Chrome 155: JPEG XL is back, and post-quantum lands in Web Crypto

Chrome 155 hit stable on 7 October. Two items in it deserve their own discussion: JPEG XL finally displays directly, and Web Crypto starts supporting post-quantum algorithms.

JPEG XL decodes natively

Chrome 155 decodes JPEG XL, with the MIME type image/jxl, so pages can embed it directly. Blink uses the jxl-rs decoder — implemented in Rust, with a focus on memory safety.

JPEG XL is standardised as ISO/IEC 18181. Its feature list is much longer than “smaller images”:

• progressive decoding, so an image can render in stages
• wide colour gamut
• HDR
• high bit depth
• animation

On compression, the widely quoted figures are roughly 11% smaller files and 13% higher quality than AVIF.

For a static site the point is one more format that does not need a JavaScript decoder. Until now, using JPEG XL meant either waiting for browser support or shipping a WASM decoder — and a sizeable WASM decoder is a non-starter on a purely static site. Now the decoder is in the browser and the site just changes a file extension.

I am not switching the whole site today. The reason is practical: a format’s benefit is multiplied by browser coverage, and coverage takes time. But it is worth reserving a slot in the image pipeline’s output formats now.

Post-quantum algorithms in Web Crypto

Chrome 155 adds these to the Web Crypto API:

Algorithm	Purpose
ML-KEM 768 / 1024	key exchange
ML-DSA 44 / 65 / 87	digital signatures
ChaCha20-Poly1305	symmetric encryption
X-Wing	hybrid key encapsulation

ML-KEM is a post-quantum key-exchange scheme and ML-DSA handles digital signatures. Both exist for the prospect of quantum computers breaking current public-key algorithms.

What matters is that this lands in Web Crypto, not only at the TLS layer. The TLS migration is already under way and is negotiated between browser and server; Web Crypto is different, because it means JavaScript on the page can use these algorithms itself, without depending on the underlying handshake.

That capability is useless to most sites. For web apps doing end-to-end encryption, generating signatures client-side, or protecting data that must stay confidential for years, it is a necessary building block.

And CSS

The release notes also mention improvements to CSS list representation and margin control. Changes like these rarely make headlines, but accumulated they are the real story of CSS: no big versions, one property at a time.

Microsoft Edge 155 shipped its corresponding web platform release notes on 8 October, essentially in step.

My take

What these two share is that neither attracts developers with a new API; each turns something you used to route around into something that just works.

JPEG XL went from “needs WASM” to “the browser ships it”, and post-quantum went from “a TLS-layer concern” to “callable from Web Crypto”. For a personal site, the first will get used eventually and the second is useless today — but knowing where it lives is much cheaper than hunting for it when you need it.