v142 · security

Origin-keyed process isolation

Chrome 142 introduces a shift in the process isolation policy from locking processes to a site like `https://example.com` to locking them to a specific origin, such as, `https://foo.example.com`. To further enhance security, Chrome is moving to a more granular process isolation model called **Origin Isolation**. Previously, Chrome used **Site Isolation**, w

concepts

  1. Origin Isolation

    Toggle Origin-Agent-Cluster on each origin and see how Chrome 142 splits them into renderer processes side-by-side with the old site-keyed grouping.

  2. Spectre Side-Channel Mitigation

    The 2018-era reason the feature exists. Side-by-side renderer-process layout with and without Origin-Agent-Cluster: ?1, with the actual window.originAgentCluster and crossOriginIsolated probes for this page.

  3. Process Tree Visualizer

    Five origins (main, three subdomains, one cross-site) in a frame tree. Toggle Origin-Agent-Cluster per origin and compare the legacy site-keyed renderer layout to Chrome 142's origin-keyed split — side-by-side, with the live window.originAgentCluster probe for this page.

  4. Isolation Audit

    Enter a list of origins and see a scored audit: which ones share a process under site-keyed isolation, which are split under origin-keyed, and what Origin-Agent-Cluster header they need to opt in. Live window.originAgentCluster and crossOriginIsolated probes plus a remediation checklist.

why it shipped

Chrome 142 introduces a shift in the process isolation policy from locking processes to a site like `https://example.com` to locking them to a specific origin, such as, `https://foo.example.com`. To further enhance security, Chrome is moving to a more granular process isolation model called **Origin Isolation**. Previously, Chrome used **Site Isolation**, w

references