v0.1.1017 Aug 2026·Rendering, Privacy & Shields

AES-GCM: the authenticated encryption the real web actually uses

v0.1.92 added AES in the CTR and CBC modes but deliberately left out GCM, because its authentication tag is a separate primitive and shipping it unverified would have been dishonest. That caution is now retired the right way: GCM is implemented in full - the GHASH multiply in GF(2^128), the counter derivation, and the tag - and verified byte-for-byte, TAG INCLUDED, against the canonical GCM test vectors. GCM is the mode the web runs on (it is what TLS, WebCrypto and JSON Web Encryption use), and the difference from CTR/CBC is that it is AUTHENTICATED: decryption recomputes the tag and refuses a tampered message rather than handing back forged plaintext. The Web API figure moves one point for completing the AES mode set with the one that matters most.

Parity with the reference browser

74overall, as of v0.1.343

Web APIs / DOM surface42

Security architecture66

GPU / graphics acceleration68

DevTools / extensions72

Networking85

Media85

Accessibility85

Real-world site compatibility99

HTML parsing100

CSS parsing + selectors100

Layout: block / flex / grid / tables / writing-modes100

Paint + visual100

JavaScript language100

JavaScript performance (JIT)100

HTML parsing100

What changed 3 changes

Rendering	Added real AES-GCM to crypto.subtle: encrypt and decrypt with the GHASH authentication tag (128/192/256-bit keys, associated data, configurable tag length), hand-written and verified byte-for-byte against the canonical McGrew-Viega / NIST SP 800-38D GCM test vectors - tags included, which is exactly the check the earlier release said it could not make.
Privacy & Shields	It is authenticated encryption, by construction: decrypt recomputes the tag over the associated data and ciphertext and returns nothing on ANY mismatch - a flipped ciphertext byte, a flipped AAD byte, or a flipped tag byte all fail - so a forged message can never be decrypted into plaintext, the property CTR and CBC cannot provide.
Privacy & Shields	GCM is the mode the real web depends on (TLS records, WebCrypto envelopes, JSON Web Encryption), so this is what unblocks on-device authenticated storage and end-to-end features that fall back or break without it - and it runs entirely on your machine with no server.