@@ -4259,7 +4259,7 @@ while still preserving as much of the <em>usefulness</em> of '':visited'' as pos
42594259 containing [=tuples=] of three pieces of information:
42604260 * a visited [=/URL=]
42614261 * an [=/origin=] for the site that started a navigation
4262- * an [=/origin =] for the top-level site containing the frame that started the navigation.
4262+ * a [=/site =] for the top-level site containing the frame that started the navigation.
42634263 (This will often be the same as the previous,
42644264 but can differ if the user clicks a link in a iframe, for example.)
42654265
@@ -4270,8 +4270,8 @@ while still preserving as much of the <em>usefulness</em> of '':visited'' as pos
42704270 add an entry to |visited history|
42714271 recording the navigation's destination URL,
42724272 the origin of the page containing the link or script,
4273- and the origin of the top-level site containing that page
4274- (which might be the same as the previous origin).
4273+ and the (schemeful) site of the top-level site containing that
4274+ page (which might be the same site as the previous origin).
42754275
42764276 Note: This allows a site to see '':visited'' information
42774277 for links that the user has clicked
@@ -4280,9 +4280,10 @@ while still preserving as much of the <em>usefulness</em> of '':visited'' as pos
42804280 where the site is A.
42814281
42824282 Additionally, add an entry to |visited history|
4283- recording the destination's URL,
4284- and the <em> destination's</em> origin
4285- for both origin values.
4283+ recording the destination's URL, the <em> destination's</em>
4284+ origin, and the <em> destination's</em> site. Do this only
4285+ for navigations from top-level frames or iframes which are
4286+ same-origin with their top-level frame.
42864287
42874288 Note: This allows for a site to see '':visited'' information about its own pages
42884289 (which is already observable by the site)
@@ -4304,11 +4305,11 @@ while still preserving as much of the <em>usefulness</em> of '':visited'' as pos
43044305 only allow it to match '':visited'' if
43054306 the link's destination,
43064307 the origin of the page containing the link,
4307- and the origin of the top-level site containing the link
4308+ and the top-level site containing the link
43084309 match a tuple in |visited history|.
43094310
43104311<div class=note>
4311- The inclusion of both page origin and top-level site origin
4312+ The inclusion of both page origin and top-level site
43124313 prevents several possible privacy attacks,
43134314 such as:
43144315
0 commit comments