Similar to Issue 626931.

This repros, albeit somewhat unreliably.

The fix in  Issue 544765  was to ensure that CSP requiring HTTP could not block HTTPS requests (https://www.chromestatus.com/feature/6653486812889088). That change remains effective and you can see by running this repro that no requests are blocked by CSP. Removing the "Step 1" section of the code (which attempts to use CSP), shows the same rate of repro. The repro is thus just using a cache timing attack to try to infer whether the target page happens to be in the cache.

As noted in comment #19 on that issue, "This won't fix variants of the attack that rely on cache timing, but it removes the trivial DOM event that the PoC relied on for 100% accuracy."

Unfortunately, breaking cache timing attacks is not generally practical without severely impairing the performance of the web platform.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot