demo · v142

Spectre Side-Channel Mitigation

The 2018-era reason this exists. Chrome already isolates sites (eTLD+1) into their own renderer processes, but two same-site origins — say app.example.com and cdn.example.com — still share one. A Spectre gadget in the lower-trust origin can read the higher-trust origin's memory. Origin-Agent-Cluster: ?1 opts the page into per-origin process isolation, putting them in separate renderers. Pick a deployment, see which origins share a process, and read out crossOriginIsolated for this page.

without origin-keyed isolation

—

with Origin-Agent-Cluster opt-in

—
window.originAgentCluster (this page)
—
window.crossOriginIsolated
—

Chrome 142 made the default behaviour for opt-ins more aggressive and added knobs around how widely the policy propagates. The probe above reads the live values for the page you're on now.

relevant headers

# Sent by the origin that wants its own process
Origin-Agent-Cluster: ?1

# Read in JS
window.originAgentCluster // true if this document is in a per-origin agent cluster

# Pair with COOP+COEP for SharedArrayBuffer
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

see also