Chrome 87 was released with a fix for NAT.

Released with a NAT patch is Chrome 87. Google has released version 87 of its Chrome browser, a release that comes with a security fix for the NAT Slipstream attack technique and a broader deprecation of the FTP protocol.

Today’s release is available for Windows, Mac, Linux, Chrome OS, Android, and iOS. Users can update to the new version via Chrome’s built-in update utility.

While in previous versions, Google has shipped some changes to Chrome settings and UI elements, almost all the major new Chrome 87 features are aimed at web developers.

In Chrome 87, we have new APIs and updates to Chrome’s built-in Developer Tools, such as:

• Support for the new Cookie Store API;
• New features to allow easier modification of web fonts via CSS;
• A new feature to let websites enumerate all the locally installed fonts
• support for pan, tilt, and zoom controls on webcam streams; and,
• Support for debugging WebAuthn operations via the Chrome DevTools

NAT SLIPSTREAM ATTACK FIXES

Chrome 87 also comes with a fix for a new attack disclosed at the end of October by Samy Kamkar, a famous security researcher and computer hacker.

Named NAT Slipstream, this technique allows attackers to bypass firewalls and make connections to internal networks by tricking users into accessing malicious sites—effectively turning Chrome into a proxy for attackers.

Chrome 87 will be the first browser to block NAT Slipstream attacks by blocking access to ports 5060 and 5061, which the attacker uses to bypass firewalls and network address translation (NAT) schemes.

Similar efforts are also underway at Apple and Mozilla, with fixes planned for future versions of Safari and Firefox.

FTP DEPRECATION

In addition, Google is also following through on its plans to remove FTP support from Chrome. This process started last year, and was initially planned for Chrome 81.

Google delayed its initial deprecation schedule due to the COVID-19 pandemic, fearing that the change might disrupt hospital networks or employees working from home needing to access resources stored on FTP servers.

The FTP deprecation was rescheduled for the fall and began last month with the release of Chrome 86 when Google removed support for FTP links for 1% of Chrome’s user base.

Google will now remove FTP support for half of Chrome’s user base, and the browser maker plans to disable support for FTP links altogether next year, in January, with the release of Chrome 88.

OCCLUSION TRACKING, AND BACK-FORWARD CACHE

Chrome 87 also comes with some performance improvements with the addition of tab throttling, occlusion tracking, and back-forward cache.

The first two features will work together. Occlusion tracking will allow Chrome to know which browser windows and tabs are visible to the user, and then enable the new tab throttling feature to put background tabs to sleep until they’re needed again.

Back-forward caching is an older feature that was first added in Chrome 79 but is hidden under a Chrome flag. With Chrome 87, back-forward caching is now enabled by default for all users. Google says it expects to improve back-forward navigation events by roughly 20% once this new feature is enabled.

---

But we only touched on the major Chrome 87 features. Users who’d like to learn more about the other features added or removed in this new Chrome release can check out the following links for more information:

• Chrome security updates are detailed here.
• Chromium open-source browser changes are detailed here.
• Chrome developer API deprecations and feature removals are listed here.
• Chrome for Android updates are detailed here.
• Chrome for iOS updates is detailed here.
• Changes to the Chrome V8 JavaScript engine are available here.
• Changes to Chrome’s DevTools are listed here.