demo · v143

Connection timing tester

A real-network test: pick a target, fire n concurrent requests, and watch their actual completion times. The histogram tells you whether your browser still has the per-host connection cap signal a v143-vulnerable build would expose, or whether the randomisation has flattened it out.

The attack: in pre-v143 Chrome, a per-host TCP socket pool had a hard cap (usually 6). The (n+1)th simultaneous request to that host blocks until a slot frees, producing a sharp "knee" in completion-time histograms. Cross-site attackers used this to count a victim's parallel network activity. v143 randomises the cap per-profile so the knee blurs out.

Test config

Run the test to see latency distribution.

How to read the chart

  1. Each bar is a request, sorted by completion order.
  2. If you see a sharp jump at request #6 or wherever the per-host cap is — that's your browser's TCP pool limit leaking.
  3. With v143's randomised pool, the second tier of requests won't all wait the same amount; the histogram looks blurry, not stepped.
  4. Note: this is a noisy real-network measurement. Run many trials and look at the median.
// What v143 changed (paraphrased):
const baseLimit = 6;
const limitForThisProfile = baseLimit + crypto.getRandomValues(...)[0] % 4 - 2;
// → some profiles get 4, 5, 6, 7, 8 — the attack distinguishes none of them.

see also