Chrome 154 for Developers: What Changed and What to Test

Chrome 154 reached stable on September 22, 2026, and most of what’s in it is new capability you can adopt at your own pace. Three things are different: they change behaviour on sites that already exist. Chrome now prompts by default on insecure HTTP connections, popovers and dialogs light-dismiss on a different event, and Background Fetch gets stricter about CORS and local network access. Test those first. Everything else can wait for a quiet sprint.

This post is a triage list, not a feature tour. The source is the official Chrome 154 release notes.

The changes that can bite an existing site

Three Chrome 154 changes alter how existing pages behave: an HTTP connection prompt shown by default, popovers and dialogs that close on click instead of pointer events, and stricter CORS and Local Network Access rules for Background Fetch. If you only have time to test three things this week, test those. The rest of the release adds capability without taking any away.

HTTP connections now prompt by default

Chrome 154 shows a prompt when someone opens an insecure HTTP connection. If your public site is HTTPS-only with HSTS, you’ll never see it. The sites that will: the admin tool on an internal hostname, the staging server somebody set up on port 8080 two years ago, the marketing microsite for an event that ended. Each now greets users with a warning that looks like a security incident.

The fix is boring and cheap. Issue certificates for everything (ACME makes this free), redirect HTTP to HTTPS, and list the hostnames you didn’t know about. We’d do the inventory first. It’s usually the hostnames nobody remembers that cause the support tickets.

Light dismiss moves from pointer events to click

Popovers and dialogs used pointer events to decide when to close on an outside interaction. Chrome 154 uses click events. The practical difference: press the mouse inside a popover, drag, and release outside. Under pointer events that could close the popover mid-selection. Under click, it won’t, because a click needs the press and release on the same target.

That’s a bug fix for users and a possible surprise for you if your tests simulate pointerdown on the backdrop to close a dialog. Switch those to a real click sequence. If you build on popovers, our write-up on CSS anchor positioning for tooltips and popovers covers the layer these sit on.

Background Fetch gets stricter

Two changes, both on the security side. Background Fetch now enforces CORS, and service workers that use it to reach local network addresses need the Local Network Access permission. If you use Background Fetch for large downloads against your own API, confirm the API sends correct CORS headers. If you point it at a LAN device, expect a permission prompt.

New things worth knowing about

WebSocket takes an options bag

The constructor’s second argument can now be a WebSocketInit dictionary, with protocols as the first supported option:

// before: second argument is a string or array
const a = new WebSocket("wss://example.com/chat", ["v2.chat"]);

// Chrome 154+: options bag
const b = new WebSocket("wss://example.com/chat", { protocols: ["v2.chat"] });

The old form still works. The point of the bag is room to grow: future options won’t need positional arguments. A related addition is a targetAddressSpace option for connecting to local or loopback destinations, which affects how mixed-content restrictions apply. If you’re deciding between sockets and the alternatives for a new feature, see server-sent events vs WebSockets.

Iterator includes()

Iterator.prototype.includes() is the TC39 addition that answers “is this value anywhere in the iterator?” without converting to an array first:

function* ids() { yield 1; yield 2; yield 3; }
ids().includes(2); // true

It consumes the iterator up to the match, so don’t call it on one you still need. Our overview of ES2026 iterator helpers and set methods lists what else landed alongside it.

Scroll markers and text decoration

scroll-marker-group gets two modes, links (the default) and tabs. In tabs mode only the active scroll marker is a tab stop and arrow keys move between markers, which is how a tablist is supposed to behave for keyboard users. text-decoration-inset lets you pull underlines and overlines in from the text edges, which finally solves the “underline runs past the last letter” problem on styled links.

Smaller items

• Responsively-sized <iframe> (opt-in), so an embed can match its document’s size without an inner scrollbar.
• FontFace has a width attribute that aliases stretch and font-stretch.
• CSS Typed OM CSSStyleValue is exposed in Workers.
• Fetch abort reasons are forwarded through Response methods and ReadableStream.
• Private Verification Tokens are in an origin trial. Don’t build on them yet.

A one-hour test plan

1. Crawl your HTTP hostnames (DNS records, CI configs, old marketing links) and get certificates for them.
2. Open every popover and dialog in your app in Chrome 154 and check that selecting text and dragging out doesn’t close it.
3. If you use Background Fetch, run one download against production and one against a LAN address.
4. Grep your test suite for pointerdown used to dismiss overlays.
5. Leave the new CSS and JS for later, and add feature detection when you do adopt it.

Our Chrome 152 write-up follows the same approach: read the behaviour changes first, skim the additions.

The one change that will cost real time this week is the HTTP prompt. Check your certificates before your users check them for you.