v136 · security

Cache Timing Lab

Visualizes how Chrome 136's new "is-cross-site-main-frame-navigation" boolean in the HTTP cache partition key breaks the cross-site timing attack. Configure two origins, pick a navigation scenario, and see whether pre-136 and 136+ keying produce a cache hit or miss for the attacker's resource probe.

Before Chrome 136: an attacker site could initiate a top-level navigation to victim.example, then immediately fetch a resource known to be loaded by that page. If the fetch was fast (cache hit), the attacker learned the user had visited. Chrome 136 adds a boolean to the cache key for cross-site navigations, so the navigation's cache entry is isolated from the attacker's fetch.

Configure scenario

Cache partition key comparison

Click "Analyze cache keys".

Attack walk-through

  1. Attacker navigates user to victim.example (top-level nav). Victim page loads resources, e.g. cdn.example/lib.js.
  2. Attacker page navigates back (same tab), regains script execution context.
  3. Attacker fetches cdn.example/lib.js directly. Pre-136: same cache key → fast = cache hit → user was on victim.
  4. Chrome 136: navigation cache entry has is-cross-site-main-frame-nav=true. Attacker fetch key has false. Different keys → separate entries → timing attack blocked.

Key structure

// Chrome HTTP cache partition key (before Chrome 136) { top_frame_site: "https://victim.example", frame_origin: "https://victim.example", resource_url: "https://cdn.example/lib.js" } // Chrome 136+ adds navigation initiator boolean { top_frame_site: "https://victim.example", frame_origin: "https://victim.example", resource_url: "https://cdn.example/lib.js", is_cross_site_main_frame_nav: false // ← new in Chrome 136 } // Cross-site attacker fetch uses a DIFFERENT key: { top_frame_site: "https://attacker.evil", frame_origin: "https://attacker.evil", resource_url: "https://cdn.example/lib.js", is_cross_site_main_frame_nav: false } // These never collide → timing attack closed