New Web Features in May: Styling, Media, and Device Updates

2026-06-03 GIGATAP Team #security

New Web Platform Features in May 2026#

What Changed#

Several features reached stable or beta browsers in May. CSS pseudo-classes for open/closed states are now baseline in Safari 26.5, allowing semantic styling of elements like <details> or pickers. Chrome 148 added name-only container queries, letting developers target containers by name without additional size or type conditions. Firefox 151 supports container style queries for custom properties, enabling styling based on parent properties beyond size. Lazy loading for <video> and <audio> elements became native in Chrome 148, improving page load and bandwidth efficiency. Firefox 151 also rolled out the Document Picture-in-Picture API, allowing always-on-top windows with arbitrary HTML content. Web Serial API support expanded: Firefox 151 on desktop and Chrome 148 on Android now allow secure read/write access to serial devices.

Beta updates preview upcoming features. Chrome 149 beta introduces CSS gap decorations, basic shape functions in CSS, improved programmatic scroll Promises, and WebSocket-compatible back/forward caching (BFCache). Firefox 152 beta brings auto-sizing for form controls.

Why It Matters#

These updates impact performance, UX, and operational security. Lazy-loading media reduces bandwidth and resource consumption. Picture-in-Picture enhancements support persistent interactive overlays. Container queries and style queries increase flexibility in responsive and context-aware designs. Expanded Web Serial API support allows controlled access to peripheral devices, but operational checks remain critical for secure integration.

Beta features give an early view of upcoming web behavior. Testing them before stable release can prevent regressions and surface compatibility issues.

What to Check#

Verify your CSS and container queries behave as expected across updated browsers.
Test lazy-loading behavior for video/audio elements to ensure deferred load does not break UX.
Evaluate Picture-in-Picture overlays for any interactive content that should persist across pages.
Confirm Web Serial API permissions and integration match your security requirements.
Experiment with beta features in isolated environments to identify potential impact on layout, performance, and caching.

What Not to Overclaim#

Browser support details may shift; MDN data may lag behind very recent releases.
Features reaching baseline do not guarantee universal adoption across all user environments.
Beta features are subject to change and should not be relied on in production without testing.

These updates show incremental but meaningful changes to web platform capabilities, especially in styling flexibility, media handling, and device integration.

Crypto clipper adds Tor and worm-like spread to theft model - Microsoft analysis shows crypto clipper evolving into a persistent threat combining clipboard hijacking, Tor-based control, and worm-like propagation.
BCI moves from trial to real use as AI national strategy expands - A brain implant user with ALS signals early real-world BCI use while South Korea accelerates national AI focus and infrastructure alignment.
Postinstall payloads in npm supply chains and Mastra breach - Mastra npm packages were compromised through a postinstall hook that executed during install, exposing CI/CD pipelines and developer environments to remote
Security beyond benchmarks: Microsoft MDASH moves to production - Microsoft’s MDASH moves from benchmark success into live engineering pipelines, embedding AI-driven vulnerability discovery directly into DevSecOps workflo
VHDX Delivery Chain Hides Remcos RAT via JavaScript Stage - A ZIP file uses a VHDX disk image to expose JavaScript after auto-mounting on Windows, leading to Remcos RAT deployment through layered execution.
AI branding as phishing leverage in modern attacks - Threat actors are using AI platform branding as a trust layer on top of standard phishing infrastructure, increasing engagement without changing core attac
AI coding agents need access, not custody - 1Password’s Codex integration points to a cleaner model for agentic development: scoped, just-in-time credentials that stay out of prompts, code, terminals
AI found the bugs. Now comes the patch problem - Anthropic’s Project Glasswing reportedly surfaced thousands of serious vulnerability candidates. The real issue is the widening gap between discovery, vali

Latest articles

Crypto clipper adds Tor and worm-like spread to theft model - Microsoft analysis shows crypto clipper evolving into a persistent threat combining clipboard hijacking, Tor-based control, and worm-like propagation.
US Government AI Inventory Raises Privacy Questions - US agencies list 3,611 AI use cases, exposing gaps in transparency and raising questions about automated decision-making and privacy.
BCI moves from trial to real use as AI national strategy expands - A brain implant user with ALS signals early real-world BCI use while South Korea accelerates national AI focus and infrastructure alignment.
Canada’s Bill C-22 Pushes Encryption Toward Built-In Access Risk - Bill C-22 expands surveillance powers in Canada and introduces mechanisms that could force access paths into encrypted systems, raising structural privacy
Postinstall payloads in npm supply chains and Mastra breach - Mastra npm packages were compromised through a postinstall hook that executed during install, exposing CI/CD pipelines and developer environments to remote
Security beyond benchmarks: Microsoft MDASH moves to production - Microsoft’s MDASH moves from benchmark success into live engineering pipelines, embedding AI-driven vulnerability discovery directly into DevSecOps workflo
VHDX Delivery Chain Hides Remcos RAT via JavaScript Stage - A ZIP file uses a VHDX disk image to expose JavaScript after auto-mounting on Windows, leading to Remcos RAT deployment through layered execution.
Wolf Gallery and the F-Droid packaging bottleneck - Wolf Gallery’s F-Droid request shows how strong local encryption and offline design still depend on packaging work before reaching users through trusted di