Beyond the Limits of Site Isolation
Ivan Fratric
OffensiveCon 2026 · Day 2 · Main Stage
In this talk, Ivan Fratric, a seasoned security researcher and Tech Lead at Google Project Zero, delves into the often-misunderstood boundaries of **Site Isolation**, a critical security mitigation in modern web browsers. Fratric presents a deep dive into a long-standing, high-severity vulnerability in Chrome, which he discovered during an internal hackathon in 2019, that allowed for the leakage of sensitive **redirect URLs** containing data like **OAuth codes**. Despite being marked as "fixed" in late 2022, Fratric reveals that the core issue, particularly concerning sub-resource loading, largely persists due to the fundamental architectural challenges of web browser engines.
AI review
Fratric takes a genuinely hard problem — the architectural limits of Site Isolation — and demonstrates that a 'fixed' Chrome bug still works against real OAuth flows using a live GitHub/Google demo. The WebKitGTK logic bug finding is a clean bonus. This is real Project Zero work: multi-year bug lifecycle, cross-browser comparative analysis, and honest admission that some 'bugs' are actually load-bearing architectural decisions.