Site Isolation.

A Chromium security architecture that places documents from different sites into separate operating-system processes so a compromised renderer cannot read cross-site data. It belongs to the Application Security category of cybersecurity.

A Chromium security architecture that places documents from different sites into separate operating-system processes so a compromised renderer cannot read cross-site data.

Site Isolation is a browser security feature, first shipped in Chrome, that ensures each site occupies its own renderer process and that cross-site iframes run in out-of-process iframes. The browser process enforces this boundary, and Cross-Origin Read Blocking (CORB) and Opaque Response Blocking (ORB) prevent sensitive responses from cross-origin sites being delivered into a renderer that should not access them. The design hardens the browser against side-channel attacks such as Spectre and against renderer-RCE exploits: even if attacker code runs inside one renderer, the operating system process boundary protects authenticated data from other sites. Edge, Brave, and other Chromium derivatives inherit the same model.

Defences for Site Isolation typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Strict Site Isolation.