Google has changed the way a key component of its Chrome browser works in order to add additional privacy protections for users.
Known as HTTP Cache or Shared Cache, this “Chrome component” works by storing copies of resources loaded on a web page, such as images, CSS files , and JavaScript files.
The idea is that when a user revisits the same website or visits another website where the same files are used, Chrome will load them from its internal cache, rather than wasting time re-downloading each file again .
This component existed not only in Chrome but in all web browsers since the early days of the internet and served as a bandwidth-saving feature.
In all browsers, the caching system usually works the same way. Each image, CSS, or JS file that is cached is given a caching key, which is usually the URL of the resource.
For example, the storage key for an image would be the image URL itself: https://x.example/doge.png.
When the browser loads a new page, it will look up the key (URL) within the internal cache database and see if it needs to download the image or load it from the cache.
Unfortunately, over the years, advertising companies realized that this feature could be used to track users.
“This mechanism worked well from a performance perspective for a long time,” said Eiji Kitamura, a Google developer.
“However, the time it takes a website to respond to HTTP can reveal that the browser has accessed the same resource in the past, which leaves the browser open to security and privacy.”
These include the following:
- Detecting whether a user has visited a specific website: An adversary can detect a user's browsing history by checking whether the cache has a resource that may be specific to a particular website or group of websites.
- Cross-site search attack: An adversary can detect whether an arbitrary string is found in a user's search results by checking whether a "no search results" image used by a particular website is in the browser's cache.
- Cross-site tracking: The cache can be used to store cookie-like identifiers as a tracking mechanism between websites.
However, with Chrome 86, released earlier this week, Google introduced significant changes to this mechanism.
Known as “cache partitioning,” this feature works by changing how resources are stored in the HTTP cache based on two additional factors. From now on, a resource’s storage key will contain three elements, instead of one:
- The site top-level domain (http://a.example)
- The current resource context (http://c.example)
- Resource URL (https://x.example/doge.png)
