← Back to release summary

AppCache: Cross-origin resource size padding

Category
Security
Type
New or changed feature
Status
Enabled by default (Chrome 75)
Intent stage
Evaluate readiness to ship

Summary

For quota accounting purposes, the size of cross-origin AppCache resources will be padded. Cross-origin resources are resources whose origin differs from the manifest's origin. The size padding will be a random number, uniformly distributed between 0 and about 14MB. Quota accounting purposes include the size reported by the Quota API and quota enforcement (an origin's storage API calls are blocked when the origin exceeds its quota).

Motivation

AppCache can be used in conjunction with the Quota API to learn the size of cross-origin resources. This has the same implications as the Cache Storage + Quota API attack described in the HEIST paper in USENIX 2016.

Standards & signals

Docs: https://tom.vg/papers/request_and_conquer_usenix2016.pdf https://tom.vg/2016/08/request-and-conquer/

Explainers: No explainer is available. The description here serves as the announcement for this change.

View on chromestatus.com