Why Does Each Gmail Account Login Create a New Subframe in the Chrome Task Manager?

Question

After upgrading to Google Chrome version 63.0.3239.108 on Linux, I noticed a new behavior from Gmail.

I have several Gmail accounts and each time I login to one of my Gmail accounts, I notice that a new subframe for "https://accounts.google.com" is created in the Google Chrome Task Manager.

If I close a browser window with Gmail in it, the subframe disappears. But as long as the Gmail web app for each account is open, the subframes for those accounts remain. (continuing to use RAM)

Screenshot of the Subframes in the Google Chrome Task Manager

My Questions:

• Why did these subframes start appearing?
• Is this a new part of the Gmail web app that everyone using Google Chrome will see?
• Will it cause problems for Gmail if I use "End Process" (in the Google Chrome Task Manager) to remove these subframes?
  • I tried this and didn't notice any problems so far.

Answer 1

It's called Site Isolation and is a security feature:

Site Isolation is an optional security feature in Chrome that offers additional protection against some types of security bugs. It makes it harder for untrusted websites to access or steal information from your accounts on other websites.

According to Chromium.org Site Isolation helps to

mitigate attacks that are able to read otherwise inaccessible data within a process, such as speculative side-channel attack techniques like Spectre/Meltdown. Site Isolation reduces the amount of valuable cross-site information in a web page's process, and thus helps limit what an attacker could access.

Additionally, Site Isolation

offers more protection against a certain type of web browser security bug, called universal cross-site scripting (UXSS). Security bugs of this form would normally let an attacker bypass the Same Origin Policy within the renderer process, though they don't give the attacker complete control over the process.

Current issues include Higher overall memory use in Chrome (about 10-12% in Chrome 65 when isolating all sites with many tabs open).

It is not enabled by default chrome://flags/#enable-site-per-process but is being tested in the field. You can opt out but it is not recommended chrome://flags/#site-isolation-trial-opt-out. If you delete a subframe the process for the site still exists but the Site Isolation for that site will no longer be enabled.

Answer 2

I imagine the purpose of the subframe is to give Chrome an instance to create duplicate entities for the same sites.

The same reason you cannot login to two different accounts with any other website unless you log out of the other one.

Not a perfect answer, but it's my first one :)