demo · v135

Per-origin processes shrink the Spectre blast radius

The motivation for tightening process isolation from site to origin: a Spectre-style speculative-execution leak can read any memory in the renderer process. Pre-135, every same-site origin (foo.example.com, bar.example.com) could land in the same process, so a malicious subdomain could leak data from a sibling. Chrome 135 locks each origin to its own process. The demo below shows the new crossOriginIsolated probe plus opting in via the Origin-Agent-Cluster: ?1 response header.

crossOriginIsolated: ? originAgentCluster: ?

site-keyed (pre-135 default)

// foo.example.com and bar.example.com
// share a process. Spectre in either
// origin can read the other's memory.

origin-keyed (135+)

// foo.example.com and bar.example.com
// get separate processes by default.
// Cross-origin reads are blocked at
// the OS level, not just the renderer.

the opt-in

HTTP/1.1 200 OK
Content-Type: text/html
Origin-Agent-Cluster: ?1

// In page JS:
console.log(window.originAgentCluster);   // true
console.log(self.crossOriginIsolated);    // sometimes also true

see also

scenario focus

Select a scenario to focus its rendered example and summary.