← Back to release summary

Incorporating navigation initiator into the HTTP cache partition key

Category
Security
Type
New or changed feature
Status
Enabled by default (Chrome 136)
Intent stage
None

Summary

Chrome’s HTTP cache keying scheme will be updated to include an “is-cross-site-main-frame-navigation” boolean to mitigate cross-site leak attacks involving top-level navigation. Specifically, this will prevent cross-site attacks in which an attacker can initiate a top-level navigation to a given page and then navigate to a resource known to be loaded by the page in order to infer sensitive information via load timing. This change also improves privacy by preventing a malicious site from using navigations to infer whether a user has visited a given site previously.

Standards & signals

View on chromestatus.com