demo · v136

Cache partition key

Chrome 136 adds an "is-cross-site-main-frame-navigation" bit to the HTTP cache key. Fetch /v136/regexp-escape/ twice from different navigation contexts and watch each one open a separate cache cell.

Cache keys below are a client-side simulation following the spec text. The actual cache cell layout in Chromium is identical in shape.

simulated cache state

resource URL/v136/regexp-escape/
top-level site

simulated cache cells

last fetch verdict

attempted key—
cache—
network round trip—

the code

// Pre-136 cache key (loose):
//   ( top-level-site, frame-site, resource-url )

// 136+ cache key (tight):
//   ( top-level-site, frame-site, is-cross-site-main-frame-navigation, resource-url )

// Implication for cross-site leak attacks:
// An attacker page can no longer probe whether a resource was previously
// fetched by a different top-level page, because that fetch landed in
// a different cache cell.

see also