Google谷歌浏览器最新版Chrome v80.0.3987.87 正式版发布

谷歌浏览器Google Chrome稳定版迎来v80首个版本发布，详细版本号为v80.0.3987.87，上一个正式版v79.0.3945.130发布于1月17日，时隔19天Google又发布了新版Chrome浏览器，本次升级主要是更新了安全修复和稳定性改进及用户体验。

谷歌浏览器v80正式版主要更新，引入SameSite Cookie可能会破坏网站功能，启用这项功能之后意味着只有从安全链接访问cookies的时候，它们才可以在第三方上下文中使用。

谷歌浏览器v79正式版主要更新，对密码检查工具的内置支持，通过安全浏览API实时将恶意网站列入黑名单，可预防网络钓鱼的常规可用性，禁止加载HTTPS“混合内容”，支持选项卡冻结，Chrome Sync个人资料部分的新界面，以及对后退缓存机制的支持。

谷歌浏览器v78正式版主要更新，带来了多项功能和改进，在Windows 10（版本 1511+）系统上默认启用。还引入了内置的密码检查工具，目的是如果在用户登录期间发现异常就会发出提醒，允许用户在新标签页中添加壁纸，以及安装来自于Chrome Web Store上的主题。

在 Chrome 80 中，Chrome 会将没有声明 SameSite 值的 cookie 默认设置为SameSite=Lax。只有采用SameSite=None; Secure设置的 cookie 可以从外部访问，前提是通过安全连接（即 HTTPS）访问。
这个处理 cookie 文件方式的变化就是本次更新的第一项重大更改，它将改变以往用户隐私被滥用的现象，保证仅能通过 HTTPS 连接访问跨站 cookie。除了直接的安全优势外，明确声明跨站 cookie 还能提高透明度和用户选择。例如，浏览器可以为用户提供管理 cookie 时的精细控制，将仅可以在单个网站访问的 cookie 与可以在多个网站访问的 cookie 分开。其实早在 Chrome 51 中就已首次引入 SamSite Cookie，其设计为用来阻止伪造的跨站点 Cookie 请求。

Chrome 80 引入更安静的消息通知机制就是本次更新的第二项重大更改。简单描述此机制就是，网页请求发送通知权限时，横幅或者弹窗通知会以更安静、更低调的方式呈现，而不再像原来那样在网页中间或顶部/底部占用空间。“更安静的通知”在 PC 设备和移动设备上均可用。不过有趣的是，Chrome 在首次向用户展示该功能时，会在产品内显示一个帮助对话框（这已经不安静了）。

根据 Google 的说法，Chrome 用户现在在所有主要平台上的 HTTPS 上花费了 90％ 以上的浏览时间。但是，那些安全页面加载不安全的 HTTP 子资源却是很常见的。这些子资源中的许多默认情况下都是被阻止的，但有些会作为图像、音频和视频或“混合内容”潜入，混合内容可能会使用户面临风险，比如脚本、iframe 与媒体文件。因此从 Chrome 79 开始，Chrome 已开始逐步阻止所有混合内容，并添加了一个新设置项，用户可以用来取消阻止特定站点上的混合内容。到了最新发布的 Chrome 80，它将所有混合音频和视频资源自动升级为 HTTPS，如果无法通过 HTTPS 加载，浏览器虽然允许加载混合图像，但会将页面标记为“Not Secure”。
最终在 Chrome 81 中会将所有混合图像、音频与视频自动升级为 HTTPS，并且阻止那些无法通过 HTTPS 加载的图像。

从 Chrome 80 开始不再支持 FTP，默认情况下，它对非企业客户端禁用了 FTP 支持。按照计划，到了 Chrome 82 将会删除 FTP 相关代码和资源

• 移除对 FTP 的支持
• 标签分组，每组可配置个性化颜色
• 支持 SVG 格式的图像，进一步降低站点资源占用
• 上线联系人选取和内容索引 API

Chrome稳定版已经更新到v80.0.3987.87安全修复程序和奖励更新包括56项安全修复
[$5000][1034394] High CVE-2020-6381: Integer overflow in JavaScript. Reported by The UK's National Cyber Security Centre (NCSC) on 2019-12-09
[$2000][1031909] High CVE-2020-6382: Type Confusion in JavaScript. Reported by Soyeon Park and Wen Xu from SSLab, Gatech on 2019-12-08
[$500][1020745] High CVE-2019-18197: Multiple vulnerabilities in XML. Reported by BlackBerry Security Incident Response Team on 2019-11-01
[$500][1042700] High CVE-2019-19926: Inappropriate implementation in SQLite. Reported by Richard Lorenz, SAP on 2020-01-16
[$N/A][1035399] High CVE-2020-6385: Insufficient policy enforcement in storage. Reported by Sergei Glazunov of Google Project Zero on 2019-12-1
[$N/A][1038863] High CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities in SQLite. Reported by Richard Lorenz, SAP on 2020-01-03
[$N/A][1042535] High CVE-2020-6387: Out of bounds write in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2020-01-16
[$N/A][1042879] High CVE-2020-6388: Out of bounds memory access in WebAudio. Reported by Sergei Glazunov of Google Project Zero on 2020-01-16
[$N/A][1042933] High CVE-2020-6389: Out of bounds write in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2020-01-16
[$N/A][1045874] High CVE-2020-6390: Out of bounds memory access in streams. Reported by Sergei Glazunov of Google Project Zero on 2020-01-27
[$10000][1017871] Medium CVE-2020-6391: Insufficient validation of untrusted input in Blink. Reported by Michał Bentkowski of Securitum on 2019-10-24
[$5000][1030411] Medium CVE-2020-6392: Insufficient policy enforcement in extensions. Reported by Microsoft Edge Team on 2019-12-03
[$5000][1035058] Medium CVE-2020-6393: Insufficient policy enforcement in Blink. Reported by Mark Amery on 2019-12-17
[$3000][1014371] Medium CVE-2020-6394: Insufficient policy enforcement in Blink. Reported by Phil Freo on 2019-10-15
[$3000][1022855] Medium CVE-2020-6395: Out of bounds read in JavaScript. Reported by Pierre Langlois from Arm on 2019-11-08
[$3000][1035271] Medium CVE-2020-6396: Inappropriate implementation in Skia. Reported by William Luc Ritchie on 2019-12-18
[$2000][1027408] Medium CVE-2020-6397: Incorrect security UI in sharing. Reported by Khalil Zhani on 2019-11-22
[$2000][1032090] Medium CVE-2020-6398: Uninitialized use in PDFium. Reported by pdknsk on 2019-12-09
[$2000][1039869] Medium CVE-2020-6399: Insufficient policy enforcement in AppCache. Reported by Luan Herrera (@lbherrera_) on 2020-01-07
[$1000][1038036] Medium CVE-2020-6400: Inappropriate implementation in CORS. Reported by Takashi Yoneuchi (@y0n3uchy) on 2019-12-27
[$500][1017707] Medium CVE-2020-6401: Insufficient validation of untrusted input in Omnibox. Reported by Tzachy Horesh on 2019-10-24
[$500][1029375] Medium CVE-2020-6402: Insufficient policy enforcement in downloads. Reported by Vladimir Metnew (@vladimir_metnew) on 2019-11-28
[$TBD][1006012] Medium CVE-2020-6403: Incorrect security UI in Omnibox. Reported by Khalil Zhani on 2019-09-19
[$N/A][1024256] Medium CVE-2020-6404: Inappropriate implementation in Blink. Reported by kanchi on 2019-11-13
[$N/A][1042145] Medium CVE-2020-6405: Out of bounds read in SQLite. Reported by Yongheng Chen(Ne0) & Rui Zhong(zr33) on 2020-01-15
[$N/A][1042254] Medium CVE-2020-6406: Use after free in audio. Reported by Sergei Glazunov of Google Project Zero on 2020-01-15
[$N/A][1042578] Medium CVE-2019-19923: Out of bounds memory access in SQLite. Reported by Richard Lorenz, SAP on 2020-01-16
[$1000][1026546] Low CVE-2020-6408: Insufficient policy enforcement in CORS. Reported by Zhong Zhaochen of andsecurity.cn on 2019-11-20
[$1000][1037889] Low CVE-2020-6409: Inappropriate implementation in Omnibox. Reported by Divagar S and Bharathi V from Karya Technologies on 2019-12-26
[$500][881675] Low CVE-2020-6410: Insufficient policy enforcement in navigation. Reported by evi1m0 of Bilibili Security Team on 2018-09-07
[$500][929711] Low CVE-2020-6411: Insufficient validation of untrusted input in Omnibox. Reported by Khalil Zhani on 2019-02-07
[$N/A][968505] Low CVE-2020-6412: Insufficient validation of untrusted input in Omnibox. Reported by Zihan Zheng (@zzh1996) of University of Science and Technology of China on 2019-05-30
[$N/A][1005713] Low CVE-2020-6413: Inappropriate implementation in Blink. Reported by Michał Bentkowski of Securitum on 2019-09-19
[$N/A][1021855] Low CVE-2020-6414: Insufficient policy enforcement in Safe Browsing. Reported by Lijo A.T on 2019-11-06
[$N/A][1029576] Low CVE-2020-6415: Inappropriate implementation in JavaScript. Reported by Avihay Cohen @ SeraphicAlgorithms on 2019-11-30
[$N/A][1031895] Low CVE-2020-6416: Insufficient data validation in streams. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2019-12-08
[$N/A][1033824] Low CVE-2020-6417: Inappropriate implementation in installer. Reported by Renato "Wrath" Moraes and Altieres "FallenHawk" Rohr on 2019-12-13
[1048330] Various fixes from internal audits, fuzzing and other initiatives
SHA1：CAE546BDDEC2F68D0C4C03C57122F7942B9E7989
SHA256：C8C58C5618729A415DED01C4D0B26A1DE1AE8C5DD1DB1A4CA668EB56916DF8C1
http://dl.google.com/release2/chrome/APwT_PugZs0Rf9lGhVkF3QA_80.0.3987.87/80.0.3987.87_chrome_installer.exe
https://dl.google.com/release2/chrome/APwT_PugZs0Rf9lGhVkF3QA_80.0.3987.87/80.0.3987.87_chrome_installer.exe
http://www.google.com/dl/release2/chrome/APwT_PugZs0Rf9lGhVkF3QA_80.0.3987.87/80.0.3987.87_chrome_installer.exe
https://www.google.com/dl/release2/chrome/APwT_PugZs0Rf9lGhVkF3QA_80.0.3987.87/80.0.3987.87_chrome_installer.exe
http://redirector.gvt1.com/edgedl/release2/chrome/APwT_PugZs0Rf9lGhVkF3QA_80.0.3987.87/80.0.3987.87_chrome_installer.exe
https://redirector.gvt1.com/edgedl/release2/chrome/APwT_PugZs0Rf9lGhVkF3QA_80.0.3987.87/80.0.3987.87_chrome_installer.exe
SHA1：A01FF2313B50E1C303EE43758BEF77B896794884
SHA256：5B0C80C632322CDB5FAA41152BC9F0889DAA5DADB8E19C1860C1F8A3C1889C0C
http://dl.google.com/release2/chrome/AIrLSlgCL8Mvuuhy9gpuOek_80.0.3987.87/80.0.3987.87_chrome_installer.exe
https://dl.google.com/release2/chrome/AIrLSlgCL8Mvuuhy9gpuOek_80.0.3987.87/80.0.3987.87_chrome_installer.exe
http://www.google.com/dl/release2/chrome/AIrLSlgCL8Mvuuhy9gpuOek_80.0.3987.87/80.0.3987.87_chrome_installer.exe
https://www.google.com/dl/release2/chrome/AIrLSlgCL8Mvuuhy9gpuOek_80.0.3987.87/80.0.3987.87_chrome_installer.exe
http://redirector.gvt1.com/edgedl/release2/chrome/AIrLSlgCL8Mvuuhy9gpuOek_80.0.3987.87/80.0.3987.87_chrome_installer.exe
https://redirector.gvt1.com/edgedl/release2/chrome/AIrLSlgCL8Mvuuhy9gpuOek_80.0.3987.87/80.0.3987.87_chrome_installer.exe
SHA1：C34561F67FF26353D362DF3EBEA69965FB33FEE4
SHA256：F4E5655D8C026EB0B0796F988C4026DAE6C7E16CB310E2E172DB195A9A93B44A
http://dl.google.com/release2/chrome/AJkrrB9igve6Mz4STD5utjA_80.0.3987.87/GoogleChrome-80.0.3987.87.dmg
https://dl.google.com/release2/chrome/AJkrrB9igve6Mz4STD5utjA_80.0.3987.87/GoogleChrome-80.0.3987.87.dmg
http://www.google.com/dl/release2/chrome/AJkrrB9igve6Mz4STD5utjA_80.0.3987.87/GoogleChrome-80.0.3987.87.dmg
https://www.google.com/dl/release2/chrome/AJkrrB9igve6Mz4STD5utjA_80.0.3987.87/GoogleChrome-80.0.3987.87.dmg
http://redirector.gvt1.com/edgedl/release2/chrome/AJkrrB9igve6Mz4STD5utjA_80.0.3987.87/GoogleChrome-80.0.3987.87.dmg
https://redirector.gvt1.com/edgedl/release2/chrome/AJkrrB9igve6Mz4STD5utjA_80.0.3987.87/GoogleChrome-80.0.3987.87.dmg
https://www.lanzous.com/b138066