How to Configure Strict Origin Isolation and Site Instance Trees in Google Chrome

Modern web security boundaries are fundamentally defined by the Same-Origin Policy (SOP). While traditional site isolation isolates web pages by registrable domain (eTLD+1, such as digitash.com), subdomains like login.digitash.com and api.digitash.com historically shared the same renderer process. In Google Chrome, enabling Strict Origin Isolation shifts the security perimeter from site-level to exact scheme, host, and port origin boundaries. This prevents speculative side-channel attacks (like Spectre) from leaking confidential memory between distinct subdomains.

Understanding Site Isolation vs Strict Origin Isolation

Process isolation in Chromium-based browsers operates across graduated security models:

• Site Isolation (Default): Assigns separate operating system processes to pages from different sites (registrable domain + public suffix). However, subdomains of the same site share renderer memory.
• Strict Origin Isolation: Places distinct origins (e.g., https://accounts.example.com vs https://docs.example.com) into dedicated, sandboxed operating system processes.
• SiteInstance Trees: A hierarchical structure within Chrome’s browser process that groups related WebContents and cross-site iframes into sandboxed execution units.

Configuring Strict Origin Isolation via Chrome Flags

To enforce strict origin boundaries across all browsing sessions:

1. Open Google Chrome, type chrome://flags into the address bar, and press Enter.
2. Search for Strict Origin Isolation:
   • Locate the flag labelled #strict-origin-isolation.
   • Change the dropdown selection from Default to Enabled.
3. Search for Site isolation trial opt-out:
   • Ensure this flag remains Default or Disabled to prevent disabling isolation mechanisms.
4. Click the blue Relaunch button at the bottom of the window to apply the updated process policy.

Inspecting SiteInstance Trees and Process Mapping

Inspect the live operating system process boundaries assigned to browser tabs and embedded iframes:

1. Open a multi-origin webpage containing cross-origin or cross-subdomain iframes.
2. Open a new browser tab and navigate to chrome://process-internals.
3. Review the Frame Trees tab:
   • Expand the target tab tree to observe how each frame is partitioned.
   • Notice that distinct origins display different Process ID (PID) assignments.
   • Observe the SiteInstance identifiers: distinct subdomains reflect unique SiteInstance records rather than sharing an aggregated site context.
4. Switch to the Isolated Origins section to verify which specific enterprise origins are currently under strict isolation enforcement.

Configuring Enterprise Policy for Fleet Deployment

Enterprise system administrators can mandate strict origin isolation across corporate workstations using Windows Registry or Group Policy:

# Windows Registry path for Chrome Enterprise Policies
# HKEY_LOCAL_MACHINESOFTWAREPoliciesGoogleChromeIsolateOrigins

# PowerShell snippet to enforce strict isolation on specific sensitive subdomains
$regPath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}

# Comma-separated list of strict origins
$isolatedOrigins = "https://finance.digitash.corp,https://vault.digitash.corp,https://admin.digitash.corp"
Set-ItemProperty -Path $regPath -Name "IsolateOrigins" -Value $isolatedOrigins

Monitoring Memory Overhead and Performance

Because Strict Origin Isolation instantiates additional renderer processes:

• Open Chrome Task Manager (Shift + Esc) to monitor process counts and private memory allocations.
• Chrome leverages process recycling and memory saver features to throttle idle isolated renderers, ensuring negligible impact on modern workstations equipped with 16GB or more RAM.