Google Chrome has become the first to have fixed a bug that has been present in browsers for years, which exposed users’ activity history by applying styles to visited links.
Links are displayed in blue, and when once clicked, they can change colour (for example, to purple) the next time that page appears in search results. This is a visual way to check which web pages have been visited, but it’s also a customisation that has put user privacy at risk for years.
This issue is caused by the way browsers store your link history: once a user clicks a link, the destination URL is stored in the browser history. Any website that includes the same link can then apply a different style to it, revealing whether the user has visited that URL before.
If a style has been applied to the link—such as changed colour— to distinguish it from an unvisited link, then those websites can know that users have already seen it and extract information from the web activity history.
Thankfully, Google has recently offered a solution to mitigate the impact of this privacy risk. To do so, it has introduced partitioning, which “shows a link as visited only if you’ve clicked on it from the same website before,” and not from any other site(s) who had the link before.
For example, if you click a link to example.com while on websiteA.com, only websiteA.com can style that link as visited. If websiteB.com includes the same link to example.com, it won’t know you visited it because the browser keeps the visit history separate for each site, preventing cross-site tracking.
“If you haven’t interacted with this site previously, its links won’t be styled as :visited,” the company explained on the Chrome Developer Blog.
The partitioning solution separates browsing history based on the context from which the user accessed the link. It also applies to links that lead to subpages within the same website.
In 2020, some browsers already implemented a mitigation, which limited the styles that web developers could apply and returned the ‘unvisited’ style to pages that requested style information.
Google has added this partition fix in Chrome version 136, released recently, and becomes the first browser to implement this protection.