Chromium Prerender2: The Safe Replacement for Link Prerender

This article explores Prerender2, the modern page prerendering engine in the Chromium web browser designed to deliver instant page loads. It covers why the legacy <link rel="prerender"> mechanism was deprecated due to resource consumption and security flaws, and explains how Prerender2 safely replaces it using Multiple Page Architecture (MPArch), strict capability controls, and the Speculation Rules API.

Originally, web developers could instruct Chromium to preload and render an entire webpage in the background using the <link rel="prerender" href="..."> HTML tag. While this created instant navigations, the underlying implementation was deeply flawed:

  • Resource Heavy: It worked by creating a hidden background tab, which consumed massive amounts of memory and CPU.
  • Unwanted Side Effects: Because the page was fully executed in the background, prerendered pages would occasionally play audio, trigger permission prompts, or corrupt session data before the user ever clicked the link.
  • Architectural Complexity: Merging a hidden tab into the active tab upon navigation caused severe bugs in browser history, security states, and extension APIs.

Due to these issues, Chromium deprecated the full prerendering behavior of <link rel="prerender"> and downgraded it to "NoState Prefetch," a mechanism that only fetched sub-resources without executing JavaScript or rendering the page.

What is Prerender2?

Prerender2 is Chromium’s ground-up rewrite of true page prerendering. Unlike NoState Prefetch, Prerender2 fully downloads resources, executes JavaScript, and builds the Document Object Model (DOM) and layout in the background. When the user clicks the link to navigate to the prerendered page, the browser instantly swaps the background page into the foreground, resulting in a near-zero millisecond load time.

How Prerender2 Safely Replaces the Old Mechanism

To avoid the pitfalls of the legacy system, Chromium engineers built Prerender2 around strict safety, privacy, and architectural guardrails.

1. Multiple Page Architecture (MPArch)

Instead of spinning up a separate, hidden browser tab to render the page, Prerender2 relies on Chromium's Multiple Page Architecture (MPArch). MPArch allows a single tab container (WebContents) to host a primary visible page alongside one or more invisible background pages. This prevents background pages from interfering with the browser's user interface, tab strip, or navigation history until the user explicitly activates the page.

2. Capability Control and Deferred APIs

The most significant safety improvement in Prerender2 is "Capability Control." To prevent background pages from annoying the user or performing unsafe actions, Chromium restricts what JavaScript APIs a prerendering page can use before it becomes visible.

  • Deferred APIs: Requests for intrusive APIs—such as WebAudio, video autoplay, Geolocation, Notifications, Fullscreen, and WebXR—are paused. The browser delays their execution until the user actually navigates to the page.
  • Canceled Navigations: If a prerendering page attempts an action that cannot be safely deferred—such as triggering a file download, opening a window.print() dialog, or spawning a pop-up window—Chromium immediately aborts and destroys the prerendered page to protect the user.

3. The Speculation Rules API

Prerender2 moves away from the <link rel="prerender"> tag in favor of the modern Speculation Rules API. Instead of relying on simple HTML link tags, developers define prerendering rules using a JSON structure inside a <script type="speculationrules"> tag.

This API gives both the developer and the browser much finer control. Developers can specify eagerness levels (e.g., prerender immediately, or only when the user hovers over a link), and the browser can easily ignore these rules if the user's device is in battery-saver mode or running low on RAM.

4. Privacy and Cross-Origin Safeguards

Prerendering a page across different domains poses a privacy risk, as the destination server could track the user via cookies before the user chooses to visit the site. Prerender2 mitigates this by restricting prerendering primarily to same-origin pages by default.

Cross-origin prerendering is only permitted under strict conditions: either the request must be made without credentials (no cookies or client certificates sent), or the destination server must explicitly opt-in to being prerendered using the Supports-Loading-Mode: credentialed-prerender HTTP header.

5. Accurate Analytics and Lifecycle States

Legacy prerendering broke web analytics because scripts would record a "page view" in the background even if the user never clicked the link. Prerender2 solves this by introducing the document.prerendering boolean property and the prerenderingchange event. Analytics providers can now easily detect if a page is currently in the background and wait until the prerenderingchange event fires (when the user actually views the page) before logging a visit.