demo · v143
Pool Limit Randomization
Choose Chrome's pre-v143 fixed pool ceiling or the v143 randomised range. The simulator fires 20 requests against one origin and animates which ones queue. The "attacker" probe at the bottom shows how predictable a fixed pool is.
click Run trial.
the attacker's inference will show here.
the change
# Pre-v143: hard-coded ceiling per origin (6 sockets).
# Attacker saturates 6, watches when one frees,
# infers victim activity.
#
# v143: ceiling randomised per profile and per origin
# within a small range. Attacker can no longer
# assume "exactly N other requests must be in flight."