v132 · css

Partitioning :visited links history

To eliminate user browsing history leaks, anchor elements are styled as :visited only if they have been clicked from this top-level site and frame origin before. On the browser-side, this means that the VisitedLinks hashtable is now partitioned via "triple-keying", or by storing the following for each visited link: <link URL, top-level site, frame origin>. B

concepts

  1. Visited Partitioning

    Closes the :visited sidechannel for cross-site history sniffing.

  2. live styling

    Real anchor links on this page rendering :visited — click the “create history” button, reload, and see only same-partition links go purple.

  3. triple-key explorer

    Walk a synthetic history table through four browsing contexts (news, other-site, ads.example iframe, "self" carve-out). See exactly which links light up :visited in each.

  4. history-sniff defense matrix

    Eight classic history-sniff attacks. Six are now dead; two survive because they're inherent to the platform — with notes on why those two are accepted.

why it shipped

Since 2010, the number of side-channel attacks to leak the user’s browsing history from :visited links styling has grown, including user interaction attacks, timing attacks, pixel color attacks, and process-level attacks. While these attack vectors are slowed down by the 2010 mitigations, they are not eliminated; browsers are still actively leaking user browsing history today.

references