v136 · security

Incorporating navigation initiator into the HTTP cache partition key

Chrome’s HTTP cache keying scheme will be updated to include an “is-cross-site-main-frame-navigation” boolean to mitigate cross-site leak attacks involving top-level navigation. Specifically, this will prevent cross-site attacks in which an attacker can initiate a top-level navigation to a given page and then navigate to a resource known to be loaded by the

concepts

  1. Initiator Partitioning

    Navigation initiator now contributes to the HTTP cache partition key. Removes a covert channel where a third party could observe whether a resource was already cached.

  2. Cross-site leak sim

    Walkthrough of the attack the v136 change blocks, with a checkbox to replay under pre-136 vs 136+ keying.

  3. Partition Key Inspector

    Tweak a destination URL, top-level frame, and initiator to see all three real scenarios — direct nav, same-site link, cross-site embed — with pre-136 and 136+ keys side by side.

  4. Cache Timing Lab

    Step through the cross-site cache timing attack that Chrome 136 closes: configure victim and attacker origins, see the pre-136 cache key match (leak) vs the 136+ key mismatch (blocked), and understand how the new is_cross_site_main_frame_nav boolean isolates navigation entries.

why it shipped

Chrome’s HTTP cache keying scheme will be updated to include an “is-cross-site-main-frame-navigation” boolean to mitigate cross-site leak attacks involving top-level navigation. Specifically, this will prevent cross-site attacks in which an attacker can initiate a top-level navigation to a given page and then navigate to a resource known to be loaded by the

references