v143 · network / connectivity
TCP Socket Pool Limit Randomization
By exploiting limits in the connection pool size on Chrome, knowledge can be gained about cross-site state which would otherwise be inaccessible. Specifically, it’s possible (with some statistical certainty) to evaluate the login state, visited history, or even something more specific like whether gmail has pending messages in the inbox.
concepts
-
Pool Limit Randomization
Animated simulator: pick fixed vs randomised pool, fire many concurrent requests, watch which queue. Tally 100 trials and see how the v143 distribution breaks the attack.
-
XS-leak replay
The xsleaks.dev connection-pool attack reproduced in code: tune the victim's request count, run 100 trials, see attacker accuracy drop from pre-v143 to v143.
-
Connection timing tester
Live network test: fire n concurrent requests at the current origin (or an external host) and chart the completion-time histogram. A sharp knee at request #6 means your build still has a fixed pool; a blurred distribution means the v143 randomisation is active.
-
Fingerprint Resistance Demo
A pre/post randomisation toggle with a canvas histogram chart simulating N concurrent connection timings. Pre-mode shows a sharp cliff at the fixed pool limit; post-mode jitters the limit 24–40 and spreads the cliff into a blurred distribution. An entropy calculator shows bits leaked (pre ~4–5 bits, post <1 bit), with an annotated timing log and a two-column explainer of the XS-Leak mechanism and Chrome 143's fix.
why it shipped
Having a fixed pool of TCP sockets available to an entire profile allows attackers to effectively divinate the amount of network requests done by other tabs/frames, and learn things about them to the extent that any given site can be profiled. For example, if a site does X network requests if it’s logged in and Y if it’s logged out, by saturating the TCP socket pool and watching movement after calling window.open, the state of the other site can be gleaned. This sort of attack is outlined in more detail here: https://xsleaks.dev/docs/attacks/timing-attacks/connection-pool/