Google has now submitted the ‘Unrestricted WebUSB’ feature, slated to be released for the Chrome 128 version, in developer trials for testing – allowing trusted web applications to access local USB devices on a computer.
Currently, WebUSB API security restrictions do not allow web applications to access local USB devices with sensitive data over security concerns.
“The WebUSB specification defines a blocklist of vulnerable devices and a table of protected interfaces classes that are blocked from access through WebUSB. With this feature, Isolated Web Apps with permission to access the “usb-unrestricted” Permission Policy feature will be allowed to access blocklisted devices and protected interface classes,” the Chrome Platform status update reads.
Isolated web applications are based on a software architecture approach that creates a self-contained, isolated execution environment for the web application – separating it from other web ecosystems and in extension, external threats.
Some of the USB devices that normally fall under the “vulnerable devices” blocklist and the isolated web applications can now access are used for multi-factor authentication.
Alongside Unrestricted WebUSB, Chrome 128 will also feature more control over attribution filtering, a cross-site ancestor bit to the keying of the partitioned cookie’s CookiePartitionKey, support for the SkipAd media session action, and partitioning “:visited links history” to improve user privacy among others.