demo · v136

Cross-site leak sim

A walkthrough of the attack the v136 change blocks: attacker.example wants to know if the user has visited bank.example. Pre-136, attacker can navigate the user to bank, load a resource bank uses, and time the response. With initiator in the cache key, that cache hit does not carry across initiators.

Step the sim with the buttons below.

1. legitimate visit

2. attacker.example tries the leak

cache trace

Run the steps to see the verdict.

the code

// Pre-136 cache key:
//   (resource URL, top-level-site)
// 136+ cache key:
//   (resource URL, top-level-site, is-cross-site-main-frame-navigation)

why this angle

The sibling concept reads cache state with the partition key changed. This concept walks the attack the change blocks, step by step, with a checkbox so you can replay under old vs new rules.

see also