Aligning timers with cross origin isolation restrictions  |  Blog  |  Chrome for Developers
Skip to main content
Docs
Build with Chrome
Learn how Chrome works, participate in origin trials, and build with Chrome everywhere.
Web Platform
Capabilities
ChromeDriver
Extensions
Chrome Web Store
Chromium
Web on Android
Origin trials
Release notes
Productivity
Create the best experience for your users with the web's best tools.
DevTools
Lighthouse
Chrome UX Report
Accessibility
Modern Web Guidance
Get things done quicker and neater, with our ready-made libraries.
Workbox
Puppeteer
Experience
Design a beautiful and performant web with Chrome.
AI
Performance
CSS and UI
Identity
Payments
Privacy and security
Resources
More from Chrome and Google.
All documentation
Baseline
web.dev
PageSpeed Insights audit
Isolated Web Apps (IWA)
Case studies
Blog
New in Chrome
/
English
Deutsch
Español – América Latina
Français
Indonesia
Italiano
Nederlands
Polski
Português – Brasil
Tiếng Việt
Türkçe
Русский
עברית
العربيّة
فارسی
हिंदी
বাংলা
ภาษาไทย
中文 – 简体
中文 – 繁體
日本語
한국어
Sign in
Blog
Docs
More
Case studies
Blog
New in Chrome
Build with Chrome
Web Platform
Capabilities
ChromeDriver
Extensions
Chrome Web Store
Chromium
Web on Android
Origin trials
Release notes
Productivity
DevTools
Lighthouse
Chrome UX Report
Accessibility
Modern Web Guidance
Workbox
Puppeteer
Experience
AI
Performance
CSS and UI
Identity
Payments
Privacy and security
Resources
All documentation
Baseline
web.dev
PageSpeed Insights audit
Isolated Web Apps (IWA)
Chrome for Developers
Blog
Aligning timers with cross origin isolation restrictions
Stay organized with collections
Save and categorize content based on your preferences.
Yoav Weiss
X
GitHub
Eiji Kitamura
X
GitHub
Mastodon
Bluesky
Before version 91,
timer resolutions
in Chrome were restricted to 5 microseconds on desktop,
where site-isolation is enabled,
and to 100 microseconds on Android, where it's not.
Starting from version 91, following a specification change,
Chrome will be restricting the resolution of explicit timers
(performance.now(), performance.timeOrigin,
and other performance APIs that expose DOMHighResTimestamps) to 100 microseconds across platforms.
By enabling cross-origin isolation,
websites can relax the restriction to 5 microseconds regardless of platform.
Note: A microsecond is one millionth of a second (0.000001 seconds). Therefore, 5 microseconds is 0.000005 seconds.
Gaining more powerful capabilities by enabling cross-origin isolation is
a similar approach posed on SharedArrayBuffer.
Cross-origin isolation is a state where a web page is isolated from other origins except ones that opted-in.
Do I need to do something about it?
Probably not. performance.now() has been limited to significantly more coarse resolutions in other browsers
(for example, 1 millisecond = 0.001 seconds),
so you shouldn't have relied on the current resolution anyway.
At the same time,
if you wish to benefit from higher resolution for your timers,
for example for more accurate performance measurements,
you would need to make sure your site is
cross-origin isolated.
That would provide you with better resolution both in Chrome and other Chromium based browsers,
as well as Firefox.
What do timers have to do with cross-origin isolation?
Browser vendors decided to limit the timers to more coarse resolutions
(as well as the availability of SharedArrayBuffers which can be used as implicit timers)
when Spectre was discovered.
This is because Spectre,
and similar speculative execution attacks,
rely on timers to measure the time certain operations take,
then guess the contents of the process' memory.
While speculative execution attacks can be executed with coarse timers,
high-resolution timers can speed them up.
Chrome used its
site-isolation
architecture, as well as other mechanisms,
to mitigate the risk and re-enabled those functionalities,
but it is limited to desktop platforms and Chromium browsers only.
Having APIs relying on the underlying browser architecture isn't really ideal.
Cross-origin isolation provides the standard baseline for browsers to run pages in an isolated environment
such that they are unable to load unwilling cross-origin resources,
and therefore, are not at risk for Spectre.
With cross-origin isolation,
we can now allow pages to access high-resolution timers,
SharedArrayBuffer,
and other APIs that are unsafe to expose in processes that can read arbitrary cross-origin data.
To learn more about the background behind this change, read
Why you need "cross-origin isolated" for powerful features.
Cover photo by Linda Perez Johannessen
on Unsplash.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2021-04-21 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2021-04-21 UTC."],[],[]]
Contribute
File a bug
See open issues
Related content
Chromium updates
Case studies
Archive
Podcasts & shows
Follow
@ChromiumDev on X
YouTube
Chrome for Developers on LinkedIn
RSS
Terms
Privacy
Manage cookies
English
Deutsch
Español – América Latina
Français
Indonesia
Italiano
Nederlands
Polski
Português – Brasil
Tiếng Việt
Türkçe
Русский
עברית
العربيّة
فارسی
हिंदी
বাংলা
ภาษาไทย
中文 – 简体
中文 – 繁體
日本語
한국어