By
Delia
/ Last update
December 10, 2024
Google Chrome 96 entered the stable channel nearly two months ago, and while the current release cadence means we should expect a new version every four weeks, thanks to Christmas, that's not the case with Chrome 97.
Chrome 97 Stable was officially released on January 5. Admittedly, Chrome 97 is not exciting in terms of end-user functionality, but the new version adds some new features for developers.
WebTransport API
One of the most notable things in the Chrome 97 release is the introduction of the WebTransport API with a WebSockets-like interface.
WebTransport is a protocol framework similar to WebRTC data channels, but is primarily intended for clients subject to the network security model to communicate with remote servers using secure, multiplexed transfers. webTransport uses the HTTP/3 protocol for bi-directional transfers. Unlike TCP-based WebSockets, WebTransport relies on UDP-like packets and cancelable streams.
Keybaord MAP API
More notably, the new Chrome 97 release of a keyboard MAP API has caused quite a bit of controversy.
Previously, the keyboard MAP API was not available in iFrame, so some previous web experience users could not use this feature, and applications such as Microsoft Office web applications (e.g. Excel, PowerPoint, and Word) could not use the API to detect keys on keyboard layouts (which vary by region or language).
The Chrome 97 version of the updated API allows web applications within iFrame to use this feature, which means that the keyboard MAP API can obtain the user's keyboard layout and further track and identify the user, thus also sparking a lot of controversy.
In this regard, Google officially explained the implementation of this new keyboard MAP API function.
"getLayoutMap() used in conjunction with code solves the problem of identifying the actual key pressed in keyboard with different layout maps such as English vs French keyboards, but since getLayoutMap() isn't available in all contexts (can't be used inside iframes), Office web apps like Excel, Word, PowerPoint, etc. that show up as embedded experiences in Outlook Web, Teams, etc. and are running in iframes, can't use this API.
Adding keyboard-maps to the allow attribute list solves this problem."
Despite this, many browsers in the industry have issued statements of resistance. Among them, Mozilla, Apple, Brave and other browser developers have all expressed concern about the matter. One of the key arguments these companies are making against browser integration is that websites may use the feature for fingerprinting purposes.
In a response posted on GitHub, Apple stated that "The Keyboard Map API as proposed exposes a high entropy fingerprinting surface. As a result, the WebKit team at Apple is not interested in implementing this feature as currently proposed."
Mozilla added the Keyboard MAP API for Chrome 97 directly to the list of "harmful APIs" and stressed that they will never use these APIs in the Firefox web browser.
Now, Google has announced that it will use the APIs in Chrome 97, but many other Chrome-based browsers have said that they will not support the APIs, or simply disable them, leaving things at an impasse.
Remember that last time, Google stirred up controversy by introducing an idle detection API feature with the Chrome 94 update. This time, Google has introduced the Keyboard MAP API in Chrome 97, which has caused controversy again. It remains to be seen how this will play out.