demo · v136
Visited Attack Replay
Walk the 2010s history-sniff attack one step at a time and watch the v136 partitioning kill it. Each step seeds visits in one context, then checks what an attacker page can read in another. Pre-136 the leak is visible; post-136 the visited state stays scoped to the seeding context.
Scenario:
pre-136 keying (URL only)
136+ keying (URL + top-site + frame-origin)
how the partitioning works
Pre-136 the visited cache was keyed by the destination URL alone — any page on any site could test whether a URL had been visited. v136 adds the top-level site and the embedding frame origin to the key. The same URL now only colours as visited if the user reached it from this exact top-site, in this exact frame.