iiinova — where your digital self keeps evolving

Responsive iframes in Chrome 154 | Blog | Chrome for Developers

For now this works only in Chrome and isn't Baseline yet. Also watch out for layout shifts that can hurt CLS. With @supports, you can keep your current approach as a fallback and adopt this step by step. Details and a demo: developer.chrome.com/blog/respons...

developer.chrome.com

Chrome 154 adds support for responsively-sized iframes, letting an iframe size itself based on the intrinsic size of its embedded document.

100

Now the embedding page sets frame-sizing: content-height in CSS, and the embedded document opts in with <meta name="responsive-embedded-sizing">. For cross-origin embeds, allow-origins controls which sites can use the content size.

101

Until now, embeds with changing heights, like comment widgets or social posts, meant measuring the content, sending the size to the parent page with postMessage(), and resizing the iframe by hand.

100

Philip Walton @philipwalton.com · 15/09/2026

"Responsive iframes" are now available in Chrome 154, letting an iframe size itself to fit the content of the document it embeds.

241

Reposted by Eiji Kitamura / えーじ

If you've ever tried using a new web API in TypeScript, you've probably hit this problem: An API exists. It works in your browser. But TypeScript has no types for it. The reason is a limitation that TS unfortunately applies to its built-in libs. BUT, I've created a relatively simple fix 👇

3419

Please note that support is currently limited to document contexts—with Worker support and constraint inheritance for cross-origin iframes (Embedded Enforcement) planned in future updates—and the feature is not yet part of Baseline.

100

Beyond blocking open redirects and WebRTC connections by default to prevent bypasses, it also supports a report-only mode (`Connection-Allowlist-Report-Only`) to safely monitor violations in production without impacting existing functionality.

100

By using the `Connection-Allowlist` HTTP response header with standard `URLPattern` syntax, you can centrally control everything from `fetch()` and subresource requests to `WebSocket`, `WebTransport`, DNS prefetching, and navigations.

100

However, existing CSP directives split rules by resource type (`img-src`, `font-src`, etc.)—meaning a single permissive setting allows data to be leaked disguised as image or font requests—and CSP fails to cover non-Fetch communication channels such as DNS prefetching and WebRTC.

100

As web apps increasingly execute dynamic generative AI code and complex third-party scripts, preventing unauthorized data exfiltration has become critical even if unintended code runs.

110

"Connection Allowlists," a browser-level security mechanism that blocks any outbound network communication not matching your permitted URL patterns, is now available starting in Chrome 152.

111

Note that these metrics are not part of Core Web Vitals and do not have specific thresholds like Good or Poor. They are currently positioned as experimental to gather community feedback, with data availability expanding gradually over the coming month.

100

This enables both publishers and advertisers to evaluate the balance between page quality and ad effectiveness based on objective data.

100

These metrics support measuring average ads in the viewport (Ad Count), viewport area fraction (Ad Density), and resource overhead (Ad Weight) encompassing both network usage in bytes and CPU processing time consumed by ads.

100

Eiji Kitamura / えーじ @agektmr.com · 15/09/2026

Overwhelming ads on the web significantly degrade user experience, but objectively measuring the actual load users face in the field has historically been difficult. To address this, four new metrics that visualize real-user ad experiences have been introduced to the Chrome User Experience Report.

110

Built on the FIDO standard CXF (Credential Exchange Format) to ensure cross-provider interoperability, it is already supported by Google Password Manager, 1Password, Bitwarden, and Dashlane (Android 8.0+). Official announcement: blog.google/products-and...

blog.google

Switching password managers is easy and safe on Android

A new Android feature lets you securely transfer passwords and passkeys between password managers.

071

Eiji Kitamura / えーじ @agektmr.com · 15/09/2026

Importing and exporting passkeys and passwords is now available on Android. This resolves the security risks of legacy plaintext CSV exports and the inability to migrate passkeys across providers through secure, OS-level peer-to-peer data transfer.

1125

Eiji Kitamura / えーじ @agektmr.com · 13/09/2026

帰国と同時に荷物が戻ってきました。同じツアーの他の人のものが見つかったと聞いてたんだけど、実際はうちのものだったというオチ。複雑な気持ちだ。というわけで無事帰国しました。今回はイベント盛りだくさんの旅だったなあ…

0100

バゲッジ未だ見つからず。明日帰国です…

150

ありがとうございます！

010

Just saw a doctor. Turned out it wasn't Achilles tendon, just a muscle. Much better than what I was worrying about, and it cures faster!

010

病院で診てもらいました。アキレス腱断裂というのは間違っていて、ふくらはぎの筋肉損傷ということでした。ギプスも覚悟してたけど、しなくて良いみたい。松葉杖と痛み止めをもらったので、これで旅行は続けられそう。

1120

Yeah, I know a few people are there including Natalia. I was thinking of stopping by but don't know yet. My achiless tendon is raptured last night and I'm seeing a doctor now😢

101

2台目のUberで無事病院に到着。どうなるかドキドキ

130

Not for threejs conf though, unfortunately. It's a personal trip.

110

病院行くのにUber頼んだけど、指定位置よりちょっと離れたところに着いて「こっちに来い」というので「怪我してるからお前が来い」と言ったらキャンセルされた。ひどい…

120

明日病院でギプスはめてもらえば少しはできるかなという感じです。明後日夕方帰国なので、それまでに少しでも楽しめれば。

010

痛くはないのだけど色々面倒です…

100

旅行中にも関わらずアキレス腱切れた

3120