Google company about amplification in Chrome mode , which provides processing of pages from different sites in separate isolated processes. The site-level isolation mode allows you to protect the user from attacks that can be carried out through third-party blocks used on the site, such as iframe inserts, or to block data leakage through the embedding of legitimate blocks (for example, with requests to banking services, which may contain authenticated user) on malicious sites.
When separating handlers in relation to a domain, each process contains data from only one site, which makes it difficult to carry out attacks aimed at intersite data capture. On desktop versions of Chrome handlers in relation to a domain, not a tab, implemented since . In a similar mode has been activated for the Android platform.
To reduce overhead, Android's site isolation mode is enabled only if the page is set to sign in with a password. Chrome remembers the fact of using a password and turns on protection for all further accesses to the site. Protection is also applied immediately to a select list of predefined sites that are popular among mobile device users. The selective activation method and added optimizations allowed us to keep the increase in memory consumption due to an increase in the number of running processes at an average level of 3-5%, instead of 10-13% observed when isolation was activated for all sites.
The new isolation mode is enabled for 99% of Chrome 77 users on Android devices with at least 2GB of RAM (for 1% of users, the mode was left disabled for performance monitoring). You can enable or disable site isolation mode manually through the "chrome://flags/#enable-site-per-process" setting.
In the desktop edition of Chrome, the above site isolation mode is now strengthened to counter attacks aimed at completely compromising the process with the content handler. Improved isolation mode will protect site data from two additional types of threats: data leaks as a result of third-party attacks, such as Specter, and leaks after a complete compromise of the handler process by successfully exploiting vulnerabilities that allow to gain control over the process, but not sufficient to bypass sandbox isolation. Chrome for Android will add this protection at a later date.
The essence of the method is that the control process remembers which site the worker process has access to and prohibits access to other sites, even if the attacker gains control over the process and tries to access the resources of another site. Restrictions cover resources related to authentication (saved passwords and cookies), data loaded directly over the network (filtered and bound to the current site HTML, XML, JSON, PDF and other file types), data in internal storage (localStorage), permissions (issued site allowing access to the microphone, etc.) and messages transmitted via the postMessage and BroadcastChannel APIs. All such resources are tagged to the source site and checked on the control process side to see if they can be pulled from the worker process.
Chrome-related events can also be noted Approvals Enabled in Chrome Feature Support , which makes it possible to form links to individual words or phrases without explicitly specifying tags in the document using the "a name" tag or the "id" property. The syntax of such links is planned to be approved as a web standard, which is still at the stage . The jump mask (essentially a scrolling search is performed) is separated from the regular anchor by a ":~:" sign. For example, when opening the link "https://opennet.ru/51702/#:~:text=Chrome", the page will move to the position with the first mention of the word "Chrome" and this word will be highlighted. Feature added to thread , but requires launching with the "--enable-blink-features=TextFragmentIdentifiers" flag to enable.
Another interesting upcoming change in Chrome the ability to freeze inactive tabs, which allows you to automatically unload from memory tabs that have been in the background for more than 5 minutes and do not perform meaningful actions. The decision on the suitability of a particular tab for freezing is made on the basis of heuristics. The change has been added to the Canary branch that the Chrome 79 release will be based on, and is enabled via the "chrome://flags/#proactive-tab-freeze" flag.
Source: opennet.ru