the warning states. Examples include programs that change the homepage, showing additional ads on visited websites and so on.

As for Google Search, this service now "incorporates signals that identify such deceptive sites," meaning users will likely not see the blacklisted sites in search results. Google has also disabled ads that lead to sites hosting unwanted software.

"If you're a site owner, we recommend that you register your site with Google Webmaster Tools," Ballard said. "This will help you stay informed when we find something on your site that leads people to download unwanted software, and will provide you with helpful tips to resolve such issues."

Google's Safe Browsing website revealed that around one billion people use the service, and "tens of millions" see warnings each week whether it's in Google's Chrome, Apple's Safari or Mozilla's Firefox browsers. Even more, each day Safe Browsing scans "billions" of websites and uncovers ten thousand malicious sites serving up unwanted downloads. Many of these websites are legitimate but have been infiltrated by hackers.

Google began warning about malicious downloads back in April 2011. Moheeb Abu Rajab of the Google Security Team said that a warning will appear when the user clicks on a download URL that matches one residing on Google's latest Safe Browsing blacklist. By comparison, the new Safe Browsing feature introduced this week warns users before they even visit the website hosting the unwanted software.

"We're constantly working to keep people safe across the web," Ballard said.

Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+.

The Chrome browser is generally considered the most secure Web browser, and it also tends to do the best in hacking competitions such as Pwn2Own. This is in part thanks to the solid security architecture of Chrome, and to its security engineers, who keep adopting strong security designs and policies.

There's always a compromise between security and flexibility/freedom to do something. Security is very much about reducing the attack vectors, which generally means reducing the freedom to use some features.

Some of those security decisions can go too far sometimes, such as the decision to only allow Chrome extensions to be installed from the Chrome store, when there could have been alternative solutions that are not as restrictive.

On Android, users are still allowed to sideload applications, just like Windows and Mac OS users can still install applications from outside the main store. This feature remains despite Android having a much bigger market share than Chrome, and with sideloaded Android apps being potentially much more damaging than Chrome extensions. Yet the security people in charge of Android have decided it's a necessary freedom that needs to stay within the Android ecosystem.

The Chrome Security Team has recently made a proposal on the Chromium.org site that is bound to make some web developers unhappy but at the same time could be highly beneficial to the Web if implemented properly. The team proposed that all browsers begin marking HTTP (plain-text traffic) websites as "non-secure" beginning next year. This comes after Google already announced this year that HTTPS sites would be getting a slight boost in its search engine.

The new move could immediately make some developers panic. However, the security team proposed that this transition happen gradually in order to give developers time to encrypt their websites with HTTPS, if they have not done it already.

The Chrome team said there are three main states for web properties:

Secure [valid HTTPS, other origins like (*, localhost, *)];Dubious (valid HTTPS but with mixed passive resources, valid HTTPS with minor TLS errors); andNon-secure (broken HTTPS, HTTP).

After the Snowden revelations, we know that HTTP is indeed non-secure, and spy agencies from all over the world can not only intercept and spy on that HTTP traffic, but they can also send malware through it.

Chrome's security engineers proposed that browser vendors make the following four-phase transition:

T0 (now): Non-secure origins unmarkedT1: Non-secure origins marked as DubiousT2: Non-secure origins marked as Non-secureT3: Secure origins unmarked

The goal seems to be that ultimately, most (over 85 percent) sites would be protected with HTTPS, and then they wouldn't need to keep the current green mark that differentiates them from the unprotected HTTP sites. The status quo would be encrypted traffic, and only a small percentage would remain marked as non-secure.

The Chrome team intends to implement its transition plan for declaring HTTP sites "non-secure" next year.

Follow us @tomshardware, on Facebook and on Google+.

Ian Morris of Forbes has discovered that Google's Chrome browser for Windows can drain a laptop's battery. The problem was first reported back in 2010, and Google is just now getting around to addressing the problem.

Morris reports that the issue stems from a misuse of the "system clock tick rate." When a user opens the Chrome browser, the rate is automatically set to 1.000 ms, and it stays that way until the user closes the browser. That means the processor, which stays "asleep" when nothing is going on, is awakened 1000 times per second. That can raise power consumption by as much as 25 percent.

When consumers open Internet Explorer or Firefox, the rate will stay at 15.625 ms until the processor is required to do something, and the rate is increased to 1.000 ms. Watch a YouTube video, and the tick rate jumps to 1.000 ms. Close the tab, and Internet Explorer and Firefox will shift back to 15.625 ms.

Morris said that he performed a test on his desktop, and discovered that when idle, it eats up 15 to 20 watts with Chrome running. When he closed Chrome entirely, the power consumption dropped down to 12 to 15 watts. He points out that on a desktop, this isn't a problem, but on a laptop, power consumption is "massively important."

So what can consumers with laptops do about this problem? Switch to a different browser until the issue is resolved. Web surfers can also "star" the issue on the bug tracker. However, given that Google is now looking into the problem (thanks to the coverage, no doubt), using an alternative browser for now seems to be the best option.

Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+

The Google Chrome Blog was updated on Wednesday with news of the company's Remote Desktop service extending out to smartphones and tablets. As the name implies, users can now install the Remote Desktop app in the Chrome browser, install the Chrome Remote Desktop app for Android, and then access the desktop from the mobile device.

1. To get this service up and running, first you need to open the Chrome desktop app and enable remote connections; your desktop or laptop should be listed under "My Computers."

2. To provide access to this particular computer, users must create a PIN of at least six digits. This PIN number will be required from the smartphone or tablet.

3. On your Android device's screen, your shared laptop or desktop should be visible. Tap on it, and the app will ask for the PIN number used on the host PC.

4. After that, you should see your desktop on the mobile Android device. Even more, a box stating that "your desktop is currently shared with blah@blah.com" should be positioned at the bottom of the computer's screen. There's also a button to halt the sharing.

That's it; setting up the connection is super easy and super fast.

Once the setup is completed, users can swipe their finger across the smartphone or tablet screen to move the mouse pointer. In this hands-on demo, all three screens were streamed, not just display #1, so maneuvering around on a 4.7-inch smartphone screen took some time, but that's OK. There's seemingly no delay between finger and remote mouse movement. Naturally, remotely accessing the PC was easier on a tablet thanks to the larger screen coverage.

This service would be ideal for those who ran out of the office without their report, for those who continuously go to Mom's house to fix her PC settings, and so on. Users can also remotely open an application, read documents, and even surf the Internet. What's great is that this Chrome service is absolutely free.

To stop sharing, simply hit the button on the bottom of the screen. Keeping this service on indefinitely isn't recommended; the whole blinking cursor thing seems to indicate that this service could interfere with games and applications that require a lot of the PC's resources. If anything, turn it on only when needed.

Although Chrome Remote Desktop has been around for a while now, adding mobile device support is a welcome addition to the Android family. For more information about this new service, head here.

Google this week announced changes to Chrome that will help the browser run faster and smoother. This is thanks to a change to the way Chrome compiles JavaScript.

Chrome’s V8 JavaScript engine compiles JavaScript in the main thread, which could in turn affect the performance of the JavaScript app, slowing things down or causing stuttering. The latest Chrome Beta hopes to eliminate that by offloading the JavaScript compilation to a background thread.

V8 defers compilation of JavaScript functions until right before they’re executed for the first time. It’s a fast process, but it doesn’t place any focus on optimizing the code. If a piece of code is executed often will get compiled a second time by an optimizing compiler. This compiler employs advanced optimization techniques, which takes more time than the first compilation, but delivers faster code.

Up until now, V8 alternated between compiling optimized JavaScrip code and executing it. This new version of Chrome Beta introduces concurrent compilation, which means compilation and execution happen at the same time, with V8 optimizing large pieces of code in a background thread.  

Concurrent compilation is, right now, only available with Chrome Beta but should hopefully trickle down to the full version of Chrome in the not too distant future and will ultimately contribute towards reducing latency in Chrome.

Follow Jane McEntegart @JaneMcEntegart. Follow us @tomshardware, on Facebook and on Google+.

The Google Chrome Blog was updated on Wednesday with news of a new release for Chrome Mobile on Android and iOS that promises up to 50 percent in data reduction, thus saving users money on their data plan. This data savings is due to a new compression and bandwidth management feature in Google's mobile browser, launched on Wednesday.

To start saving that precious mobile data, Chrome users simply visit "Settings" > "Bandwidth Management" > "Reduce Data Usage." From there Chrome users can slide the toggle to "On." Even more, on this menu, users can see how much bandwidth they save each month when using Chrome, as seen in the supplied screenshot.

In addition to the data savings, Chrome for Android will allow users to create shortcuts to their favorite websites right on the home screen for faster and easier access to the Web. To make these shortcuts, users simply select "Add to home screen" from the toolbar menu when visiting a site to save. For certain websites, the shortcut will open in a full-screen experience and appear as a separate app in the Android app switcher.

On the Apple iOS front, Google plans to introduce Google Translate in Chrome for iOS in the coming days, so stay tuned.

"With this update, you can now translate webpages in Chrome with the click of a button on your iPhone and iPad, just as you're used to on Chrome for desktop and Android. To translate a page into your phone or tablet's native language, just look for the translation bar and select 'Translate'," writes Matt Welsh, Software Engineer & Data Squasher Extraordinaire.

Download the latest releases of Chrome for Mobile at the Play Store and App Store. The updates will reportedly roll out over the next several days.

While a stalwart cadre of PC users has stuck with Windows XP for the past decade, Microsoft has said that its support of the OS will end on April 8, 2014. Earlier today Google announced that it would continue patching and updating Chrome for XP an additional year – until 2015.

Mark Larson, the Superintendent of Public Safety at Google said in a blog post, "Our goal is to support Chrome for XP users during this transition process. Most importantly, Chrome on XP will still be automatically updated with the latest security fixes to protect against malware and phishing attacks."

Supporting legacy software is often rough – the code’s flaws are much better known by definition and that tends to make computers running older, outdated tech significantly more vulnerable to attack. That aside, many businesses still rely on bulk licenses to keep their  enterprises running, and the closer we get to that April 8^th deadline, the more likely those IT departments will be forced to switch over.

For a good chunk of people, that’s going to mean big change and certainly plays into Microsoft’s hands as it brings in new bulk licenses for its latest operating systems.

Justin Schuh, Security Engineer and Plug-in Retirement Planner for Google Chrome, said on Monday that browser plug-ins based on the popular Netscape Plug-in API architecture will be blocked starting next year. The roll-out will be in stages, with webpage-instantiated NPAPI plug-ins blocked by default on the Stable channel in January 2014.

The most popular NPAPI plug-ins used in the Chrome browser include Silverlight (15 percent), Unity (9.1 percent), Google Earth (9.1 percent), Java (8.9 percent and is already blocked by default), Google Talk (8.7 percent) and Facebook Video (6 percent). These will be temporarily white-listed to avoid disruption to users, he said, for an unspecified amount of time.

"The Netscape Plug-in API (NPAPI) ushered in an early era of web innovation by offering the first standard mechanism to extend the browser," Schuh explained. "In fact, many modern web platform features—including video and audio support—first saw mainstream deployment through NPAPI-based plug-ins. But the web has evolved. Today's browsers are speedier, safer, and more capable than their ancestors."

He said NPAPI's 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity. Because of this, Chrome will be phasing out NPAPI support over the coming year. In the short term, users and businesses will be able to white-list specific plug-ins, but eventually NPAPI support will be completely ripped out of the Chrome browser.

"We expect this to happen before the end of 2014, but the exact timing will depend on usage and user feedback," Schuh said. "Note that the built-in Flash plug-in and PDF viewer will be unaffected because they don't use NPAPI."

Google switched the Flash Player plug-in bundled with Chrome for Windows from NPAPI to a new plug-in architecture called Pepper Plugin API, or PPAPI, back in August 2012, and then made the switch in Chrome for Mac OS X one month later. Google's PPAPI forces plug-in code to run securely inside a sandbox, thus making Flash Player less susceptible to crashes.

As of Monday, the Chrome Web Store will be refusing new Apps and Extensions containing NPAPI-based plug-ins, and developers with current solutions offered on the platform will be able to make updates until they will be removed from the store's home page, search results and category pages in May 2014. In September 2014, all existing NPAPI-based Apps and Extensions will be unpublished. Installed Apps and Extensions will continue to work until support for NPAPI is removed at the end of 2014.

Schuh said developers relying on NPAPI can use alternatives where standard technologies are not yet sufficient, including NaCl, Native Messaging API, and Legacy Browser support. However, moving forward, the Chrome team is shooting to evolve the standards-based web platform to cover the scenarios currently served by NPAPI.

"We feel the web is ready for this transition," he said. "NPAPI isn't supported on mobile devices, and Mozilla plans to block NPAPI plug-ins in December 2013."

A few interesting tidbits have popped up since Google introduced Chromecast less than 24 hours ago, including some of the specs and tips on how to load up videos stored on a hard drive. Google's streaming gadget went on sale for $35 on Wednesday, only to immediately sell out, making Chromecast a seemingly cheap and popular alternative to purchasing a set-top box or Smart TV.

According to the specs, Chromecast is powered by a Marvell "Armada" DE3005 chip and an AzureWave 2.4 GHz Wireless N chip. The details were spilled by updated FCC documents that originally evaluated the device as a Google H840 Device labeled H2G2-42.

Unfortunately, Marvell doesn't show the DE3005 on its website, so we couldn't get the specifics -- the chip could be a custom solution for Google's gadget. The closest relative would be the Armada 1000 (88DE3010) which has two "Sheeva" cores clocked up to 1.2 GHz, dedicated hardware acceleration for multi-format video and audio decoding, and a Qdeo processing pipeline. This chip supports HDMI v1.3.

There's also the Armada 1500 (88DE3100) which is a bit more feature-rich, packing two ARMv7 compatible PJ4B CPU cores with symmetric multi-processing and clocked at 1.2 GHz, a dedicated security engine, support for USB 2.0 OTG, support for HDMI v1.4, a Vivante GC1000 graphics core, 512 kb of L2 cache, a Qdeo pipeline and so on. We're betting the chip used in Google's Chromecast is similar to this one.

Based on the FCC shots, the AzureWave chip used in Chromecast may be the AW-NH387. This combo chip combines Wireless N, Bluetooth 3.0 + HS and FM radio into one solution. FM bands are supported, the specs read, and supports the European Radio Data Systems (RDS) and the North American Radio Broadcast Data System (RBDS) modulations. If this is indeed the chip, does this mean Google plans to open up Bluetooth and FM radio capabilities in the future?

As for the whole power cord aspect, the FCC shows an image of the device plugged into the back of an HDTV during testing. The power cord is clearly dangling from the device, meaning despite Google's presentation of merely connecting and steaming with no visible wires, that indeed is not the case. Chromecast doesn't have a battery, so users will either need to plug it into a wall outlet, or possibly a spare USB port on the HDTV to provide power.

As for additional Chromecast specs, the device sports Micron D9PXV 4 Gb DDR3-1600 RAM and 4 GB of Micron flash memory (29F16G08MAA). The device also supposedly uses a simplified version of Chrome OS instead of Android to better handle media tuned in from a Chrome browser on a desktop or laptop. Chrome's browser extension for the gadget, which will essentially let users play any Flash-based video on Chromecast, can be installed here.

One Reddit user discovered that Chromecast owners can play any video from their hard drives as well. Simply open the Chrome browser, type in C:/ in the address bar, and navigate to any locally stored video. Actually, this should work on any mapped hard drive.

Getting a new $35 Chromecast may be a bit difficult for now. Various reports point to stock selling out quickly both online and offline. Google Play is now showing a three to four week delay in shipments, and Amazon is currently listing it as "out of stock." Best Buy's product page says it's sold out online.

New Android boss Sundar Pichai recently talked with Wired about the future of the platform, and how he plans to keep it separate from Chrome even though he's knee-deep in both. He also talked a little bit about Facebook Home, and how Android was intended to be customizable to the point that Facebook's launcher design is possible. But that could change later on down the road.

"As for the specific product, my personal take on it is that time will tell," he said. "To Mark [Zuckerberg], people are the center of everything. I take a slightly different approach. I think life is multifaceted: people are a huge part of it, but not the center and be-all of everything."

Wired then asked about rumors that Google may block a Facebook Home-style approach in a future release. Pichai said that Google wants Android to be a very open platform, but the company also wants users to have a good experience overall. Designs need to make sense for both the user and developer. There’s always a balance, he said, and it’s no different from the kind of decisions that Facebook has to make about its own platform.

"Users get to decide what apps and what choices they want," he told Wired. "Some users really want this. We don’t want to get in the way of that. [But] in the end, we have to provide a consistent experience. As part of that, with every release of Android, we do go through changes. So we may make changes over time. But if this is what users want, I think Facebook will be able to do it. We want it to be possible for users to get what they want."

As for the forked version of Android like what's used on the Kindle Fire tablets, he admitted that Google would rather everyone use one version of Android because it benefits everyone better. But under the rules of the license, Amazon can alter the platform all it wants. He also shot down any hints of rivalry with Samsung by showing Wired his Galaxy S4 smartphone, saying that Samsung is a great company and that they work closely together on a large number of products.

The interview goes on to cover a load of topics including the eye-tracking project, the future of Google-branded hardware, the performance of Web apps, money generated from Android in comparison to the money Apple makes from iOS devices, and Mozilla's Firefox OS. They also briefly cover the Android update process.

"We are thinking about how to make Android handle updates better," he said. "We see ways we can do this. It’s early days. We’re talking with our partners and working our way through it. We need time to figure out the mechanics, but it’s definitely an area of focus for me and for the team."

And what about Google I/O this week? There are reports that we'll see a ton of new devices like the Motorola XFON, new 7-inch and 10-inch second-gen Nexus tablets, Android 4.3 "Jelly Bean", Android-based notebooks and more. There's speculation the keynote itself was stretched to three hours in order to cram all the announcements into one presentation.

"It’s going to be different," he said. "It’s not a time when we have much in the way of launches of new products or a new operating system. Both on Android and Chrome, we’re going to focus this I/O on all of the kinds of things we’re doing for developers, so that they can write better things. We will show how Google services are doing amazing things on top of these two platforms."

Google wants you to use Chrome. To get you to use it, the company has turned its browser into a game. In fact, the game in question actually requires you to install both the mobile and desktop versions of Google's Chrome browser. Pretty clever, huh?

Dubbed Google Chrome's World Wide Maze, the game involves opening the same tab on both your phone on your desktop and then using your phone as the controller for a little ball that appears on your screen. You tilt your phone to make the ball roll around your favorite sites.

Engadget reports that the game will work with both the iPhone and Android devices, though you need to be running Android 4.0 or iOS 5.0 or higher for it to work. Check out the video for yourself below, or head on over to Chrome.com/maze and give it a whirl.

Contact Us for News Tips, Corrections and Feedback

According to the company, the feature was originally intended to "allow users to opt-in to adding a useful extension to Chrome as a part of the installation of another application", but has been founded to be  abused by third party software developers.

Google said that extensions have been distributed and installed without "proper acknowledgment from users", which was made possible via the Windows registry mechanism for extension deployment.

Chrome 25 will automatically disable all extensions that were installed via the company's external extension deployment options. However, Chrome will show a "one-time prompt to allow the re-enabling of any of the extensions".

Chrome 25 is not expected to be released as a stable version until the end of February.

_{Contact Us for News Tips, Corrections and Feedback}

Google released the first beta version of Chrome on September 2, 2008. The first final release followed on December 11, 2008. Since its launch, Chrome has captured the lead in the market share race and is currently slightly ahead of Microsoft's Internet Explorer, with 33.59 percent versus 32.85 percent share.

The browser has been widely credited with increasing the focus on browser speed and security, and forcing Microsoft and Mozilla to substantially accelerate their JavaScript engines. According to JavaScript benchmarks such as Google's Octane, SunSpider or Mozilla's Kraken, chrome is still ahead in this discipline. Google has also influenced its rivals to adopt a silent update mechanism and a reduced user interface that allows more content to be shown in the browser window. Mozilla has also changed its software release schedule to 6 week time frames to match Google's model.

To review Chrome's milestones, Google posted the Chrome Time Machine, which allows the user to click through all major announcements. My personal favorite is the speed tests video, including a comparison of Chrome page load times against a potato gun. The video was launched when Chrome 5 was current (today were are using Chrome 21 as final version and Chrome 23 as developer version).

_{Contact Us for News Tips, Corrections and Feedback}

There is now word that this app will be integrated into Google's Gmail service "soon".

François Beaufort is typically well-informed, so I would put this information closer to an actual product than pure rumor. Beaufort said that Google's Chrome developers are working on an integration of the Document viewing app directly into Gmail. If you are not using Microsoft Office on your computer, a simple and lean implementation of this app would surely make the life of Gmail users much easier.

If Beaufort is right, Google could simply be leveraging an existing extension for Chrome that can be tied to the Gmail service as a another example how Google is suggesting its users to switch to Chrome.

In its current version, the Document viewer supports the formats doc, .docx, .xls, .xlsx, .ppt, and .pptx.

_{Contact Us for News Tips, Corrections and Feedback}

The software now integrates tab sync, which syncs open taps and your browsing history in real time.

As long as you are using Chrome for Android Beta on your phone or tablet, you can seamlessly pick up web browsing where you left off on your desktop. Even the back and forward buttons will work from machine to machine. Tab sync requires users, like other Sync features (such as bookmarks, apps, extensions, history, and themes), to be signed in to a Google account.

Google, however, said that not all Chrome users will be seeing the tab sync immediately. Instead, Google will pushing out tab sync "gradually over the coming weeks."

Download the latest version of Google Chrome here.

Google's updated its Chrome browser now to version 18 on the stable channel. The major new improvement in this release is the addition of hardware acceleration for graphics in Canvas2D and WebGL.

John "More CPU in Your GPU" Bauman and Brian "FPS" Salomon and penned in the Chromium blog:

«We’ve enabled GPU-accelerated Canvas2D on capable Windows and Mac computers, which should make web applications like games perform even better than a pure software implementation. GPU-accelerated Canvas2D has previously been enabled in the Beta channel for quite some time, so hopefully developers have had a chance to try it out. We’re continuing to make improvements and tweaks to our Canvas2D implementation, so please file a bug in our public issue tracker if you encounter problems.

WebGL enables compelling 3D content on the web, so we want to ensure that as many users as possible have access to this technology. That’s why we’ve enabled SwiftShader, a software rasterizer licensed from our friends at TransGaming, for users with older configurations. Keep in mind that a software-backed WebGL implementation is never going to perform as well as one running on a real GPU, but now more users will have access to basic 3D content on the web. See our previous blog post for more details on SwiftShader and how to try it out.»

If you're already running Chrome, you should see an update available in the About menu. Otherwise, you can find the latest download on Tom's Guide.

_{Read more from @MarcusYam on Twitter.}

Obviously, statistics carry marketing value in a negative or positive view and there is a clear motivation to comment on numbers that are primarily published by NetApplications and StatCounter (even if there are plenty more sources such as Clicky, StatOwl, or W3 Browser Statistics).

While Mozilla and Google have been largely quiet about market shares (but certainly care, as mentioned by Mozilla CTO in this blog post), Microsoft has used market share numbers only from Net Applications to highlight the decrease of importance of IE6 and the runaway success of IE9, especially on the dedicated blog Exploring IE. Last week, Microsoft reacted to data published by StatCounter that Chrome has exceeded IE market share for the first time. Microsoft's opinion is that StatCounter's data are slanted and incorrect and best. The reason? StatCounter evenly counts market share across its user base and does not consider geoweighting. To make matters worse, StatCounter also considers Google's prerendering feature, which obviously puts a positive spin on Google's data.

Without going too deep into analytics, Microsoft complains that the pages that are pre-rendered in Google's Omnibox count for market share at StatCounter. In February, pre-rendering counted for 4.3 percent of market share, Microsoft says. Also, Microsoft believes that, depending on the available data set, browser market share data has to be weighed against the entire Internet population. For example, China (where Microsoft dominates the browser market share arena) has 21.39 percent of the Internet population, according to CIA Internet user statistics, but it has only 0.96 percent in StatCounter's data.

According to Internet World Stats, the CIA estimate may be a bit conservative, as the user share in China could actually approach 25 percent. So, does Microsoft has a point? Sure. But we should not forget that NetApplications has also its problems as the scientific process of data collection isn't entirely transparent with missing margins of error, for example. My personal gripe with NetApplications has been that the freely available data change on a frequent basis and the company has denied consistent access to the same data sets over time. For example, Net Applications has strongly limited access to market share data to the fragmented versions of IE. Were they removed because of monetization reasons? Because of integration into IE overall? We have no idea as the company declined to comment. I cannot help but have some doubt about the data distribution between browser versions and within a browser itself. I am not accusing NetApplications of shady data publications, but there are clearly inconsistencies that make it difficult from the outside to assess the value of the data.

Like NetApplications, StatCounter has its issues as well. It is common sense to assume that no market share estimate can be entirely correct and there will always be opportunities to criticize the data published and interpret the data in the way you prefer. Those on the outside have to remember that browser market share statistics are merely trend indicators. In any case, absolute numbers should always be taken with a grain of salt.

Since November 2010, when Goggle began offering cash for bug reports, the company said it paid more than $410,000 to more than 200 individuals who found more than 1100 "legitimate issues" and 730 that qualified for a reward. An additional $19,000 was paid to charities chosen by bug reporters.

The "vast majority" of bug reports were motivated by the potential reward to disclose their discovery. So, even if Google paid more than $400,000, this seems to be a bargain when compared to the potential damage just one bug could have caused.

"It’s not all about money, though," wrote Adam Mein, technical program manager of Google's Security Team in a blog post. "Google has gotten better and stronger as a result of this work. We get more bug reports, which means we get more bug fixes, which means a safer experience for our users."

Google also disclosed that about half of all bugs found were located in software provided by companies that Google had acquired.

Prerendering kicks in as soon as a user begins typing in the URL bar of the browser and Chrome auto-completes a site's address and determines high likelihood that the site is the intended destination. Details about prerendered pages can be monitored in Chrome via the local URL chrome://net-internals/#prerender.

Google also extended the safe browsing features of Chrome and compares executable EXE and MSI files against a whitelist and information about websites that are likely to host malware.

The developer version of Chrome recently went to version 19, concluding the tree of Chrome 18, which will include more than 11,000 changes over Chrome 17. According to Chrome developer Peter Beverloo, Chrome 18 brings six new stable extension APIs, a CSS selector profiler, and mutation observers.

Chrome 17 can be downloaded here.

Vector-based SVG graphics as well as CSS filters are now accelerated via the GPU and can be activated via chrome://flags in a recent nightly build. The feature is mainly for developers as there are very few websites that could take advantage of accelerated CSS filters.

Chromium supports SVG and CSS acceleration on Mac, Windows, Linux, and Chrome OS. Additional experimental GPU acceleration features include GPU accelerated painting as well as GPU compositing on all pages. We were not able to determine any performance gains as those new features appear to be unstable and produced crashes in HTML5 benchmarks such as WebViz.

IE9 was the first browser that introduced SVG acceleration with the first platform preview of IE9 in March of last year.

The obvious idea behind this move is Google's interest in capturing those advertising revenues generated by Mozilla's 25 percent browser market share and users who are using the box for Google searches. Some rumors suggest that the price for Firefox went up as Microsoft was bidding for the space as well and Google certainly has no interest to handing those search revenues to Bing.

The problem, of course, is Firefox is a rival for Chrome is this respect as it is cheaper for Google to harvest search revenues through Chrome than pay Mozilla. As long as Mozilla has substantial market share that makes economic sense for Google, there is no reason to believe why Google would be dropping Mozilla. However, Chrome developer Peter Kasting does not quite agree and complained that people do not understand why Google is developing Chrome and why Google is supporting Firefox. According to Kasting, Chrome is much more Google's donation to the world, a welfare project if you will, than a tool that generates revenues.

Kasting argues that "the primary goal of Chrome is to make the web advance as much and as quickly as possible. That's it. It's completely irrelevant to this goal whether Chrome actually gains tons of users or whether instead the web advances because the other browser vendors step up their game and produce far better browsers. Either way the web gets better. Job done. The end."

To continue that thought, Mozilla also aims to make the web better. And since Chrome "cannot be all things to all people", Google needs to fund Mozilla as Firefox "is an important product because it can be a different product with different design decisions and serve different users well." Kasting concludes his thoughts with the notion that "Google succeeds (and makes money) when the web succeeds and people use it more to do everything they need to do." One may wonder where all the advertising business fits into this argument, as Chrome is actually tied directly to advertising via its instant-search engine supported via the location bar.

For some perspective, there is a balancing post from Firefox product manager Asa Dotzler, who has not been especially kind to Google's intention to build walls around its interests in the web in the past. According to Dotzler, the deal between Mozilla and Google has, of course, to do with selling ads: "This is Google's business," he writes. "They sell ads alongside 'free' content, and they buy additional traffic to make those ads more valuable." Contrary to Kasting's web welfare claims to make the web better, Dotzler says that "Google is not a philanthropist 'donating' money to Mozilla or any other traffic acquisition partner."

In the greater view, the deal makes sense for both parties and Mozilla has clearly come out on top, but the Firefox guys have a rough year ahead to make the money work. Despite Kasting's thoughts that Mozilla is simply an extension of Google's intent to make the web better, there may be more interest for Google to keep Mozilla alive and well down the road. The company is already under fire for unfair monopolization of web apps and advertising and the last thing Google needs is an antitrust suit that it killed Firefox in the browser race. Funding it with $1 billion may help avoid such a suit.

Following Mozilla and Google’s lead, Microsoft said on Thursday that Internet Explorer will begin to update itself automatically to the latest version starting in January.

Customers in Australia and Brazil will see the auto-updating first if the feature is turned on in Windows Update. A rollout schedule for other territories is unknown at this point, but Microsoft's Ryan Gavin said in a company blog that, like the release of IE9 earlier this year, Microsoft will take a measured approach, scaling up over time.

Obviously Microsoft's first priority is to get customers using older versions of Internet Explorer forcibly updated to the latest stable build. "For consumers, the safety benefits are one of the key reasons that the industry has been moving towards automatic updates as the norm," he said. "This is increasingly important since the biggest online threat these days is socially engineered malware, which typically targets outdated software like Web browsers."

But Microsoft also understands that there are situations where upgrading is not possible or desired. Thus, the company has released the Internet Explorer 8 and Internet Explorer 9 Automatic Update Blocker toolkits to prevent automatic upgrades of IE. Additionally, customers who have declined previous installations of IE8 or IE9 through Windows Update will not be automatically updated.

"Customers have the ability to uninstall updates and continue to receive support for the version of IE that came with their copy of Windows," Gavin said. "And similar to organizations, consumers can block the update all together and upgrade on their own. Finally, future versions of IE will provide an option in the product for consumers to opt out of automatic upgrading."

Meanwhile, arch enemy Google Chrome 16 now adds cloud print by default. Google Cloud Print (GCP) made its debut earlier this year, appearing as one of the main features in Chromebooks and as a product test in the Chrome beta channel. The goal, according to Google, is to enable simple, secure printing from any app on any device to any printer without the use of cables and drivers.

"People with Chromebooks have always had access to the latest and greatest Google Cloud Print features, but today, we’ve reached a new milestone: starting with the latest release of Chrome, anyone using the browser on Windows, Mac and Linux will be able to print any webpage to Google Cloud Print," writes product manager Akshay Kannan. "We’ve also turned on print preview for Chromebooks, so you’ll get the same familiar experience wherever you use Chrome."

On Thursday website analytics company StatCounter said that the older-yet-stable Chrome 15 has become the most popular web browser version worldwide for the first time on a weekly basis. In the last full week in November, Chrome 15 took 23.6-percent of the worldwide market compared to Microsoft’s Internet Explorer 8 at 23.5-percent.

"If one aggregates all versions then IE still leads the global market with Chrome in second position, having overtaken Firefox in November," StatCounter claims.

The company added that in the U.S., Internet Explorer 8 continues to be the most popular browser version with 27.0-percent for week beginning December 5 compared to 18.1-percent for Chrome 15.

Chrome 16 is the eighth release for Chrome this year. The big news is multi-profile support in one browser window. You can simply add new user profiles by clicking the user icon on the top left of the browser window or via the Tools/Options menu. This new feature enables multiple users to use the same browser window and load their browsing history as well as bookmarks (a carryover feature that previously required a retired Google Gears feature), as long as they are synced. What you can't do is run two profile in parallel at the same time.

Google also added 15 (published) security patches and paid $6000 to those who discovered them. The nightly Chrome (Canary) has arrived at version 18, which recently introduced an overhaul to the extensions page, which is still very much work in progress.

Download Chrome 16 here.

The result published by the Internet analysis firm matches the previous low in StatCounter's charts, which began recording browser data in July of 2008. Back in December of 2008, Firefox was at 25.23 percent and climbed to a high of 32.21 percent in November of 2009. The browser has been declining ever since then and lost more than 20 percent of its market share (5.14 points) over the past 12 months alone.

Google, on the other hand, was able to grow Chrome's market share by 10.84 points over the past 12 months. However, the growth posted in November was the slowest rate (2.76 percent or 0.69 points) in three years. Microsoft was able to halt IE's decline due to an advertising campaign that was launched last month across the Internet. However, if IE continues its average decline (6.31 points over the past 12 months, Chrome will be able to catch up by the third or fourth quarter next year.

StatCounter isn't the only source; NetApplications still sees Firefox ahead of Chrome in market share. Firefox is listed with 22.1 percent, followed by Chrome with 18.2 percent. IE leads with 52.6 percent. The trend in NetApplications data suggests that Chrome can surpass Firefox in their charts by March or April 2012.

There are countless Aura entries in Google's Chromium revision blog, but there is not much information about it beyond a project page and the explanation that it will be a hardware accelerated UI. Google developer François Beaufort recently published videos on YouTube that provide a first look at Aura.

The video showcases an experimental feature that is only available in the Aura version of Chromium - translucent windows, which demos translucent window frames as well as constrained window dragging. Aura is still very much work in progress, but will enable Google to depart from GTK and decrease its reliance on Windows - and achieve much more UI code consistency across all supported platforms.

For the more immediate future, Google recently added a timeline feature in Chromium, which draws a graph of the data traffic sent and received by the browser. There is also a new flag, Pointer Lock, in the most recent nightly builds, which allows web applications to take over the mouse pointer to enhance web app functionality. A browser user can cancel such an action simply pressing the Escape key. A notable additions is also the chrome://sessions local URL, which displays all active tabs in Chrome - which works across multiple devices, if the live tab syncing feature is activated.

The company says that the new version cuts down GC pause times and adds to the web app peak performance upgrade previously achieved by the Chrome JavaScript Crankshaft update.

According to a brief blog post, Google promises that the reduced pause times, which drop from a peak of 272 ms to just 50 ms, will result in notably better performing web apps, such as the WebGL versions of Google Maps or browser games. Subjectively, this writer found the WebGL version of Maps to be performing slightly better with a Chrome 17 nightly build rather than the stable Chrome 15, but I would not necessarily pin those marginal and very subjective impressions of improvements down on the change of the GC just yet. I am not convinced that the effect is as substantial as Google's data suggests

However, for those of us who believe benchmarks, there is a "stress test" that measures the effect of the new GC. Chrome 15 finished the (10 second) test with a score of 6, and Chrome 17 with a score of 34 on my test system. However, Chrome was beaten by the current Opera 11 stable build with 46, by the nightly build of Firefox 11 with 48 and, most dramatically, by the current Firefox 8 stable build with 126, which was able to paint more than twice the number of frames than Chrome 15 did - 617 frames versus 278 frames.

You can download the current developer version of Chrome here.

The new release also features a record sum of rewards paid to security researchers - more than $27,000 for a total of 27 published security issues. The Chromium revision log suggests that Google 15 has more than 5000 revisions over Chrome 14. Chrome has changes on the surface as well, as it now features the revised new tab page that has much more focus on applications and horizontally sliding pages. Future Chrome versions will get Most visited, Apps, and also a Bookmarks page, which is already live in developer versions of the browser.

Also noteworthy is that apps and extensions are now presented in a tab page that can be accessed via the browser settings page.

The developer channel of Chrome has just been branched to version 16 and indicates that the next version of the browser will have at least 5500 changes over version 15. Version 17 is in the nightly channel.

Grab the download for Chrome 15 here.

Google is a bit late to the party with this feature. Opera has had pipelining support since version 4 and Firefox has also included some customization freedom for users to adjust pipelining to alleviate the page load delays that are cause in high-latency situations.

Pipelining can be enabled via a flag in chrome://flags and will result in Chrome sending off multiple http requests before a response is received. The purpose is to shorten load times of pages especially on slow client-server systems. The improvement is very limited at this time and highly subjective. Google is unlikely to offer this feature for customization, but indicated that Chrome will automatically select the best number of pipelines. There is no proxy support and there is no way for the system to deal with servers that do not support pipelining or incorrectly implement pipelining. Google said that it will be fixing this feature in the future.

It is unclear when pipelining will be available by default. However, Chrome 17 is about 12 - 14 weeks from its final release and there is plenty of time to prep the feature. You can test drive pipelining in Chrome by downloading a recent Chromium snapshot. The feature is integrated in the browser in build versions 106364 and higher.

Google has decided that the trade-off of higher latency for increased security when running searches is worth it. While there has been an SSL-enabled search for more than a year now, it was never the default. Google announced on its official blog that it would be phasing the SSL feature in as the default setting for users who are signed in to a Google account over the next few weeks.

Attempts to access http://www.google.com will be redirected to https://www.google.com. Note that other localized Google search engines, such as Google UK and Google AU, do not yet appear to have working SSL implementations. However, it is quite common for features to be rolled out to these at a much later date.

Google says that it wants to protect personalized search results from snooping eyes connected to unsecured Wi-Fi hotspots. For this reason the new SSL-based search is optionally accessible to users who are logged out or who don't even have a Google account. Of course that's merely a side benefit compared to the real reason that this is being rolled out.

Upon clicking a search result using a a standard, insecure connection, the search query is passed to the website being accessed. Sometimes this is used to highlight the keywords on the page with gaudy colors that make it difficult to read. More importantly, the search term is collected by page scripts – particularly Google Analytics – and used by the website owners to determine what search terms they are primarily being found under and what content is generating the most traffic.

SSL changes everything.

No longer will Google Analytics data let website owners know what search terms were used to bring a person to their websites - at least not for logged-in Google account users. What it will provide is the number of users who came to the site via an SSL-enabled search. After conducting some research using a site whose Analytics data I have access to, I found that, rather than displaying the keyword information, these visits will simply appear in the dashboard's Keywords section as "(not provided)". This mirrors the findings some others as well. So while you won't see a sudden and unexpected collapse in your traffic, the data that you receive in Google Analytics will have been stripped of any context or meaning, other than that it came from Google.

Fortunately, Google's benevolence prevails and the search engine giant will still provide basic aggregate information about the top search terms that provided traffic to the site from the previous 30 days via its Webmaster Tools.

From an end user perspective, is this a win for privacy? Partially, yes. However, there is a small detail in the official blog post that may easily be overlooked. Google will still be passing on the search query for AdWords (paid search results). Those who are willing to pay for your search terms are still going to get them regardless of how much encryption Google throws at its users. Whether this is an attempt at causing dodgy SEOs more pain than being hit by a giant Panda or a way of pushing more people to AdWords is anyone's guess. Regardless of the motive, it will cause headaches for website owners, especially if it is eventually rolled out as the default for users who are not logged in.

According to the company, there are now 200 million active Chrome users. Back in May of this year, the number was at 160 million. In December 2010, the company said it had about 120 million users.

Market share data from StatCounter estimates Chrome's share at about 23.6% for September. Firefox was at 26.8% and IE at 41.7%. In October, it appears that Firefox will hold its market share stable, while Chrome will be climbing to close to 25% and IE may be dropping below 40%.

There is also indication that Chrome will soon be released for Android as early as next week as part of the Ice Cream Sandwich release. Google has not released usage numbers for Chrome OS, which could also be lifting Chrome numbers. However, Google CEO told investors during yesterday's Q2 earnings call that the company is "beginning to see lots of interest and good uptake, both from the businesses and educational institutions."

Although similar free services are already offered by third parties, Google has launched a beta of its new Chrome Remote Desktop, an application that allows any two computers using a Chrome browser -- whether its via Windows, Linux, Mac and Chromebooks -- to connect with each other. Google said the goal of this beta release is to demonstrate the core Chrome Remoting technology and get feedback from users.

"This version enables users to share with or get access to another computer by providing a one-time authentication code," Google states in the release notes. "Access is given only to the specific person the user identifies for one time only, and the sharing session is fully secured."

The free service will come in handy for remote IT helpdesk situations. The helpdesk can use the Chrome Remote Desktop BETA to help another user either in the office or out in the field, while conversely a user can receive help by setting up a sharing session without leaving their desk. This could also be a great tool for managing a family member's computer in-house or remotely when facing technical issues (like I don't understand how to use this Facebook thing).

Establishing a connection is simple. After installing the app and granting Google permission to access the PC (on both ends), users are faced with two options: a button to share the computer, and a link to access a shared computer. When sharing, the app produces three sets of four numbers -- the connecting computer applies this code (without spaces!) in the access code entry field and hits "Connect." The app then verifies the access code and connects the two computers together.

Once established, the remote "administrator" has full control over the client's computer. The entire desktop appears within the administrator's Chrome browser, allowing him/her to gain access to the hard drive, type within a Skype window, change the client's wallpaper and more. There's some lag, but it's seemingly minimal after the first minute.

"Additional use cases such as being able to access your own computer remotely are coming soon," the company said.

Over on the Chromium developer group, Alpha (Jin-Chung) Lam explains how this connection works:

The protocol is something we designed and based on several Google technologies:

1. Bottom layer is p2p connection established by libjingle, this can be udp, tcp or relay through google. 2. We use PseudoTcp implementation in libjingle to provide reliable connection. 3. On top of that is SSL connection. 4. protobuf is used for structured data and framing. 5. Graphics is encoded using VP8.

Google's Chrome browser has the ability to keep itself updated, so if you're a regular user (who also restarts the browser regularly), then you should be updated – even if you weren't aware of it.

In either case, you may be pleased to know that Google has officially released the stable version of Chrome 14.

Google says that this release contains two significant technologies which allow developers to create even more powerful web apps and games:

• The Web Audio API enables developers to add fancy audio effects such as room simulation and spatialization.
• Native Client is an open-source technology which allows C and C++ code to be seamlessly and securely executed inside the browser. Currently, Native Client only supports applications listed in the Chrome Web Store, but we are working to remove this limitation as soon as possible.

Mac users running Chrome will also appreciate some of the Mac OS X Lion-specific additions, such as overlay scrollbars, which appear only while you’re scrolling and natively supported full-screen mode.

Download Chrome 14 here.

I can remember a chat I had about two years ago with a Microsoft employee very well. In that conversation, we discussed the difficulty of enabling a multi-threaded browser and accelerating possible future applications with many-core CPUs and GPUs. It felt like science-fiction back then, but it's become a reality today. The current hardware acceleration and rendering engines, in combination with much more nimble JavaScript abilities, have given us browsers with a hidden potential that is difficult to appreciate today.

HTML5-based web apps are predicted to take advantage of the new horsepower in web browsers, but what we see today are mostly just demos and explorations of a technology platform that is likely to change software as we know it. Among the most dramatic changes may be video gaming, which could soon showcase the potential of HTML5. It is Google that is carrying video gaming into a new age by illustrating, one more time, how the browser interface could replace the traditional OS UI soon. Here are three specific examples of Google's initiative. 

1. NaCl

Two weeks ago, Google announced that it has enabled Native Client (NaCl) in Chromium. This approach allows developers to run native C and C++ code inside a sandboxed environment within Google's browser via Pepper APIs. (The technology is being provided to developers via the NaCl SDK.) At the time, Google said that NaCl supported 2D graphics, stereo audio, as well as URL fetching and local file access. What Google did not say is that it has also been working on NaCl 3D, which is implemented in Chrome with the sole purpose of enabling much more complex and better detailed games within the Chrome browser, and particularly in their Chrome OS.

Seth Ladd, a developer on the Chrome team, already teased the arrival of NaCl, but didn't mention that the feature had already been integrated into Chromium. A quick search through the Chromium revision log reveals that NaCl 3D made its first nightly build appearance last Wednesday in build 98083. It became functional, at least in part, in build 98534, which was released last Friday. Until we see what NaCl can do, its ability is pure speculation. I would not be surprised if we saw big games running within Chrome in the not too distant future, though. On that note, some readers may have also heard of DOS games running in Chrome. NaCl, however, targets much more current and demanding video games.

2. New Game

Google is heavily pushing New Game - a conference for HTML5 game developers. We have seen such game developer rally events before, but they have been mainly online, such as Mozilla Labs Gaming. This event has a different dimension to it. Google says there will be "hundreds" of game developers at the two-day event, with feature panels and tech sessions with developers who are taking their games to the web. There will be a casual focus to this conference, but watch out for some serious games as well as they are expecting pretty impressive browser games, such as Codemasters' Formula Online early in 2012. EA's Rich Hilleman will be keynoting at the conference.

What is noteworthy about New Game is that it is not an event about future technologies for visionaries. New Game will focus on what is possible today with technologies such as WebGL and Canvas2D. This is an event designed to bring developers up to speed on what they can use now, and hopefully motivate them to get started developing immediately.

3. Joystick API

Last week, I noticed an interesting entry on the Webkit developer message board that discussed a Joystick API. The origin of this API is apparently a feature request that was posted on Mozilla's Bugzilla in October 2010 by Ted Mielczarek. Mozilla has started a Wiki about a "JoystickAPI", but it is not clear how far this idea has gone to date. What we know is that Google picked up the idea, threw it in a quick discussion in the Webkit forum, then subsequently submitted it as a discussion topic at W3C.

The idea behind such an API is to enable joysticks and gamepads to interact with a browser. Apple chimed into the discussion and noted that the API could be extended to a much greater range of input devices, such as remote controls and other assistive devices. Perhaps it is just me, but Google isn't wasting any time with such ideas. The Joystick API isn't even at the proposal stage at this time, but there is a general sense that this may only be a matter of time.

The bottom line is we are seeing a general trend toward gaming in the browser window. We see it in Firefox, IE, and especially Chrome, as Google is driving this trend presently in the most aggressive way, and with good reason to do so. If Google wishes to enable gaming in Chrome OS, gamepad support would be a great feature. Playing serious video games in a browser window could become a reality as early as next year.

First released on September 2, 2008, Chrome is credited with fueling the browser speed race to accelerate JavaScript as well as a trend that removed the focus on complex menus and shifted it to more space for web content.

Chrome has not been an instant hit. It took Google over half a year to collect more than 2 percent market share as users took time to adjust to the radically different look of the minimalist interface. However, since the second quarter of 2009 Chrome has been adding market share from its rivals IE and Firefox aggressively and has recently broke the 23 percent mark, according to StatCounter. At the current pace, Google will surpass Firefox in November at the 26 percent mark and could exceed IE's share by mid-2012 at about 32 percent.

As Mozilla challenged Microsoft in 2004 with Firefox and reignited a browser war we thought was long gone, it is Google that has been fueling the battle with a rapid innovation cycle in web browsers that has caused more than one headache for Microsoft and Mozilla. Both have responded to Google's speed and interface challenge and significantly accelerated their browsers. Mozilla recently also adopted Google's rapid release cycle model that unveils a new browser version available every six months. Microsoft has also cut its release cycle in half and is generally believed to be on a 1-year release cycle, instead of the previous 2-year cycle (Microsoft does not officially comment on its release cycle).

While the business model of Chrome as well as the Chrome-based Chrome OS is questioned, Chrome has become a critical component in Google's structure that protects core revenues. Chrome users are strongly tied to the use of Google's search engine and are seen as key in shielding Microsoft's attempts to attract search advertising business to Bing. Google said that there are currently 160 million active Chrome users.