v135 · security

Origin-keyed process isolation

Chrome 142 introduces a shift in the process isolation policy from locking processes to a site like `https://example.com` to locking them to a specific origin, such as, `https://foo.example.com`. To further enhance security, Chrome is moving to a more granular process isolation model called **Origin Isolation**. Previously, Chrome used **Site Isolation**, w

concepts

  1. Origin Isolation

    The Origin-Agent-Cluster opt-in header demoed against a live read of crossOriginIsolated.

  2. Per-origin processes shrink the Spectre blast radius

    The security argument: side-by-side site-keyed vs origin-keyed memory layout, with a probe of the current page's isolation state.

  3. COOP / COEP recipe builder

    Pick Origin-Agent-Cluster + COOP + COEP combinations and see the resulting header block and verdict: own process? crossOriginIsolated? SharedArrayBuffer? Plus Chrome 135's new default.

  4. Origin Isolation Inspector

    Add a list of origins and compare site-keyed (pre-135) vs origin-keyed (Chrome 135) process grouping. See exactly which subdomains would share a process under site isolation and how origin isolation separates them. Presets include subdomain, cross-site, banking, and mixed real-world scenarios.

why it shipped

Chrome 142 introduces a shift in the process isolation policy from locking processes to a site like `https://example.com` to locking them to a specific origin, such as, `https://foo.example.com`. To further enhance security, Chrome is moving to a more granular process isolation model called **Origin Isolation**. Previously, Chrome used **Site Isolation**, w

references