v134 · miscellaneous

Bounce Tracking Mitigations on HTTP Cache

Bounce tracking mitigations for the HTTP cache is an extension to existing anti-bounce-tracking behavior. It removes the requirement that a suspected tracking site must have performed storage access in order to activate bounce tracking mitigations.

concepts

  1. Bounce Cache Mitigation

    Bounce tracking mitigations now reach into the HTTP cache. Removes a survival path where cached responses kept tracking state alive.

  2. Cache-only tracker

    The PrivacyCG-documented loophole: a tracker that never touches storage but stashes an ID in the HTTP cache. Toggle behaviour vs. browser version to see when it gets flagged.

  3. Tracker Survival Matrix

    Six bounce-tracker techniques vs. five Chrome versions. Watch which combinations let the tracker survive and which clear it; v134 row is where the cache loophole closes.

  4. Redirect Chain Visualizer

    Trace hop-by-hop what happens at each redirect in a bounce-tracking chain. Pick a scenario — single bounce, multi-hop, SSO, or cache probe — and see where Chrome 134's internal mitigation applies.

why it shipped

It's possible to craft a bounce tracker that does not require cookie access and instead uses only the HTTP cache. As a result, there exists a class of bounce trackers that can systematically evade the initially-proposed bounce tracking mitigations.

references