Chrome will deprecate and remove support for the Theora video codec in desktop Chrome due to emerging security risks. Theora's low (and now often incorrect) usage no longer justifies support for most users. Notes: - Zero day attacks against media codecs have spiked. - Usage has fallen below measurable levels in UKM. - The sites we manually inspected before levels dropped off were incorrectly preferring Theora over more modern codecs like VP9. - It's never been supported by Safari or Chrome on Android. - An ogv.js polyfill exists for the sites that still need Theora support. - We are not removing support for ogg containers. Our plan is to begin escalating experiments turning down Theora support in M120. During this time users can reactivate Theora support via chrome://flags/#theora-video-codec if needed. The tentative timeline for this is (assuming everything goes smoothly): - ~Oct 23, 2023: begin 50/50 canary dev experiments. - ~Nov 1-6, 2023: begin 50/50 beta experiments. - ~Dec 6, 2023: begin 1% stable experiments. - ~Jan 8, 2024: begin 50% stable experiments. - ~Jan 16th, 2024: launch at 100%. - ~Feb 2024: remove code and chrome://flag in M123. - ~Mar 2024: Chrome 123 will roll to stable.
A spike in zero day attacks against media formats has caused us to reevaluate our support for legacy codecs. The Theora video codec was first released in 2004 and had its last official release in 2011. While it was one of the first open codecs on the web, usage has now fallen below detectable levels and was never supported by Safari or Chrome for Android. Given the risks to the wider Chrome population, we'll begin to remove support in M120 and finalizing removal in M123. Prior to usage falling below detectable levels, the sites we did manually inspect were incorrectly preferring Theora over more modern codecs like VP9.