demo · v133

Coarsening resolver

Renders are reported at a 4ms granularity to mitigate cross-origin pixel readback attacks. Punch in a hypothetical raw render time and see what number actually reaches your RUM — plus the quantisation error band.

raw value
—
reported (floor)
—
error band
—

live page LCP (this document)

collecting…

where the 4ms comes from

For cross-origin images without a Timing-Allow-Origin header, a precise paint timestamp would let an attacker correlate the time-to-paint with the image bytes (decode cost varies subtly with content). The mitigation is to floor every cross-origin renderTime to a multiple of 4ms before exposing it. RUM still gets a meaningful number — web vitals scoring uses 100ms buckets so 4ms quantisation is below the noise floor — while pixel readback channels are blunted to bits-per-second levels.

const reportedRender = Math.floor(rawRender / 4) * 4;
// error band: [reportedRender, reportedRender + 4)

see also