← Back to release summary

Cross-site ancestor chain bit for CookiePartitionKey of partitioned cookies

Category
Miscellaneous
Type
New or changed feature
Status
Enabled by default (Chrome 128)
Intent stage
None

Summary

Chrome 128 adds a cross-site ancestor bit to the keying of the partitioned cookie's CookiePartitionKey. This change unifies the partition key with the partition key values used in storage partitioning and adds protection against clickjacking attacks by preventing cross-site embedded frames from having access to the top-level-site's partitioned cookies. If an enterprise experiences any breakage with embedded iframes, they can use the CookiesAllowedForUrls policy or use SameSite=None cookies without the Partitioned attribute and then invoke the Storage Access API (SAA) to ensure that embedded iframes have access to the same cookies as the top level domain.

Motivation

The inclusion of an ancestor chain bit in the CookieParitionKey better aligns it with the existing StoragePartitionKey and helps prevent click-jacking attacks in an A1->B->A2 context

Standards & signals

Explainers: https://github.com/privacycg/CHIPS/issues/40#issuecomment-1743473025

View on chromestatus.com