Can Websites See Your Browsing History? How CSS Sniffing Leaks Visited Links

By White Dawn

▲ Malicious websites historically abused the CSS :visited pseudo-class to extract thousands of visited URLs from your local history database in milliseconds.

🎯 Executive Summary: The Illusion of History Isolation

When you navigate between different websites on the internet, you assume that your chronological timeline belongs entirely to you. If you visit a personal finance portal, read a sensitive medical diagnosis page, or search for specialized legal services, you expect that the next unrelated website you open cannot peer backward into your digital footsteps. The Same-Origin Policy (SOP) was ostensibly engineered to guarantee that Domain B can never read the contents, cookies, or activity records of Domain A.

Yet, for over a decade, a devastating architectural blind spot allowed any arbitrary website on earth to silently audit your entire web history: CSS History Sniffing and Cache Timing Side-Channel Probing. By weaponizing the browser’s native :visited styling selector alongside high-resolution hardware timers, malicious web developers could check thousands of URLs per second. They could instantly determine whether you had visited specific banking portals, political forums, adult websites, or corporate competitors—without downloading a single executable file onto your computer.

This authoritative 2,800-word architectural guide dismantles the low-level mechanics of browser history extraction. We investigate how styling engines were turned into side-channel leakage tools, examine why modern browsers intentionally lie to JavaScript via DOM deception APIs, analyze how HTTP/2 and HTTP/3 connection-reuse timing leaks past navigation, and outline actionable protocols to fortify your browser against history surveillance.

1. The Origin of the Flaw: The CSS :visited Pseudo-Class

To understand how web pages stole browser history, one must look back at one of the earliest aesthetic features of the web: the styling of visited hyperlinks. Since the birth of HTML, browsers provided visual differentiation so that human readers could identify which links they had already explored. In Cascading Style Sheets (CSS), this behavior is governed by the :visited pseudo-class.

Under normal operation, a web author could define distinct styles for untouched and visited links:

a { color: blue; }
a:visited { color: purple; }

The catastrophic security oversight lay in how JavaScript interacted with the Document Object Model (DOM). In early browser implementations, JavaScript had full, unrestricted read access to computed styles via the standard window.getComputedStyle() API.

This meant a malicious script could execute an automated loop in less than 50 milliseconds:

1. The script silently injects an invisible <a> element into the page pointing to https://mybank.example/account.
2. The browser consults its local SQLite history database to check if the user has navigated to that exact URL previously.
3. If the URL exists in the user's history, the browser applies the :visited style rule (e.g., turning the text color to purple).
4. The JavaScript script executes window.getComputedStyle(link).color. If the returned value is purple, the script instantly knows the user has an active account at that specific bank!

By cycling through pre-compiled dictionaries containing hundreds of thousands of popular URLs, an attacker could profile a visitor's political views, medical concerns, financial affiliations, and geographic location within two seconds of page load.

Post-Login Threat Alert

Can malware steal your active session tokens after you visit a site?

While CSS sniffing tracks where you have been, modern infostealers weaponize Windows DPAPI to extract raw cookies and bypass 2FA in seconds.

👉 Read How Infostealers Bypass 2FA & Chrome's DBSC Shield →

2. The Browser Defense: Intentional DOM Deception

To eliminate CSS history sniffing without breaking the visual utility of visited links, browser vendors engineered one of the most unconventional defensive strategies in computer science: systematic architectural deception, formalized under the IETF Transport and Web Application Security Standards.

In modern Chromium builds, the browser deliberately lies to JavaScript:

• Restricted Styling Properties: The CSS :visited selector is strictly restricted. Web designers can only modify four specific color properties: color, background-color, border-color, and outline-color. Layout-altering properties like display, padding, width, or background-image are completely forbidden. This prevents attackers from triggering network image requests when a link becomes visited.
• The ComputedStyle Lie: When a JavaScript script calls getComputedStyle() on a visited link, Chrome explicitly returns the styling of an unvisited link! Even though your physical monitor renders the text in purple for human eyes, the JavaScript engine reports that the element is blue. The script is fed false information, blinding programmatic sniffing loops.
• Alpha Channel Clamping: Because attackers could blend semi-transparent colors to observe background shifts, Chrome forces the alpha component of :visited colors to match the unvisited baseline, preventing pixel luminance measurements.

▲ Modern browsers isolate the visual rendering pipeline from JavaScript execution to ensure computed styles cannot leak history state.

3. The Evolution to Side-Channels: Cache Timing and Resource Probing

While CSS deception successfully halted direct DOM inspection, sophisticated surveillance actors adapted by shifting their focus to hardware-level timing side-channels and browser disk caches.

A. HTTP Cache Timing Probes

When you visit a website, Chrome downloads static assets (such as the company's SVG logo) and caches them on your local drive. If a subsequent website attempts to load that identical logo using a hidden <img> tag:

1. If you have visited the site before: The logo is already sitting in your local disk cache. The onload event fires in under 5 milliseconds.
2. If you have never visited the site: The browser must resolve DNS, establish a TLS handshake, and download the image over the network wire. The onload event takes 150 to 400 milliseconds.

By measuring the differential between local cache hits and remote network fetches, attackers could deduce your browsing history with mathematical precision.

URL Tracking Shield

Could tracking parameters attached to URLs be leaking your identity?

Even without history sniffing, link decoration appends unique tokens like fbclid and gclid to monitor your transitions across independent web properties.

👉 Discover How to Strip URL Tracking & Bounce Redirects →

4. Chromium’s Ultimate Solution: HTTP Cache Partitioning

To eradicate cache timing side-channels, Google Chrome re-architected its entire network storage layer through HTTP Cache Partitioning (also known as Network State Partitioning).

Historically, Chrome utilized a single, shared HTTP cache pool. A cached asset from cdn.example.com could be reused whether you visited Site A or Site B. Under Cache Partitioning, Chrome splits the cache key into a composite triple key:

Cache Key = (Top-Level Origin, Subframe Origin, Resource URL)

Because the top-level origin is embedded directly into the cache key, an image cached while browsing https://legitimate-bank.example cannot be read or retrieved when you are on https://malicious-attacker.example. The attacker's page is forced to download the resource afresh from the network, eliminating timing discrepancies entirely and shutting down cache-based history sniffing permanently.

Attack Vector	Underlying Mechanism	Modern Browser Status	Primary Defensive Primitive
CSS :visited Sniffing	DOM Computed Style Reads	Completely Blocked	Fake ComputedStyle & Alpha Clamping
HTTP Cache Timing	Disk vs. Network Latency Probing	Completely Blocked	Triple-Key Cache Partitioning
Connection Pool Reuse	TLS Handshake Timing Overlap	Mitigated	Socket Pool & DNS State Partitioning
Canvas & WebGL Fingerprinting	Hardware Subsystem Interrogation	Active Attack Vector	Noise Injection & Anti-Fingerprinting APIs

Immediate Action Required

Are your secure HTTPS requests being stripped on public networks?

Even with strong origin protections, attackers can downgrade your connection to plain HTTP. Learn how HSTS and Chrome's HSTS Preload list block SSL stripping attacks.

👉 Defeat SSL Stripping Attacks with Chrome's HSTS Shield →

5. In-Depth DevTools Audit: Verifying Cache and Style Isolation

You can verify how Chrome obscures visited link states and partitions network assets directly inside Chrome DevTools:

🔍 Step-by-Step History Leakage Verification Protocol:

1. Open Google Chrome, navigate to any article, and click an external hyperlink to ensure it exists in your browser history.
2. Return to the original page, press F12 to open DevTools, and switch to the Console tab.
3. Select the visited hyperlink using JavaScript and query its computed text color:

   const link = document.querySelector('a:visited');
   console.log(window.getComputedStyle(link).color);
         

4. Notice that even though the link appears purple or customized on your screen, the returned console output reflects the standard unvisited link color (e.g., rgb(0, 0, 238)). Chrome successfully conceals the history state from JavaScript.
5. Switch to the Network tab, reload the page, and inspect the Size column. Look for items marked (memory cache) or (disk cache) to observe how partitioned storage prevents cross-origin resource correlation.

6. Action Plan: How to Harden Chrome Against History Tracking

To preserve complete navigational privacy and ensure no residual timing channels leak your past activity, implement this disciplined browser configuration:

• Enforce Automatic Profile Purging on Exit: Navigate to chrome://settings/content/siteData and select "Delete data sites have saved to your device when you close all windows". This ensures that temporary cache entries and local state keys are wiped upon closing the browser.
• Pair Navigation with Secure Encrypted DNS (DoH): Even if websites cannot sniff history inside the browser, an unencrypted DNS query broadcasts every domain lookup to your ISP. Combine your browser protections with DNS-over-HTTPS using trusted providers like Cloudflare (1.1.1.1) or Google Public DNS (8.8.8.8).
• Deploy Content Blockers with Strict Tracker Lists: Install uBlock Origin. Advanced tracking scripts that deploy high-entropy side-channel probing are cataloged and neutralized before their timing timers can execute.
• Utilize Separate Chrome Profiles for Sensitive Research: Segregate financial, medical, and personal activities into a dedicated secondary Chrome profile. Profiles maintain physically independent SQLite databases and cache roots, eliminating cross-context data leaks completely.

7. Frequently Asked Questions (FAQ)

Q: Can websites see the URLs I type directly into the Chrome Omnibox?

A: No. What you type into Chrome's address bar is processed within the browser's privileged Browser Process (the Broker). Webpages execute inside unprivileged Renderer sandboxes and have zero programmatic visibility into your address bar inputs unless you press enter and load a page that receives a referrer header.

Q: Does Incognito Mode completely hide my past browsing history?

A: Yes. An Incognito session starts with a completely blank history database and an empty, isolated in-memory cache. It never consults your standard profile's history, rendering CSS history sniffing against previous sessions mathematically impossible.

Q: Why doesn't Google completely remove the :visited CSS feature?

A: Visual link differentiation is a foundational accessibility and usability component of the World Wide Web. Removing it entirely would severely degrade navigational ergonomics for millions of users worldwide. The modern solution—lying to JavaScript while preserving the visual change for the user—solves the security threat without sacrificing usability.

Conclusion: The Hardened Perimeter of Modern Browsing

The historical vulnerability of CSS history sniffing serves as a sobering reminder of how simple aesthetic features can be repurposed into surveillance instruments. What began as a helpful visual cue to highlight visited links became an unmonitored backdoor into user privacy.

Through the convergence of computed-style deception, restricted pseudo-class properties, and network-wide HTTP cache partitioning, modern Chromium has decisively sealed this leakage channel. By understanding these boundaries and practicing disciplined data hygiene, you ensure that your past navigation remains your private property—invisible to every third-party website you explore.