Why Chromium Restricted High-Resolution Timers

Chromium restricted access to high-resolution timers like performance.now() to protect users from hardware-level side-channel attacks, most notably Spectre. These attacks exploit vulnerabilities in modern processors to read sensitive memory across different websites sharing the same browser process. Because attackers require extremely accurate timers to execute these exploits, Chromium intentionally degraded timer precision by default. To regain access to high-resolution timers, developers must now enable cross-origin isolation, a security state that places the webpage in a dedicated process where sensitive cross-origin data cannot be stolen.

The Threat of Spectre and Side-Channel Attacks

In 2018, security researchers disclosed Spectre, a critical vulnerability affecting almost all modern CPUs. Spectre abuses a hardware feature called speculative execution. To maximize speed, a CPU guesses which instructions it will need to run next and executes them ahead of time. If the guess is wrong, the CPU discards the results.

However, even when the CPU discards these results, the speculative execution leaves behind physical side effects in the processor's cache. By observing what data made it into the CPU cache, a malicious script on a webpage can infer the contents of protected memory. In a web browser, this means a malicious website could potentially read passwords, personal data, or authentication tokens belonging to a completely different website open in another tab or embedded via an iframe.

How High-Resolution Timers Enable the Attack

A malicious script cannot directly read the CPU cache. Instead, it must deduce the cache's contents by measuring how long it takes to access specific memory locations.

  1. Cache Hit: If data is already in the CPU cache, accessing it is extremely fast.
  2. Cache Miss: If data is not in the cache, the CPU must fetch it from the main memory (RAM), which takes significantly longer.

The time difference between a cache hit and a cache miss is measured in nanoseconds. To successfully execute a Spectre attack and read leaked data, an attacker needs a stopwatch capable of measuring these microscopic time differences. In the browser, APIs like performance.now() and SharedArrayBuffer served as this exact stopwatch.

Chromium's Mitigation: Blunting the Timers

Because Spectre is a hardware vulnerability, software makers like Google could not simply patch the CPU. Instead, they had to break the tools attackers used to exploit the vulnerability.

Chromium responded by disabling SharedArrayBuffer by default and significantly reducing the precision of performance.now(). By coarsening the timer's resolution (rounding the time to the nearest 100 microseconds) and adding artificial randomness (jitter), Chromium effectively broke the attacker's stopwatch. Without a high-resolution timer, malicious scripts could no longer tell the difference between a fast cache hit and a slow cache miss, neutralizing the side-channel attack.

Why Cross-Origin Isolation Restores Precision

While reducing timer accuracy protected users, it hindered legitimate web applications. Game engines, video editors, and performance monitoring tools rely on microsecond precision to function correctly.

To give developers these tools back safely, browser vendors introduced Cross-Origin Isolation. A webpage becomes cross-origin isolated when the server sends two specific HTTP headers:

  • Cross-Origin-Opener-Policy: same-origin (COOP)
  • Cross-Origin-Embedder-Policy: require-corp (COEP)

When a webpage implements these headers, it explicitly forbids the loading of untrusted cross-origin resources and severs ties with cross-origin popups. Because the page guarantees it will only interact with resources that have explicitly opted in to being loaded, Chromium can safely place the entire webpage into its own isolated operating system process.

When a webpage is strictly confined to its own process, no sensitive data from other websites exists in that process's memory space. Even if an attacker runs a Spectre attack inside a cross-origin isolated page, there is no foreign data in the memory for them to steal. Because the security risk is eliminated by this architectural boundary, Chromium safely unlocks the full, unthrottled precision of performance.now() and re-enables features like SharedArrayBuffer.