![Rachel Andrew](https://web.dev/images/authors/rachelandrew.jpg) Rachel Andrew Technical Writer [GitHub](https://github.com/rachelandrew) [LinkedIn](https://www.linkedin.com/in/rachelandrew) [Mastodon](https://front-end.social/@rachelandrew) [Bluesky](https://bsky.app/profile/rachelandrew.bsky.social) [Homepage](https://rachelandrew.co.uk)

<br />


Published: September 2, 2026

<br />

Unless otherwise noted, the following changes apply to the newest Chrome beta
channel release for Android, ChromeOS, Linux, macOS, and Windows. Learn more
about these features by using the provided links or by visiting
ChromeStatus.com. Chrome 154 is in beta as of September 2, 2026. You can download
the latest beta version from [Google.com](https://www.google.com/chrome/beta/)
for desktop or from Google Play Store on Android.

## CSS and UI

### CSS `scroll-marker-group` modes

The `scroll-marker-group` property is enhanced to support the following modes:

- `links`: The generated `::scroll-marker-group` operates in `links` mode, functioning like a navigation list. This is the default mode if omitted.
- `tabs`: The generated `::scroll-marker-group` operates in `tabs` mode, functioning like a tablist.

Each mode changes the focus order and accessibility behavior of
`::scroll-marker-group` and `::scroll-marker`, following WAI-ARIA patterns:

- **Links mode (default)** : Mimics standard navigation landmarks combined with fragment anchors. The `::scroll-marker-group` takes on the `navigation` role, and `::scroll-marker` elements take on the `link` role. All `::scroll-marker` elements are sequential tab stops. When a link marker is activated, focus moves to the target element.
- **Tabs mode** : Replicates the tabs pattern and serves as the foundation for tabbed carousels. The `::scroll-marker-group` is assigned the `tablist` role, `::scroll-marker` elements act as `tab` roles, and originating elements get the `tabpanel` role. Only the active `::scroll-marker` acts as a tab stop, using arrow keys to navigate between markers. Content from inactive tabs is hidden from the accessibility tree.

### CSS `text-decoration-inset`

The `text-decoration-inset` CSS property controls how far underlines, overlines,
and line-through decorations are inset from or extended beyond text run edges. It
supports `auto`, length, and percentage values, including one-value and two-value
syntax for setting start and end offsets. This lets developers adjust decoration
spacing and create reveal effects with native text decorations instead of
background gradients or additional elements.

### CSS `text-decoration-skip-spaces`

The `text-decoration-skip-spaces` CSS property controls whether text decoration
lines (such as underlines, overlines, and line-throughs) skip over whitespace
characters. This lets you prevent decorations from being drawn under spaces.

### Expose `CSSStyleValue` hierarchy to Worker contexts

The CSS Typed OM specification exposes the `CSSStyleValue` hierarchy to worker
global scopes (`[Exposed=(Window, Worker, PaintWorklet, LayoutWorklet)]`), but
Blink previously only exposed `CSSStyleValue`, `CSSKeywordValue`,
`CSSNumericValue`, `CSSUnitValue`, and `CSSUnparsedValue` to `Window` and
worklets. As a result, these constructors were undefined in `Worker` contexts.
Chrome 154 exposes these constructors in workers, aligning with the specification
and other browser engines.

### `FontFace` `width` attribute and `font-width` descriptor

Exposes the `width` attribute on `FontFace` and the `@font-face` `font-width`
descriptor as aliases for `stretch` and `font-stretch`. This aligns Chromium
with the updated CSS Font Loading and CSS Fonts 4 specifications. You can
inspect or initialize font face widths using `FontFace.width` and CSS `font-width`
interchangeably with `stretch` and `font-stretch`.

### Light dismiss improvements for popovers and dialogs

Improves and simplifies the light dismiss behavior for popovers and dialogs.
Light dismiss is the behavior where clicking outside of a popover or dialog
closes it. These improvements ensure that scrolling gestures on touchscreens and
right-clicks no longer trigger light dismiss.

The browser now uses `click` events to trigger light dismiss instead of a
combination of `pointerdown` and `pointerup` events.

### Responsively-sized `<iframe>`

Lets sites opt into iframes with responsive sizing. This sizes the `<iframe>`
element in the parent document to the iframe document's layout overflow sizing,
avoiding scrolling in the child document.

## JavaScript

### Iterator `includes`

A TC39 proposal that adds an `includes()` method to iterators, letting you check
whether an iterator yields a given value, similar to `Array.prototype.includes()`.

## Web APIs

### Add options bag to `WebSocket` constructor

Adds support for passing an options dictionary (`WebSocketInit`) as the second
argument to the `WebSocket` constructor. The options dictionary supports a
`protocols` option, letting you specify subprotocols (mirroring the existing
`protocols` argument), and serves as an extension point for future options.

Previously, this was written as:

```javascript
const socket = new WebSocket("wss://example.com:8080", "soap");
```

With this change, it can also be written as:

```javascript
const socket = new WebSocket("wss://example.com:8080", { protocols: "soap" });
```

### Algorithm updates in WebCrypto

Adds post-quantum cryptography and a symmetric AEAD algorithm to the set of
cryptographic algorithms available in the Web Cryptography API. This gives you
access to browser-provided implementations of quantum-resistant cryptographic
algorithms standardized by NIST:

- ML-KEM (768, 1024)
- ML-DSA (44, 65, 87)
- ChaCha20-Poly1305
- X-Wing

### CORS enforcement for Background Fetch

The Background Fetch API now enforces Cross-Origin Resource Sharing (CORS).

This update aligns Chromium's implementation with the intent of the
[Background Fetch specification](https://wicg.github.io/background-fetch/). This
ensures that Background Fetch requests are subject to the same security policies,
such as Local Network Access checks, preventing sites from bypassing CORS and
other security policy checks by using Background Fetch instead of regular
[Fetch](https://fetch.spec.whatwg.org/).

### Fetch API: Forward reason from `AbortController` to fetch `Response`

Exposes the abort reason, if one is provided, to the methods of the `Response`
object and its `ReadableStream`, rather than only the `fetch` promise. This aligns
Chrome with the standard, surfacing the developer-supplied abort reason
everywhere intended.

### Local Network Access restrictions for Background Fetch

Background Fetch requests require that the service worker's origin has the
necessary Local Network Access (LNA) permission to send requests to local or
loopback servers.

This aligns Chromium's implementation with the intent of the
[Background Fetch specification](https://wicg.github.io/background-fetch/), which
states that requests go through the Fetch specification and have the same
security policies applied to them. This prevents sites from bypassing LNA checks
by using Background Fetch instead of regular
[Fetch](https://fetch.spec.whatwg.org/).

For enterprises, you can use existing LNA enterprise policies in the same way as
for regular Fetch API requests from service workers:

- [`LocalNetworkAccessRestrictionsTemporaryOptOut`](https://chromeenterprise.google/policies/#LocalNetworkAccessRestrictionsTemporaryOptOut)
- [`LocalNetworkAccessAllowedForUrls`](https://chromeenterprise.google/policies/#LocalNetworkAccessAllowedForUrls)
- [`LoopbackNetworkAllowedForUrls`](https://chromeenterprise.google/policies/#LoopbackNetworkAllowedForUrls)
- [`LocalNetworkAccessPermissionsPolicyDefaultEnabled`](https://chromeenterprise.google/policies/#LocalNetworkAccessPermissionsPolicyDefaultEnabled)
- [`LocalNetworkAccessIpAddressSpaceOverrides`](https://chromeenterprise.google/policies/#LocalNetworkAccessIpAddressSpaceOverrides)

### Renewed HTML insertion and streaming methods

Exposes multiple HTML setting methods that provide a coherent approach for
dynamically inserting markup into an existing document:

- Positional methods (`before()`, `after()`, `append()`, `prepend()`, and `replaceWith()`) that take HTML as an argument, replacing `insertAdjacentHTML()`.
- Streaming methods (`streamAppendHTML()`, `streamAppendHTMLUnsafe()`, and related methods) which return a `WritableStream`.
- Passing `{runScripts}` as part of `SetHTMLUnsafeOptions`, matching `createContextualFragment` behavior.
- Supporting `createParserOptions` in Trusted Types, letting Trusted Types override the scripting mode and sanitizer.

### Secure Payment Confirmation: Locale validation

Updates the Secure Payment Confirmation `locale` data field to return a
`NotSupportedError` `DOMException` if none of the language tags provided in the
field match the language used by the Secure Payment Confirmation dialog. If the
field is not set or is empty, this validation is skipped.

This helps match the language of the data supplied to Secure Payment Confirmation
with the dialog.

### Support `targetAddressSpace` option for WebSockets

Adds support for passing a `targetAddressSpace` option in the `WebSocket`
constructor. This lets you specify that a WebSocket connection to a public
hostname should be treated as going to a "local" or "loopback" destination,
matching existing support in the Fetch API. The main use case is to bypass
mixed content restrictions when connecting to local servers that don't support
HTTPS, because Local Network Access permissions require a secure context.

For example, a public site that connects to a local server can use a hostname
instead of manual configuration of the exact private IP address:

```javascript
const ws = new WebSocket("ws://local-server.example", { targetAddressSpace: "local" });
```

This flags the WebSocket connection as going to a local address, bypassing mixed
content blocking when run in a secure context. The user must grant the site the
local network permission for the WebSocket connection to succeed, and the
hostname must resolve to a local IP address (otherwise it is blocked).

This feature builds on the options dictionary added to the `WebSocket`
constructor.

### WebGPU: WGSL fragment depth

Adds the ability to provide a `less` or `greater` modifier to
`@builtin(frag_depth)` in WGSL.

Using `@builtin(frag_depth)` without modifiers can introduce a performance
penalty by disabling early-Z optimizations on a draw call. The new modifiers allow
explicit setting of the buffer mode, enabling early-Z optimizations to be applied.

### Window Shape API

The Window Shape API lets allowlisted
[Isolated Web Apps](https://chromeos.dev/en/web/isolated-web-apps) on ChromeOS
have a customized window shape. By enabling non-rectangular and non-contiguous
window layouts, developers can implement experiences such as widgets, floating
panels, and overlays that match the appearance of native applications. The
`window.setShape()` method requires the window to be in `unframed` display mode
and requires the `window-management` permission.

Administrators can manage this feature with existing policies for window
management:

- [`DefaultWindowManagementSetting`](https://chromeenterprise.google/policies/#DefaultWindowManagementSetting) configures the default state of window management for all apps.
- [`WindowManagementAllowedForUrls`](https://chromeenterprise.google/policies/#WindowManagementAllowedForUrls) lets IWAs with specified origins enter unframed mode and set custom window shapes without user interaction.
- [`WindowManagementBlockedForUrls`](https://chromeenterprise.google/policies/#WindowManagementBlockedForUrls) blocks the permission for specified origins, forcing Chrome to remove any custom window shapes and fall back to other available display modes.

## New origin trials

In Chrome 154, you can opt into the following new
[origin trials](https://developer.chrome.com/docs/web-platform/origin-trials.md.txt).

### Private Verification Tokens

Private Verification Tokens (PVT) is a low-entropy mechanism that lets websites
transfer the trust that users have established in regular browsing into private
browsing mode, reducing user friction from CAPTCHAs and challenges. PVTs are
issued during a regular browsing session and redeemed in private browsing mode.