v136 · css

Triple-Key Visualizer

Chrome 136 partitions the :visited link hashtable by a triple key: (link URL, top-level site, frame origin). This visualizer builds the key for any combination of inputs and walks through five real-world scenarios to show exactly when a link renders as visited vs unvisited.

A link is styled :visited only if you have clicked it from this exact (top-level site, frame origin) combination. The same URL visited from a different site shows as unvisited — closing the cross-site history sniffing attack that existed since 2000.

Build a triple key

Partition key

Triple key = ⟨ link URL, top-level site, frame origin ⟩
link URL
—
+
top-level site
—
+
frame origin
—

Scenarios for this link URL

Live :visited probe

These links use the current page's triple-key context. If you've clicked them before from this page, they appear visited (browser-default purple). Cross-site sniffers can't read this via JS.

chromestatus.com entry Above: external link — visited only if you clicked it from this origin

How the key protects you

// Pre-Chrome 136: single key = just the URL // VisitedLinks hashtable entry: sha256(link_url + salt) // → Any page could fetch the URL, measure timing, learn you visited it. // Chrome 136: triple key // VisitedLinks entry: sha256(link_url + top_level_site + frame_origin + salt) // // Scenario A — you visit https://docs.example.com/guide from mysite.example // key: ⟨"https://docs.example.com/guide", "mysite.example", "https://mysite.example"⟩ // → :visited on mysite.example ✓ // // Scenario B — attacker.evil loads same URL in an iframe and checks :visited // key: ⟨"https://docs.example.com/guide", "attacker.evil", "https://attacker.evil"⟩ // → DIFFERENT key → not :visited → attack fails ✓ // // Same-origin self-link exception: if the link points to the same origin as // the page, it can still show :visited. That's the carve-out in the spec.