What Is Chrome Site Isolation and Why Does It Matter?
In this technical breakdown of site isolation chrome explained, Site Isolation is Chromium’s security architecture introduced in Chrome 67 that enforces dedicated operating system process boundaries between pages from different web sites. By ensuring code from distinct origins runs in separate OS process sandboxes, Site Isolation prevents speculative execution side-channel attacks like Spectre, stops Universal Cross-Site Scripting (UXSS), and isolates renderer compromises so malicious scripts cannot extract cross-site cookies, authentication tokens, or DOM data across open tabs.
Before Site Isolation, web browsers relied primarily on soft software boundaries known as the Same-Origin Policy (SOP). While SOP governed logical access rules within JavaScript runtimes, it frequently allowed pages from different websites to share the same OS-level rendering process. If an attacker exploited a memory corruption vulnerability inside the browser’s render engine, or leveraged hardware speculative execution flaws, they could read secret memory belonging to an entirely unrelated site running in the same process memory space.
Site Isolation fundamentally changed browser security architecture by elevating origin boundaries from logical software checks in V8/Blink to strict hardware-enforced boundaries managed by the operating system kernel. Understanding how Chromium implements Site Isolation—and where its boundaries end—is essential for security architects, developers, and multi-account operators who require robust privacy and profile separation.
The Core Architecture: Process Allocation and Origin Boundaries
To appreciate how Site Isolation works, one must understand how Chromium historically allocated renderer processes. Modern browsers separate functionality into a central Browser Process (which handles UI, network requests, storage, and GPU commands) and multiple worker Renderer Processes (which parse HTML, execute JavaScript in V8, and lay out DOM elements).
From Process-per-Tab to Site-per-Process
In legacy Chromium versions, process allocation relied on simpler models such as Process-per-Tab (where opening a new tab spawned a renderer process) or Process-per-Site-Instance (where connected pages from the same site shared a process). Under these legacy models, embedding an <iframe> from a third-party domain (such as an embedded payment gateway or social widget) resulted in that third-party code executing within the same OS process as the parent document.
Site Isolation replaces these models with a strict Site-per-Process rule. Regardless of whether a web page is loaded in its own top-level tab or embedded deeply inside a multi-layered iframe hierarchy, Chromium places documents from different sites into completely separate OS processes.
Defining “Site” vs. “Origin” in Chromium
In web security terminology, an Origin consists of three components: scheme (protocol), host (domain), and port (e.g., https://sub.example.com:443). However, for process allocation, Site Isolation groups origins into a slightly broader construct called a Site.
- Site Definition: Scheme + Effective Top-Level Domain plus one (eTLD+1).
- Example 1:
https://login.example.comandhttps://dashboard.example.combelong to the same site (https://example.com) and may share a renderer process. - Example 2:
https://example.comandhttps://bank-example.orgbelong to different sites and are guaranteed to run in separate OS renderer processes. - Example 3:
http://example.com(HTTP) andhttps://example.com(HTTPS) have different schemes, so they are treated as distinct sites and isolated into separate processes.
Out-of-Process iframes (OOPIF) Architecture
The technical linchpin of Site Isolation is the Out-of-Process iframe (OOPIF) infrastructure. Before OOPIF, rendering a web page required a contiguous tree of DOM elements residing within a single Blink layout engine instance. OOPIF decoupled frame rendering from process topology.
When Chromium encounters a cross-site <iframe src="https://third-party.com"> inside a document from https://first-party.com:
- The Browser Process intercepts the navigation request and detects an eTLD+1 boundary mismatch.
- The Browser Process spawns (or selects) a dedicated renderer process for
https://third-party.com. - In the parent renderer process, Blink creates a placeholder object called a
RenderFrameProxyinstead of a local frame. - In the target renderer process, Blink creates a
RenderFramecontaining the actual document DOM. - Input events, geometry updates, scrolling, and rendering layers are synchronized across the process boundary using asynchronous Inter-Process Communication (IPC) messages mediated by the main Browser Process.
Key Security Threats Countered by Site Isolation
Site Isolation was not merely an architectural cleanup; it was an urgent security imperative designed to neutralize entire classes of high-severity browser exploits. Implementing strict process boundaries fortifies safe browsing environments against both software and hardware attack vectors.
1. Microarchitectural Side-Channel Attacks (Spectre & Meltdown)
Discovered in early 2018, CPU speculative execution vulnerabilities like Spectre (CVE-2017-5753, CVE-2017-5715) broke software memory boundaries. Spectre allows an attacker writing high-resolution JavaScript timer loops (using SharedArrayBuffer or performance.now()) to measure cache access timings. By tricking CPU branch predictors into speculatively reading memory outside JavaScript array bounds, malicious code running in a renderer process could exfiltrate any data loaded anywhere within that same process memory space.
Without Site Isolation, if you opened a banking site in Tab A and a compromised ad script in Tab B (or inside an iframe), the ad script could use Spectre to read the session token of your banking site directly out of process RAM. Site Isolation eliminates this vector by ensuring that the banking site’s memory and the ad script’s memory reside in completely separate OS process address spaces. The operating system kernel’s virtual memory management unit (MMU) hardware prevents Process B from reading Process A’s memory pages under any speculative condition.
2. Universal Cross-Site Scripting (UXSS) Mitigation
Universal Cross-Site Scripting (UXSS) occurs when a bug in the browser’s C++ code (such as a use-after-free or type confusion vulnerability in Blink’s DOM bindings) allows an attacker to bypass origin checks and execute arbitrary script inside another site’s context. In a non-site-isolated architecture, a single UXSS flaw grants complete access to all DOM trees, cookies, and tokens present in that renderer process.
Under Site Isolation, even if an attacker achieves full remote code execution inside a renderer process via a C++ DOM bug, that process contains only memory pages belonging to the attacker’s site. The process simply does not contain the DOM, cookies, or JavaScript heap of any other site. To compromise other sites, the attacker must chain their renderer exploit with an additional Chrome Browser Process privilege escalation or kernel sandbox escape exploit.
3. Cross-Site Leaks (XS-Leaks) and Data Theft Protection
Site Isolation enforces strict Cross-Origin Read Blocking (CORB) and Cross-Origin Resource Policy (CORP) at the network process layer. Before network responses (such as JSON data, HTML documents, or sensitive API payloads) are delivered to a renderer process, the browser checks whether the renderer is authorized to receive that site’s data.
If an attacker attempts to fetch a confidential JSON response via a <script> or <img> tag from another origin, CORB identifies that the response MIME type is incompatible with the requested tag context. Instead of handing the response body to the renderer, CORB strips the payload and replaces it with an empty response before it ever reaches the renderer process memory.
4. Sandboxing Compromised Graphics & File Renderers
Complex renderers—such as PDF viewers, WebGL shaders, WebGPU pipelines, and custom image decoders—contain millions of lines of performance-critical code vulnerable to memory corruption. By isolating these components into sandboxed, process-constrained environments, Chromium ensures that a corrupted PDF or malicious WebGL shader cannot read cross-site web session data.
Memory Overhead, Performance Tradeoffs, and Optimization
While Site Isolation delivers unprecedented defense-in-depth, enforcing dedicated processes for every unique eTLD+1 comes at a measurable computational cost. Browser engineers had to balance security guarantees against memory consumption and IPC performance overhead.
RAM Consumption Impact
Operating system processes carry fixed baseline overheads. Spawning a new OS process requires allocating kernel data structures, page tables, V8 engine instances, Garbage Collector (GC) heaps, and IPC channels. In desktop environments with dozens of open tabs containing complex third-party embedded scripts (ad networks, analytics, video embeds), Site Isolation increases total browser memory usage by approximately 10% to 15%.
Dynamic Process Capping and Android Adaptations
On mobile platforms like Android, memory constraints are significantly tighter. Chromium handles low-memory environments using adaptive isolation strategies:
- Full Site Isolation: Enforced on desktop operating systems (Windows, macOS, Linux, ChromeOS) where system RAM is abundant.
- Partial / Selective Site Isolation: On Android, Chromium isolates high-risk sites (such as sites where the user enters password credentials or sensitive financial data) while allowing less sensitive cross-origin pages to share processes when device RAM falls below specific thresholds (e.g., devices with under 4GB RAM).
- Process Limits: Chromium maintains a maximum process cap (typically 82 to 128 processes based on available system hardware). When the cap is reached, Chromium reuses existing processes for pages matching the same eTLD+1, ensuring performance does not degrade into OS page swapping.
Run Site Isolation Chrome Explained in the Cloud With Send.win
Send.win’s cloud browser runs your isolated profiles on remote infrastructure — open a clean, fingerprint-isolated session from any device without installing anything:
- Instant cloud sessions – launch an isolated browser in seconds, no local install
- Isolated profiles – separate fingerprint, cookies, and storage per session
- Cloud sync & profile sharing – pick up the same profiles on the desktop app (Windows, macOS, Linux) or share them with your team
- Built-in residential proxies – with automatic timezone and locale matching
You can try it right now: the Send.win demo browser opens an isolated cloud session directly in this browser tab. The 30-day free trial needs no credit card, and paid plans start at $6.99/month billed annually — see pricing.
Compositing and Input Event Latency
Rendering an OOPIF requires coordinating separate compositor threads across different processes. When a user scrolls over a cross-site iframe, touch and wheel events must be passed from the Browser Process to the child renderer, processed, and composited back into the main frame buffer. Chromium engineers developed specialized Viz (Visual Output Service) architecture to render sub-surfaces asynchronously without causing visual stutter or input lag.
Chrome Renderer Process Model Comparison
The table below summarizes how Chromium process models compare across key architectural parameters:
| Process Model | Boundary Level | Spectre Protection | Memory Overhead | Primary Use Case |
|---|---|---|---|---|
| Process-per-Tab | Top-level Tab | ❌ Vulnerable via iframes | Moderate | Legacy Chromium |
| Process-per-Site-Instance | Connected Navigation | ❌ Vulnerable across frames | Low-Moderate | Pre-Chrome 67 Default |
| Site-per-Process (Site Isolation) | eTLD+1 Origin Boundary | ✅ Fully Protected | Higher (+10-15% RAM) | Desktop Chrome Standard |
| Partial / Password-Triggered | Sensitive Origins Only | ⚠️ Partial Protection | Optimized Low RAM | Low-end Android Devices |
Chromium Process Isolation vs. Antidetect Browser Session Isolation
A common point of confusion among web developers, digital marketers, and security practitioners is conflating Chromium’s Site Isolation with Session Isolation provided by specialized antidetect tools. While both concepts involve the word “isolation,” they operate on completely different layers of the computing stack and solve fundamentally distinct problems.
What Chrome Site Isolation Does NOT Do
Chromium’s Site Isolation is strictly an intra-browser process security boundary. It is designed to stop Site A from reading Site B’s memory inside your browser. However, it provides zero protection for account separation, identity isolation, or fingerprint masking:
- Shared Cookie & Storage Jars: If you open two tabs to
https://facebook.cominside standard Chrome, both tabs run in the same profile context. They share identical cookies, LocalStorage, IndexedDB, and SessionStorage—meaning both tabs represent the exact same logged-in user session. - Shared Hardware & Browser Fingerprints: Site Isolation does not alter canvas rendering APIs, WebGL parameters, audio context buffers, device hardware concurrency, or media device IDs. A website probing your hardware will receive identical fingerprint signatures across all tabs and processes. For an in-depth look at how websites analyze these vectors, see our breakdown on how a browser fingerprint explained works in detail.
- Shared IP Address and Network Stack: Standard Chromium routes all rendering processes through a single network context and gateway IP address, making multi-account operation on platforms like Amazon, Google Ads, or Facebook impossible without triggering security bans.
Understanding Antidetect Session Isolation
Where Site Isolation protects memory between websites, session isolation isolates entire browser profile environments from one another. Antidetect browsers achieve true multi-account separation by virtualizing every layer of the browser environment:
- Independent Profile Storage: Every browser profile maintains an isolated directory for cookies, cache, web SQL databases, extensions, and history. Profile A cannot read or influence Profile B.
- Per-Profile Fingerprint Masking: WebGL renderers, Canvas noise algorithms, WebRTC IP handling, font lists, navigator properties, and screen resolutions are customized per profile to ensure distinct digital identities.
- Dedicated Proxy Integration: Network sockets for each profile route traffic through unique residential or mobile proxies, assigning a dedicated IP address and geographic location to every profile environment.
- Architecture Differentiation: For enterprise cloud deployments, organizations often implement enterprise-grade solutions like remote browser isolation to execute entire web browsing contexts on disposable remote server nodes, completely air-gapping local hardware from untrusted web code.
How Send.win Extends Chrome Isolation for Multi-Account Protection
Send.win bridges the gap between Chromium’s enterprise process isolation and advanced identity separation. Built on top of Chromium, Send.win leverages Chromium’s internal Site Isolation architecture for process-level safety while adding robust multi-profile management, proxy routing, and fingerprint spoofing.
Whether operating native desktop profiles or remote cloud instances, Send.win delivers an isolated, secure browsing framework designed for teams, agencies, e-commerce managers, and automation engineers.
1. Dual-Layer Isolation Architecture
Send.win implements a dual-layer security model that protects both system memory and online identity:
- Layer 1 (Process Isolation): Inherits Chromium’s Site-per-Process OOPIF architecture, protecting your local hardware memory from cross-site scripts, Spectre exploits, and malicious renderers.
- Layer 2 (Profile & Identity Isolation): Enforces strict physical isolation between browser profiles. Each profile operates with a separate cookie container, independent LocalStorage, custom HTTP headers, unique WebGL/Canvas noise injectors, and isolated proxy parameters.
2. Flexible Deployment: Sendwin Browser & Cloud Sessions
Send.win adapts to diverse team operational workflows through two powerful deployment modes:
- Sendwin Browser (Native Desktop App): Requires local installation on Windows, macOS, or Linux. It runs profiles locally using native hardware resources while utilizing cloud sync for profile state, proxy configurations, and team credential sharing.
- Cloud Browser Sessions: Requires no local installation and runs browser profiles entirely inside Send.win’s secure cloud infrastructure without installing local client software. Users can launch, control, and monitor profiles from any web browser on any OS.
3. Flexible Pricing Plans & Automation API
Send.win provides clear plans backed by a 30-day free trial with no credit card required:
- 30-Day Free Trial: Full feature access with no credit card required to get started.
- Pro Plan ($9.99/mo standard or $6.99/mo billed annually): Includes 150 isolated profiles, 5GB storage, cloud sync, and full access to the Automation API (Puppeteer, Playwright, Selenium).
- Team Plan ($29.99/mo standard or $20.99/mo billed annually): Designed for teams with 500 isolated profiles, 20GB storage, 16 team member seats, and full Automation API access.
Technical Comparison: Site Isolation vs. Send.win Profile Isolation
The matrix below highlights the core differences between Chromium’s native Site Isolation and Send.win’s multi-profile isolation framework:
| Feature / Vector | Chrome Site Isolation | Send.win Profile Isolation |
|---|---|---|
| Isolation Scope | eTLD+1 websites inside one browser profile | Entire browser environment & identity profiles |
| Primary Threat Target | Spectre, UXSS, memory leak exploits | Account bans, browser fingerprinting, cross-account tracking |
| Cookie & Storage Jars | Shared across all tabs in profile | 100% Isolated per profile directory |
| Browser Fingerprints | Identical hardware signature for all tabs | Customized / Spoofed Canvas, WebGL, Audio & Hardware APIs |
| Network & IP Proxy | Single global network connection | Independent proxy assignment per profile (HTTP/SOCKS5) |
| Automation API | Standard DevTools Protocol (detectable) | Undetectable Automation API (Puppeteer/Playwright/Selenium) |
| Cloud Execution Mode | Requires local desktop Chrome installation | Supports both Sendwin Browser desktop app & Cloud Sessions |
🏆 Send.win Verdict
Chromium’s Site Isolation is a masterclass in process security, successfully safeguarding system RAM against Spectre side-channel attacks and cross-site script leakage. However, process isolation alone cannot protect businesses from multi-account bans or fingerprint tracking. Send.win combines Chromium’s process-level defense with robust profile isolation, proxy integration, and anti-detection capabilities starting at just $6.99/month billed annually.
Try Send.win free today — start your 30-day free trial with no credit card required and manage your browser profiles with ultimate security.
Frequently Asked Questions
What is Chrome Site Isolation in simple terms?
Chrome Site Isolation is a security feature in Google Chrome that runs web pages from different websites in separate operating system processes. This ensures that if a website attempts to run malicious code or exploit memory vulnerabilities, it cannot access the cookies, passwords, or data from other websites open in your browser.
Does Chrome Site Isolation slow down my computer?
Site Isolation increases RAM usage by roughly 10% to 15% because running separate operating system processes requires additional memory for V8 JavaScript engines and browser data structures. However, on modern devices with 8GB or more RAM, performance impact is negligible, and Chrome automatically manages process caps to prevent system slowing.
How does Site Isolation protect against Spectre vulnerabilities?
Spectre exploits CPU speculative execution to read process memory across software boundaries. Because Site Isolation forces documents from different websites into completely separate OS process address spaces, the operating system kernel’s virtual memory management prevents one process from speculatively reading memory pages allocated to another process.
Is Chrome Site Isolation enabled by default?
Yes, Site Isolation has been enabled by default on desktop versions of Google Chrome (Windows, macOS, Linux, and ChromeOS) since Chrome 67. On Android devices, Chrome uses a selective Site Isolation model that isolates high-risk sites or sites where users enter login credentials to balance security with mobile memory limitations.
Does Site Isolation replace the need for an antidetect browser?
No. Site Isolation only isolates memory between different websites within a single browser profile. It does not separate cookies, local storage, browser fingerprints, or IP addresses between multiple accounts on the same site. To safely manage multiple accounts on platforms like Facebook, Google, or Amazon without detection, you need an antidetect browser solution like Send.win.
How does Send.win differ from Google Chrome’s native isolation?
Send.win builds upon Chromium’s security by adding complete profile isolation. While Chrome isolates processes between different sites, Send.win isolates entire browser environments—giving each profile its own cookie storage, custom hardware fingerprint (Canvas, WebGL, Audio), independent proxy connection, and dedicated automation capabilities via Puppeteer, Playwright, or Selenium.
Can I automate Send.win profiles with Puppeteer or Playwright?
Yes. Send.win features a built-in Automation API available on Pro ($9.99/mo standard, $6.99/mo annual) and Team ($29.99/mo standard, $20.99/mo annual) plans. Developers can seamlessly attach Selenium, Puppeteer, or Playwright scripts to manage isolated profiles programmatically with undetectable fingerprint masking.
Does Send.win require a local installation?
Send.win offers flexible deployment options. You can use the native Sendwin Browser desktop app for Windows, macOS, and Linux, or run Cloud Browser Sessions directly in your web browser without installing any local software.