How Origin Isolation Complements Chromium Site Isolation
This article explores how Origin Isolation works alongside Site Isolation in the Chromium web browser to maintain strong security on memory-constrained devices. While full Site Isolation offers robust protection against side-channel attacks by placing every website in its own process, it consumes too much RAM for many mobile and low-end devices. Origin Isolation bridges this gap by offering a targeted, opt-in approach that isolates only specific, sensitive web origins, thereby maximizing security without exhausting system memory.
The Memory Cost of Full Site Isolation
To protect users from speculative execution attacks like Spectre, Chromium introduced Site Isolation. This feature ensures that pages from different websites are always placed in separate operating system processes. By doing this, malicious code on one site cannot read the memory of another site.
However, creating a new renderer process for every site adds significant memory overhead. On desktop computers with abundant RAM, this trade-off is acceptable. On memory-constrained devices—particularly lower-end Android smartphones—running dozens of separate processes quickly leads to out-of-memory crashes and sluggish performance.
Partial Site Isolation on Constrained Devices
Because full Site Isolation is too heavy for low-memory devices, Chromium uses a scaled-back version on these platforms. Instead of isolating every website by default, Chromium relies on heuristics to isolate only high-risk sites.
For example, Chromium on Android might only trigger process isolation when a user enters a password, uses an OAuth login flow, or visits a known high-value domain like a banking portal. All other general browsing is grouped into shared processes to conserve RAM. While this saves memory, it leaves non-isolated sites more vulnerable and fails to separate subdomains that belong to the same overarching site.
How Origin Isolation Fills the Gap
To understands how Origin Isolation helps, it is important to distinguish between a "site" and an "origin":
- Site: Defined by the registrable domain (e.g.,
example.com). This groupsmail.example.comandgames.example.comtogether. - Origin: Defined strictly by the scheme, hostname,
and port (e.g.,
https://mail.example.com:443).
Origin Isolation allows the browser to isolate a specific subdomain
rather than an entire site. It is primarily driven by the
Origin-Agent-Cluster HTTP response header, which allows web
developers to explicitly tell the browser that a specific origin
contains sensitive data and requires its own dedicated resource pool and
process.
The Complementary Relationship
Origin Isolation complements Chromium's memory-saving strategies in three direct ways:
1. Developer-Driven Opt-In Security
On devices where full Site Isolation is disabled to save RAM, Chromium must guess which sites need protection based on user behavior. Origin Isolation removes the guesswork. If a site doesn't trigger Chromium's password-entry heuristics but still handles sensitive data, the developer can use Origin Isolation to explicitly request a dedicated process. This ensures critical web apps remain protected even when full Site Isolation is turned off.
2. Granular Resource Allocation
Isolating an entire site (all subdomains) can waste memory if only
one subdomain actually handles sensitive information. By using Origin
Isolation, a company can isolate checkout.store.com in its
own secure process while allowing blog.store.com and
www.store.com to share a standard process. Chromium creates
the expensive process barrier only for the exact origin that needs
it.
3. Protection Against Untrusted Subdomains
Even when Site Isolation is active, it groups all subdomains of the same site into the same process if they are browsed together. If a large organization hosts user-generated content on one subdomain and secure account management on another, Site Isolation alone will not separate them. Origin Isolation enforces a strict boundary between the sensitive origin and the rest of the site, providing finer-grained security with minimal process bloat.
By combining heuristic-based Site Isolation with explicit Origin Isolation, Chromium achieves a balanced security model. Memory-constrained devices avoid the heavy performance penalties of universal process creation while still granting strict, process-level protection to the specific web origins that need it most.