v136 · css

Partitioning :visited links history

To eliminate user browsing history leaks, anchor elements are styled as :visited only if they have been clicked from this top-level site and frame origin before. On the browser-side, this means that the VisitedLinks hashtable is now partitioned via "triple-keying", or by storing the following for each visited link: <link URL, top-level site, frame origin>. B

concepts

  1. Visited Partitioning

    Visited-link history is partitioned per (link URL, top-level site, frame origin). Closes the >20-year-old :visited sidechannel for cross-site history sniffing.

  2. Same-origin self-link exception

    The carve-out the spec deliberately keeps: a link to a URL on this same origin still renders :visited if any same-origin context saw it. Side-by-side comparison with cross-origin links.

  3. Visited Attack Replay

    Step through the classic history-sniffing attack with a pre-136 and 136+ pane side by side. Seed visits, load an "attacker" page, read :visited; v136 stops the leak at step 3.

  4. Triple-Key Visualizer

    Build the full (link URL, top-level site, frame origin) partition key interactively. Five pre-loaded scenarios show when a link renders as :visited — including the same-origin self-link exception — explaining why an attacker iframe always sees a different key.

why it shipped

Since 2010, the number of side-channel attacks to leak the user’s browsing history from :visited links styling has grown, including user interaction attacks, timing attacks, pixel color attacks, and process-level attacks. While these attack vectors are slowed down by the 2010 mitigations, they are not eliminated; browsers are still actively leaking user browsing history today.

references