Plugging the CSS History Leak

Sid Stamm


Privacy isn’t always easy.

We’re close to landing some changes in the Firefox development tree that will fix a privacy leak that browsers have been struggling with for some time. We’re really excited about this fix, we hope other browsers will follow suit. It’s a tough problem to fix, though, so I’d like to describe how we ended up with this approach.

History Sniffing

Visited and Unvisited LinksLinks can look different on web sites based on whether or not you’ve visited the page they reference. You’ve probably seen this before: in some cases, visited links are purple instead of blue. This is just one of the many features web designers use to make the web the best it can be, and for the most part that’s a good thing.

The problem is that appearance can be detected by the page showing you links, cluing the page into which of the presented pages you’ve been to. The result: not only can you see where you’ve been, but so can the web site!

Originally specified as a useful feature for the Web, visited link styling has been part of the web for… well, forever. So this is a pretty old problem, and resurfaces every once in a while to generate more paranoid netizens.

The most obvious fix is to disable different styles for visited versus unvisted links, but this would be employed at the expense of utility: while sites can no longer figure out which links you’ve clicked, neither can you. David Baron has implemented a way to help keep users’ data private while minimizing the effect on the web, and we are deploying it to protect our users. We think this represents the best solution to the problem, and we’ll be delighted if other browsers approach this the same way.

Technical Details.

The biggest threats here are the high-bandwidth techniques, or those that extract lots of information from users’ browsers quickly. These are particularly worrisome since they enable not only very focused attacks, but also the widespread brute-force attacks that are, in general, more useful to a variety of attackers (potentially including fingerprinting).

The JavaScript function getComputedStyle() and its related functions are fast and can be used to guess visitedness at hundreds of thousands of links per minute. To make it harder for web sites to figure out where you’ve been without radically changing the web, we’re approaching the way we style links in three fairly subtle ways:

Change 1: Layout-Based Attacks
First of all, we’re limiting what types of styling can be done to visited links to differentiate them from unvisited links. Visited links can only be different in color: foreground, background, outline, border, SVG stroke and fill colors. All other style changes either leak the visitedness of the link by loading a resource or changing position or size of the styled content in the document, which can be detected and used to identify visited links.

While we are changing what is allowed in CSS, the CSS 2.1 specification takes into consideration how visited links can be abused:

“UAs may therefore treat all links as unvisited links, or implement other measures to preserve the user’s privacy while rendering visited and unvisited links differently.” [CSS 2 Specification]

Change 2: Some Timing Attacks
Next, we are changing some of the guts of our layout engine to provide a fairly uniform flow of execution to minimize differences in layout time for visited and unvisited links. The changes cause all styles to be resolved on all links for both visited and unvisited states, and it is stored; then, when the link is styled, the appropriate set of styles is chosen making the code paths for visited and unvisited links essentially the same length. This should eliminate some of the easy-to-mount timing attacks.

Change 3: Computed Style Attacks
JavaScript is not going to have access to the same style data it used to. When a web page tries to get the computed style of a link (or any of its sub-elements), Firefox will give it unvisited style values.

What does this mean for users?

For the most part, users shouldn’t notice a change in how the web works. A few web sites may look a little different, but visited links will still show up differently colored. A few sites that use more than color to differentiate visited links may look slightly broken at first while they adjust to these changes, but we think it’s the right trade-off to be sure we protect our users’ privacy. This is a troubling and well-understood attack; as much as we hate to break any portion of the web, we need to shut the attack down to the extent we can.

We have to be realistic, though: there are many ways all browsers leak information about you, and fixing CSS history sniffing will not block all of these leaks. But we believe it’s important to stop the scariest, most effective history attacks any way we can since it will be a big win for users’ privacy.

If the remaining attacks worry you, or you can’t wait for us to ship this fix, version 3.5 and newer versions of Firefox already allow you to disable all visited styling (immediately stops this attack) by setting the layout.css.visited_links_enabled option in about:config to false. While this will plug the history leak, you’ll no longer see any visited styling anywhere.

Enhancing Privacy on the Web.

We want to bridge the gap between our users’ expectations of privacy and what actually happens on the web. Sometimes users have an expectation that we preserve their privacy a certain way, and if we can, we want to live up to it. Privacy isn’t a feature that can simply be added to a browser, though; it often comes at the expense of utility. We think we’ve found a fix that will balance flexibility for web developers while providing a safer experience for our users on the web.

Sid Stamm, Mozilla Security

67 responses

  1. Michael wrote on :

    Sorry, I’m really angry about that. I think Change 2 and Change 3 are very useful, but I’m completely against Change 1.
    Please be aware that this will affect a significant portion of your user base, see

  2. Matt wrote on :

    “However, I don’t see why there can’t be an exception for visited sites of the same website, surely the website can see what the user clicks on anyway within their own site.”

    I’d like to second this comment. Please provide an exception to sites within the same base domain. This way javascript can do handy things with those links.

  3. Jaanus wrote on :

    My question is: what is the point of visited links feature nowadays? Would anyone be worse off (or notice) if this “visited links” feature were simply eliminated from the browser? These days, with rich content and URL shorteners and whatnot, it has lost its usefulness in my eyes. Does anyone have any evidence (scientific, anecdotal, whatever) that people know or care about this feature? (Especially the kind of people featured in “what is a browser” video.)

    How this relates to security: simply eliminating a feature would save everyone the trouble of trying to plug perceived or real security holes related to that feature.

  4. Colby Russell wrote on :

    Michael: “completely useless” is surely an exaggeration. Having said that, the Web is certainly just as useless in its current state, no? Web designers have been putting personal taste for aesthetics before the usability for others for a long time, so in truth, you’re already running into problems with low contrast or otherwise indistinguishable color palettes in the wild, right? And even amongst designers who do not fit in those categories, the number of designers who put icons or even non-color types of text decoration in their style sheet to distinguish visited links is by far outnumbered by those who only specify color.

    Using an add-on to help with your color vision deficiency would probably have the highest benefits for you across the board.

    David Baron: Is/will there now an API in place (getTrueComputedStyle?) available to chrome? It seems like it would be a shame if add-ons didn’t have an easy way to get at that information; I know the DOM Inspector uses the DOM 2 Style API in question for the computed style viewer. (Certainly no problem if you’re only interested in seeing exactly what is going to be seen by script, but if that’s not your use case, then a problem does arise.) And it would probably be most beneficial to have a separate method rather than a whitelisting effect for chrome, in case your add-on is interested in seeing exactly what script will see.

  5. Mike Samuel wrote on :

    JavaScript sandboxing schemes can prevent sandboxed code from doing history sniffing, port sniffing, etc.

    Caja ( ) addresses history mining by exposing only the non-visited version of styles for links to untrusted code.

  6. Colby Russell wrote on :

    Sid, it’s also interesting that you say you “hope other browsers will follow suit”, since the approach makes it seem more like a (belated) temporary stopgap than a permanent solution, and will potentially be subject to future progress which could retain more of the current functionality to be exposed to authors—contingent upon some untangling in /layout that would make such things possible.

    1. Sid Stamm wrote on :

      @Colby: I wouldn’t call this fix a temporary stopgap, unless you are hoping this it a stepping stone towards removing browser history entirely, which I doubt would be welcomed with open arms. With the text you quoted, I was saying how I’d like to see more adoption of the fundamental approach: blocking history from arbitrary web sites, but still letting users themselves see it. The point is to match up what the browser does with what users think it does. Browser history is widely perceived as something that’s just part of the browser–not transmitted to sites–and this patch is intended to make it that way.

  7. Anna wrote on :

    Please provide an exception to sites within the same base domain or explain why it’s not a good idea.

  8. Frank Yan wrote on :

    I don’t think text-decoration (at least underline) affects page layout. If I am correct, why isn’t this supported for :visited?

  9. Ben Curtis wrote on :

    Please consider only applying these changes to links that specify a domain.

    These changes look like they will break the (very useful) types of :visited links with checkmarks (e.g., a symbol saying “check — you’ve followed this link”), or otherwise calling deliberate and unmistakable attention to links you have not gone to yet and those you have. For example, a list of PDFs that must be viewed/downloaded could be marked with a.pdf-list:visited { text-decoration:line-through; }; such a notation is not just a design aesthetic, but a significant usability aid that would otherwise require convoluted server-side code to implement.

    So I suggest that these new changes only apply when the link starts with a protocol or double slash, and therefore specifies the domain. I don’t even think it would be necessary to compare the domain to the page’s domain; ANY specified domain will trigger these privacy protections on that link.

    If it doesn’t specify the domain, then the link must point within the domain. For the majority of sites which fully control all pages on their domain, your suggested changes do not provide any additional privacy protection since all of that history can be tracked on the server. But the changes would prevent creative and useful applications of CSS. (Sites where untrusted third parties are hosted under the same domain, e.g.,, would be the exception — but Facebook controls what JS can run and can easily protect against this themselves.)

    Hope you consider this modification.

  10. James wrote on :

    From Webkit’s bugzilla, it looks like Dave Hyatt is going to implement the same fix. (The great thing about a competitive browser market.)

  11. Jesse Ruderman wrote on :

    Will user stylesheets be affected?

  12. Eris wrote on :

    Hang on, wait a tick. Why not treat link styles using the same-origin policy that affects XMLHttpRequest and Javascript interaction with frames? Visited links that fall under same-origin are styled freely and those that don’t are styled as unvisited.

    Actually, I’d like to see this made part of the CSS spec and add a pseudoclass for all links that point to a resource that belongs to another domain. Don’t suppose it will ever happen, though.

  13. Daniel Veditz wrote on :

    @Jesse: yes, user sheets and even chrome sheets are affected. The engine simply doesn’t support :visited styling except for a limited number of properties.

    @Frank Yan: text decoration isn’t supported out of concerns about timing attacks.
    See also “Test #3” in that bug which only uses the underline property.

  14. Colby Russell wrote on :

    @Sid (emphasis is mine):

    I’d like to see more adoption of the fundamental approach: blocking history from arbitrary web sites, but still letting users themselves see it.

    Certainly. And you probably do know that I wasn’t suggesting removing history entirely.

    But your call to follow suit seemed a bit stronger than the adoption of fundamentals; it seemed like one for an adoption of the specific process used in Gecko—the rules it applies to determine the restrictions on :visited and how it will be accessible to content script. Given that many people are seeing this as a loss in functionality, David Baron’s past expressions that indicated he envisioned at least a little more flexibility would remain with regard to what web authors would be allowed to do with the selector, and that the bug is still marked ASSIGNED, as well as my own thoughts that it seems like more options could be preserved, albeit with some more work, it appears to me to be a temporary stopgap set to be improved upon.

    For what it’s worth, this affects me in absolutely no way with regard to Web authoring, and I’m not sore over it. (Did my disdain for designers who put an overemphasis on their personal taste for aesthetics shine through before?) The aspects I’m far more concerned about are ones I share with Jesse: how is this attempt to thwart evildoers on the Web going to affect already-privileged chrome?

  15. Watches wrote on :

    I hope users stylesheets aren’t hit by this.

  16. AJ wrote on :


    Haha, that’s a good one! I almost fell for it because I’m in a different timezone, but when I got to the end I realized it’s an April Fools prank, and a classic one at that! But I don’t think that more experienced Web developers will be fooled — Bug 147777 has been around long enough that any proposal to do something about it is about as like to happen as having Duke Nukem Forever implemented as a Firefox plug-in. Good try though :)

  17. Philip wrote on :

    I don’t thing that you should disable the background-image property for visited links totally. It should be allowed for links that point to the same domain. I know some sites that use background-image for visited links and it would be pity if they won’t work as they usually do.

  18. Tom wrote on :

    Really a good one. While my first thought was: MUST be an april’s fool, I stumbled across the fact that the date just wasn’t right. But as AJ already mentioned: timezones. Damn globalization! You really got me with this one!

    Good job!

  19. Davin wrote on :

    No you can’t. You have to have a list of canidate links in the first place and there are far too many profiles in Facebook.

    Someone (I can’t find the link now) put together a proof of concept using popular Facebook groups. They had a pretty good hit rate on identifying users from their unique combination of groups, I believe it was above 50%.

  20. ant wrote on :

    Will this also be used to cripple pages that run no JS code whatsoever?

    1. Sid Stamm wrote on :

      History can be sniffed without JavaScript too, just using CSS. See this demo for an example and explanation of how it works.

More comments: 1 2 3