>No modern browser lets you know the state of a:visited There are loads of ways to extract that information, and the number increases all the time as browsers

>No modern browser lets you know the state of a:visited There are loads of ways to extract that information, and the number increases all the time as browsers get more complex. It's not something browser vendors actually consider to be a bug. They have historically only 'fixed' the trivial methods of getting the visited status because it became an issue that was widely publicised. If they cared at all they would never have implemented features like Shared Array Buffers. This stuff is all sitting in years old open bug reports. Nobody cares. https://bugzilla.mozilla.org/show_bug.cgi?id=884270 https://bugzilla.mozilla.org/show_bug.cgi?id=884270 Link Visitedness can be detected by redraw timing https://bugs.chromium.org/p/chromium/issues/detail?id=508166 https://bugs.chromium.org/p/chromium/issues/detail?id=508166 Security: Chrome provides high-res timers which allow cache side channel attacks Further reading on some of the exciting new timing attacks added to web standards in recent years: https://arxiv.org/pdf/1502.07373v2.pdf https://arxiv.org/pdf/1502.07373v2.pdf The Spy in the Sandbox – Practical Cache Attacks in Javascript https://www.contextis.com/resources/white-papers/pixel-perfect-timing-attacks-with-html5 https://www.contextis.com/resources/white-papers/pixel-perfe... Pixel Perfect Timing Attacks with HTML5 (now fixed because you could use it to steal the contents of any page) http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf ASLR on the Line: Practical Cache Attacks on the MMU