Chromium Network State Partitioning: Cache and Connections

This article explains how the Chromium web browser implements network state partitioning to enhance user privacy and security. By dividing previously global browser resources into isolated silos based on the top-level website a user is visiting, Chromium prevents malicious actors from executing cross-site tracking and side-channel timing attacks. Specifically, this breakdown covers the exact mechanisms Chromium uses to isolate HTTP cache entries via the Network Isolation Key and how it separates network connection pools using the Network Anonymization Key.

The Shift from Global to Partitioned State

Historically, web browsers maintained a single, global pool for network resources. If two different websites requested the same third-party script or image, the browser would reuse the same cached file and the same underlying network connection. While efficient for performance, this shared state allowed attackers to infer a user's browsing history by measuring how quickly a resource loaded or a connection was established.

To eliminate these vulnerabilities, Chromium introduced network state partitioning. This architecture scopes network resources to the "top-level site"—the primary domain shown in the user's address bar—defined by its scheme and effective Top-Level Domain plus one label (eTLD+1).

Isolating the HTTP Cache

Chromium isolates the HTTP cache by appending contextual metadata to the standard resource URL before storing or retrieving files. This is managed through an internal structure called the NetworkIsolationKey (NIK).

Instead of looking up a cached item solely by its URL, Chromium uses a triple-keyed approach consisting of:

  1. The Top-Level Site: The scheme and eTLD+1 of the main page in the browser tab.
  2. The Frame Site: The scheme and eTLD+1 of the specific iframe making the request (if applicable).
  3. The Resource URL: The actual web address of the requested file.

When a webpage requests a resource, the browser constructs the NIK and checks the HTTP cache. If site-a.com embeds an iframe from tracker.com that loads script.js, that script is cached under the specific combination of site-a.com + tracker.com + script.js.

If the user later visits site-b.com, which embeds the exact same tracker.com iframe and script, the resulting NIK will be different because the top-level site has changed. Chromium will treat this as a cache miss and fetch a fresh copy of script.js from the network. This prevents site-b.com from probing the cache to see if the user recently visited site-a.com.

Isolating Connection Pools

Beyond the cache, browsers optimize performance by keeping network connections open in a connection pool for future reuse. This includes TCP sockets, TLS sessions, and QUIC (HTTP/3) connections. Without partitioning, a website could detect if a connection to a third-party server is already "warm" (open and active), revealing that another tab or recent session communicated with that same server.

Chromium isolates these lower-level network layers using the NetworkAnonymizationKey (NAK). The NAK operates similarly to the NIK, binding network sockets to the top-level site.

The NAK generally consists of:

  1. The Top-Level Site: The eTLD+1 of the main frame.
  2. A Cross-Site Bit: A boolean flag indicating whether the request is coming from a subframe that is cross-site relative to the top-level site.

When Chromium's network stack needs to open a socket to a remote server, it queries the connection pool using both the destination server's address and the current tab's NAK.

Because the connection pool is partitioned by the NAK, two different top-level sites cannot share a persistent connection to the same third-party server. Even if site-a.com and site-b.com are open simultaneously and fetching data from the same content delivery network (CDN), Chromium forces the network stack to perform separate DNS lookups, TCP handshakes, and TLS negotiations for each top-level site. This completely isolates the connection state, neutralizing connection-based timing attacks and preventing cross-site tracking via socket reuse.