Google says Chrome 77 for Android enables Site Isolation security feature on pages where users log in with a password, adds additional protections on desktop
Lawrence Abrams / BleepingComputer :
Context & Ripple Effects
Site Isolation — one browser process per domain, built as a defense against Meltdown and Spectre — reached desktop Chrome with the Chrome 67 rollout in mid-2018, but Android held back because running a process per site strains memory-constrained phones. Chrome 77 is the compromise: isolation activates only on pages where users log in with a password, plus added desktop protections.
The move fits a longer Google pattern of hardening credential moments first — Chrome 56's "Not secure" warning on HTTP password forms started that playbook, and the Chrome 79 breach notifications and phishing tools extended it months later. Login pages are where side-channel attacks and credential theft pay off, so that is where the memory budget goes first.
First-order effects
- Android users get process-level isolation on password login pages, closing the Spectre/Meltdown-class exposure that desktop Chrome users have had since Chrome 67.
- Sites with password forms see Chrome on Android spawn additional processes on those pages, trading some memory and performance on phones for isolation.
Second-order effects
- Attackers rationally shift toward the pages Chrome 77 leaves unisolated — non-login content on Android — since the per-domain process wall now covers only credential surfaces.
- The staged rollout pressures device makers: full Site Isolation on Android is gated by memory headroom, so low-RAM hardware lags on browser security unless OEMs raise baselines.
Third-order effects
- If the pattern holds, browser security matures per workflow rather than per release — credential-bearing surfaces get isolation, breach alerts, and phishing defenses first, with coverage widening as hardware allows.
- The browser consolidates as the de facto endpoint security layer on Android, with Google's release cadence — not OS patches — setting the pace for side-channel and credential-theft defenses.
The trend: Browser defenses are being rolled out per workflow — login and payment surfaces first — with hardware memory limits, not threat models, dictating how fast Android catches up to desktop.