# Chrome 151 Brings Quantum-Resistant Cryptography to the Web Platform

Page: https://hirantha.me/blog/chrome-151-brings-quantum-resistant-cryptography-to-the-web-platform
Published: 2026-08-02
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: chrome, webcrypto, post-quantum-cryptography, browsers, web-platform

> Chrome 151 lets JavaScript use post-quantum encryption via WebCrypto, adds SPA performance metrics, and drops macOS 12 support.

## Post-quantum cryptography moves into JavaScript

Chrome 151 reached the stable channel on July 28, 2026, and its headline change is aimed squarely at developers who handle cryptography in the browser. Google has started rolling out post-quantum algorithms through the Web Cryptography Application Programming Interface (API), known as WebCrypto, the interface JavaScript uses to encrypt, sign, and verify data client-side. Via an origin trial running from Chrome 151 through Chrome 154 on desktop and Android, sites can now request Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM, in 768 and 1024-bit variants) for key encapsulation, Module-Lattice-Based Digital Signature Algorithm (ML-DSA, in 44, 65, and 87 parameter sets) for digital signatures, the X-Wing hybrid key exchange, and ChaCha20-Poly1305 for symmetric authenticated encryption. A more limited developer trial had already been available since Chrome 150.

This is a distinct step from Chrome's earlier adoption of ML-KEM inside the Transport Layer Security (TLS) handshake, which secures the connection between browser and server but is invisible to page code. Exposing these algorithms through WebCrypto means a web application can itself encrypt or sign data with quantum-resistant algorithms, independent of what the underlying transport is doing. For anyone building applications that need to survive a future in which quantum computers can break today's RSA and elliptic-curve cryptography, that is the more consequential change, even though it will take an origin trial and eventual general availability before it is safe to rely on in production.

ML-KEM and ML-DSA are not Google inventions. Both are algorithms finalized by the US National Institute of Standards and Technology (NIST) as its official post-quantum cryptography standards, derived from the CRYSTALS-Kyber and CRYSTALS-Dilithium submissions to NIST's multi-year standardization competition. X-Wing, the hybrid key exchange also landing in this trial, deliberately combines a post-quantum algorithm with a classical elliptic-curve one, so that a flaw discovered in the newer, less battle-tested post-quantum math does not immediately break the whole exchange. Sites that want to try any of this need to register for the origin trial, which issues a token scoped to a specific domain, rather than something that turns on for every Chrome user automatically.

## Smaller changes with everyday uses

The rest of the release is a grab bag of the kind of incremental additions that quietly save developers time. A new `textStream()` method lands on `Request`, `Response`, and `Blob`, letting code read a byte stream as decoded text directly rather than manually wiring it through `TextDecoderStream`. Two new Performance API entry types, `soft-navigation` and `interaction-contentful-paint`, are aimed at single-page applications (SPAs), where the existing navigation-timing metrics were designed for full page loads and struggle to capture in-app route changes.

Cascading Style Sheets (CSS) gains a `ruby-overhang` property, which controls how ruby annotation text, the small pronunciation guides used above or beside characters in languages like Japanese, is allowed to overhang the base text it annotates, accepting `auto`, `spaces`, or `none`. Accessibility gets a new `aria-actions` attribute for describing complex interactive widgets to assistive technology under the Accessible Rich Internet Applications (ARIA) specification, and the Web Speech API adds an `unspokenPunctuation` boolean for inferring punctuation automatically rather than having it read aloud. Declarative Shadow DOM picks up a `shadowrootslotassignment` attribute for manual slot assignment, and `AnimationEvent` and `TransitionEvent` both gain a read-only `animation` property that returns the `Animation` object that triggered them.

## What's being removed

Chrome 151 is also the first release that drops support for macOS 12; Chrome 150 was the last version to run on it, and anyone still testing on that operating system needs to move to macOS 13 or later. The `FontFaceSet` constructor now throws a `TypeError` when called directly, and its interface definition no longer carries the legacy no-interface-object marker, making it behave as a proper global object rather than a special case. Under the hood, the release carries 370 security fixes, seven of them rated critical, most of them memory-safety issues in the graphics stack.

Chrome 152 is scheduled for stable release on August 25. It will be one of the last releases on Chrome's current four-week cadence: starting with Chrome 153 on September 8, Google is moving to two-week stable releases, so the gap between major version bumps is about to shrink noticeably.

## What it means for developers

If you handle client-side cryptography, the WebCrypto post-quantum origin trial is worth registering for now even if production use is still a way off, since it gives real lead time to test ML-KEM and ML-DSA against your own code before quantum-resistant algorithms become a compliance requirement rather than an option. Everyone building SPAs should look at the new Performance API entry types, since accurately measuring soft navigations has been a persistent gap. And if your continuous integration still targets macOS 12, Chrome 151 is the version where that finally breaks, not a future one.

## Questions

**What's the biggest change in Chrome 151?**
The addition of post-quantum cryptography algorithms, including ML-KEM and ML-DSA, to the Web Cryptography API via an origin trial, letting JavaScript itself use quantum-resistant encryption and signatures.

**Is this the same as Chrome's earlier quantum-resistant TLS support?**
No. Chrome had already added ML-KEM to the TLS handshake that secures the connection to a server; this release instead exposes post-quantum algorithms to page-level JavaScript through WebCrypto.

**Can I use the post-quantum WebCrypto algorithms in production today?**
They're available through an origin trial running from Chrome 151 through Chrome 154, which is meant for testing and feedback rather than production reliance.

**Does Chrome 151 still support macOS 12?**
No. Chrome 150 was the last version to support macOS 12; Chrome 151 requires macOS 13 or later.

**When is the next Chrome release?**
Chrome 152 is scheduled for stable release on August 25, 2026, shortly before Chrome moves from a four-week to a two-week release cadence starting with Chrome 153 on September 8.

## Sources

- [Chrome 151 | Release notes](https://developer.chrome.com/release-notes/151), Chrome for Developers
- [Chrome 151 Stable: What Developers Should Note](https://www.digitalapplied.com/blog/chrome-151-stable-what-devs-should-note), Digital Applied
- [Google Chrome 151 stable version released, adding a Web API that makes it easy to stream text](https://gigazine.net/gsc_news/en/20260729-google-chrome-151), GIGAZINE