Introduces a new set of HTTP request headers, including `Sec-Fetch-Site`, `Sec-Fetch-Mode` and `Sec-Fetch-User`, that sends additional metadata about a request's provenance (is it cross-site, is it triggered from <img>, etc.) to the server to allow it to make security decisions which might mitigate some kinds of attacks based on timing the server's response (xsleaks and others).
Explainers: https://github.com/mikewest/sec-metadata