Chrome’s :visited link partitioning addresses this flaw head-on by storing link history with contextual details—specifically, the link URL, top-level site, and frame origin. Google Chrome’s version 136, released in April 2025, introduces :visited link partitioning, a revolutionary feature that fix a privacy flaw plaguing the web for over two decades. For example, if a user clicked a link to Site B from Site A, a rogue Site Evil could later display that same link and exploit its :visited status to confirm the user’s visit to Site B. “With :visited link partitioning, Chrome eliminates a long-standing privacy risk while preserving the seamless experience users expect. For instance, while browsing Site.Wiki’s page on gold, links to its chrome and brass pages will appear visited if the user accessed them previously, regardless of the referring site. Now, a link only appears as :visited on the site where it was clicked, preventing cross-site leaks. By redefining how browsing history is handled, Chrome not only preserves the utility of visited link styling but also delivers a safer, more private web experience for all. As the first major browser to implement this robust defense, Chrome ensures users’ browsing histories remain shielded from prying eyes, marking a significant leap forward in online security. In the same scenario, Site Evil’s link to Site B would remain unstyled unless the user clicked it there, rendering exploits futile. This partitioning transforms :visited history from a global, vulnerable list into a secure, context-specific record, safeguarding users’ privacy with unprecedented precision. Since the internet’s early days, the CSS :visited selector has enabled websites to style clicked links often turning them purple to enhance navigation. This feature, while user-friendly, created a vulnerability, malicious sites could detect :visited styling to infer which sites a user had visited. This feature allows a website to style links to its own subpages as :visited, even if they were clicked from a different context. This thoughtful design maintains the familiar ease of navigating within a site while upholding stringent security standards.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 14 Apr 2025 06:10:13 +0000