Google describes the strict site isolation as "Site Isolation is a large change to Chrome's architecture that limits each renderer process to documents from a s

Google describes the strict site isolation as "Site Isolation is a large change to Chrome's architecture that limits each renderer process to documents from a single site" And they developed that largely in response to Spectre. What the paper did was related to the site isolation, and not Spectre, but there was a lineage there...Spectre -> Site Isolation -> This Side Channel attack still works. They showed that while Google said "single site", they really meant "same tld, but hostnames can differ" and "if you have control over a page on b.whatever.com, you can artificially gain side-channel visibility to c.whatever.com" via window.open() or iframes and some memory pressure. Seems fairly significant given that many sites have user generated content on a.example.com and more important/sensitive stuff on b.example.com.