How to Configure Site Isolation and Process per Site in Google Chrome

When hardware speculative execution security vulnerabilities like Spectre and Meltdown emerged, they fundamentally altered browser security models. Because web browsers execute untrusted third-party JavaScript code from arbitrary websites, malicious scripts could potentially exploit speculative CPU memory caching to read data across memory spaces within the same operating system process. To provide airtight defense against side-channel memory inspection, Google engineered Site Isolation in Google Chrome. Site Isolation ensures that pages from different websites are always rendered in dedicated, operating-system-sandboxed processes.

How Site Isolation Protects Browser Memory

Under Chrome’s multi-process architecture, Site Isolation enforces strict operating system boundaries:

• Dedicated Process per Origin: Web pages from different registered domains (e.g., https://bank.com and https://untrusted-site.com) never share a renderer process.
• Out-of-Process Iframes (OOPIFs): If a website embeds third-party content (such as an ad or payment iframe), that embedded frame renders inside its own dedicated process, isolated from the parent DOM.
• Cross-Origin Read Blocking (CORB): Blocks sensitive data files (like JSON, XML, or HTML) from entering renderer processes that shouldn’t have access to them.

Checking Site Isolation Status via Chrome Internals

To verify whether Site Isolation is active and inspect memory sandboxing:

1. Open Google Chrome on desktop.
2. In the address bar, type chrome://process-internals and press Enter.
3. The Process Internals dashboard lists active isolation parameters:
   • Site Isolation Mode: Typically reports Site Per Process on modern desktop versions.
   • Isolated Origins: Displays domains configured for additional strict isolation policies.
4. Press Shift + Esc to launch the Chrome Task Manager and view individual renderer process IDs assigned to different domains.

Enforcing Strict Site Isolation via Chrome Flags

Users who handle ultra-sensitive credentials or corporate security teams can enforce strict site isolation policies:

1. Navigate to chrome://flags in the Chrome address bar.
2. Search for Site Isolation.
3. Locate the flag: Strict site isolation.
4. Set the dropdown menu to Enabled.
5. Click Relaunch at the bottom of the screen to restart Chrome with hardened process boundaries.

Configuring Isolated Origins for High-Security Domains

To guarantee that specific high-value corporate subdomains receive isolated processes even on mobile or low-memory machines:

1. Locate the flag: Isolate origins inside chrome://flags.
2. Enter a comma-separated list of exact domains (e.g., https://corp.example.com,https://vault.example.com).
3. Relaunch Chrome. The browser will strictly isolate these listed web origins regardless of device resource limitations.