Chrome's RAM usage is higher than ever as Google introduces Site Isolation to fight Spectre

Google's Chrome browser may be popular, but you'll find a lot of its users complain about high memory usage. With Chrome 67, things just got even worse.

If you've noticed that Chrome on the desktop is using more RAM, you're not imagining it. Google has enabled a Site Isolation feature in Windows, Mac, Linux and Chrome OS to help mitigate against the Spectre vulnerability -- and it's a bit memory-hungry.

See also:

• New Spectre 1.1 and Spectre 1.2 CPU vulnerabilities exposed
• Researchers develop SafeSpec to overcome vulnerabilities like Spectre and Meltdown
• Spectre and Meltdown variant 4: Microsoft, Google and Intel reveal new Speculative Store Bypass chip vulnerability

There are numerous variants of Spectre, and they make it possible to grab data from browser sessions. Various patches and fixes have been rolled out from hardware and software manufacturers, and Google's changes to Chrome are just the latest example of this.

While the additional security offered by Site Isolation will be welcomed, the performance hit and requirement for more resources are going to be less well-received -- particularly given Chrome's RAM-gobbling reputation.

In a blog post about the rollout of the security feature, Google's Charlie Reis explains:

Site Isolation is a significant change to Chrome's behavior under the hood, but it generally shouldn't cause visible changes for most users or web developers (beyond a few known issues). It simply offers more protection between websites behind the scenes. Site Isolation does cause Chrome to create more renderer processes, which comes with performance tradeoffs: on the plus side, each renderer process is smaller, shorter-lived, and has less contention internally, but there is about a 10-13 percent total memory overhead in real workloads due to the larger number of processes. Our team continues to work hard to optimize this behavior to keep Chrome both fast and secure.

10-13 percent is a fairly significant overhead to add to a piece of software that is used so much by so many people. It's a similar story as the patches pushed out by Intel and others resulted in something of a performance hit, and the resource usage is why Site Isolation is not coming to Chrome for Android just yet, as Google security expert Justin Schuh explains on Twitter:

Technical highlights: The current version defends only against data leakage attacks (e.g. Spectre), but work is underway to protect against attacks from compromised renderers. We also haven't shipped to Android yet, as we're still working on resource consumption issues.

— Justin Schuh ? (@justinschuh) July 11, 2018

Image credit: Ink Drop / Shutterstock