Google Chrome 97 introduces a controversial keyboard API

Google Chrome 97 is expected to be released later today. The new stable version of Google Chrome will be rolled out via the browser’s automatic update system starting today.

The release of Chrome 97 was delayed by weeks due to the holiday period in many parts of the world. Google Chrome 96, the last major stable version in 2021, was released on November 16, 2021.

The new version of Google Chrome launches with a controversial keyboard MAP API. The API could not previously be used by certain web experiences because it could not be used inside iframes. Applications such as Microsoft’s Office web applications could not make use of the API to detect keystrokes in the keyboard layout. Keyboard layout varies by region or language. The change makes the functionality available to web applications that are inside iframes.

Here is the official explanation of why the feature was implemented:

getLayoutMap() used in conjunction with code solves the problem of identifying the actual key pressed on the keyboard with different layout maps, such as English vs French keyboards, but since getLayoutMap() is not available in all contexts (you can’t use inside iframes ), Office web apps like Excel, Word, PowerPoint, etc. that appear as built-in experiences in Outlook Web, Teams, etc. and run in iframes, they cannot use this API.
Adding keymap to the list of allowed attributes solves this problem.

Mozilla, Apple, Brave and other browser developers raised concerns. A key argument companies made against integration into their browsers was that sites could use the fingerprinting functionality.

apple posted an answer on GitHub, stating:

As I noted in person a while back, the keymap API, as proposed, exposes a high-entropy fingerprint surface. This is not acceptable from a privacy perspective. As a result, the WebKit team at Apple is not interested in implementing this feature as currently proposed/specified.

Brave Software, creator of the Brave Browser, had this to say:

Brave inherits from Chrome’s implementation of the Keyboard API which does not provide any functionality to the user (only Chrome and Opera support it, and to my knowledge no sites actually use it). However, the API can be used for fingerprinting.

The WICG draft keyboard map mentions that the API can be used for fingerprinting of:

Users who use unusual ASCII layouts (such as Dvorak or Colemak)
Users using an ASCII layout that does not match the default for the region they are in. For example, a user in the US with an active layout from the UK or France.

Mozilla has finally added the keymap API to the list of harmful APIs that it will not implement in the Firefox web browser.

Google will implement the API in Chrome, but many other browsers, even those based on Chromium, will not implement it or disable the API so that websites cannot use it.

Interested users can check out the other features of Chrome 97 here.

Now you: What is your preferred browser at the moment?

advertising