Chrome 152 lets a page name the hosts it is allowed to call

Chrome 152 shipped to the stable channel on August 25, 2026, and the entry worth reading first is Connection Allowlists. A server distributes the authorized endpoints through an HTTP response header, and Chrome evaluates every destination against that list before a connection is established. The restriction covers requests started through the Fetch API and other platform APIs, from a document and from a worker alike.

A list the browser enforces

The mechanism is a list rather than a heuristic, which is what makes it worth wiring up. The page declares the exact URL patterns permitted for network communication started in its context, and everything outside the patterns is refused rather than reported after the fact. The header is Connection-Allowlist, and the origin trial documentation covers the configuration and reporting options.

This suggests a use beyond the classic cross-site case. When a page hands untrusted content to a model and then lets it act, the cheapest way out for stolen data is a request to a host the attacker controls, usually with the data sitting in the query string. A destination list the browser checks refuses that request before it leaves the machine, which is a different kind of defense from a classifier reading text and guessing what it will become.

What else arrived in CSS and the DOM

The rest of the release is smaller but immediately usable, and most of it is the kind of thing that removes a workaround rather than enabling something new.

• Relative alpha colors: the alpha() function from CSS Color 5 takes an origin color and changes only its alpha channel.
• CSSPseudoElement extends to ::backdrop, ::scroll-marker and ::view-transition, so a click on a dialog backdrop can be handled without intersection calculations.
• The window-drag property standardizes and renames app-region, with the values move and none, for draggable title-bar regions in an installed desktop web app.
• The autocorrect attribute is exposed globally and reflected on HTMLElement, so autocorrection in editable elements is controlled from markup.
• OpaqueRange represents a live span of text inside a form control value and works with getBoundingClientRect() and the CSS Custom Highlight API.
• Reference Target forwards label for, aria-labelledby, popovertarget and commandfor to an element inside a shadow root, declared with shadowrootreferencetarget or set through ShadowRoot.prototype.referenceTarget.

What is leaving, and one thing to watch

Client-side XSLT is deprecated and planned for removal from the web platform. A deprecation trial opens in Chrome 152, so a site that still transforms XML in the browser gets migration time instead of a broken page. In the same release the Private Aggregation API is removed together with related Privacy Sandbox APIs, which Chrome ties to its decision to keep the current approach to third-party cookies.

The CPU Performance API is the addition to think about before adopting. It reports the performance tier of the device so a page can scale graphical fidelity or heavy computation to it, and it pairs with the Compute Pressure API for live readings. A user can override the reported tier in Chrome settings and an administrator can override it through enterprise policy, which means the value a site receives is a hint and not a measurement.