Microsoft has started 2017 by rolling out Windows 10 builds 15002 and 15007 to end users, giving developers a new UWP architecture for Edge’s multi-process model, click-to-run Flash content and updated support for WebVR.
EdgeHTML, Microsoft's HTML rendering engine, includes a number of updates with the 15002 release. Most notable among them is support for Content Security Policy 2.0. The specification helps developers create a whitelist of sources of trusted content, and only allows the browser to execute or render resources from the trusted sources.
CSP 2.0 diverges from the original level in several important ways, including workers having their own policy, as distinct from the protected resource that loaded them, and controlling a protected resource’s ability to load Workers via child-src rather than script-src.
The release also includes added support for WebVR APIs by default. The experimental JavaScript API provides access to Virtual Reality devices, such as the Oculus Rift, Samsung Gear VR, or Google Cardboard from the browser. Work to complete support for the WebVR APIs continues in the 15007 build.
Other updates include enabling the independent rendering of HTML5 video elements by default, as well as enabing Media over Fetch and XHR over Fetch by default. In addition, the release brings limits to setTimeout() and setInterval() callbacks of once per second for cross-origin iframes when not in view. The change is a move to improve the Edge browser's energy consumption.
New in Microsoft's Edge app itself is a new UWP architecture for Edge’s multi-process model, coming with both a new visual tree and a new input model. According to Microsoft, these changes "will help improve stability and input responsiveness and make the browser UI more resilient to slow or hung web page content."
Edge is also following the lead of Chrome, Safari and Firefox and restricting Flash content. Where Chrome rewrites YouTube Flash embeds and automatically uses HTML5 instead, Edge has extended its click-to-run functionality for Flash.
In the blog post Extending User Control of Flash with Click-to-Run, Crispin Cowan -- senior program manager and security guru -- says:
Sites that support HTML5 will default to a clean HTML5 experience. In these cases, Flash will not even be loaded, improving performance, battery life, and security. For sites that still depend on Flash, users will have the opportunity to decide whether they want Flash to load and run, and this preference can be remembered for subsequent visits.
Also available for developers is support for the new Payment Request API. While this is currently in a preview state, it aims to improve online checkout by storing payment and shipping info in Microsoft Wallet.
For the full list of changes since the last Windows 10 release, check out the Edge Release Notes.