Summary

  • A W3C working draft in January 2010 described how :visited, selector queries and getComputedStyle() could expose browsing history. Mozilla responded by letting readers see visited colors while returning unvisited style values to page scripts and limiting other observable differences.
  • Chrome 136, released in April 2025, partitioned visited-link state by destination, top-level site and frame origin. A third site no longer inherits the purple mark from a click made on another site; a site can still recognize links to its own pages under the documented exception.

The famous purple hyperlink did two jobs at once. It told a reader, “you have been here,” and it offered a page a way to test the same fact. A hostile page could assemble links to places it wanted to ask about and inspect which ones looked visited. The W3C's January 2010 Selectors API working draft treated this as a privacy problem, naming both selector queries and getComputedStyle(). The draft even sketched a loop over querySelectorAll(":visited") to show how a page might interrogate the browser.

Mozilla wanted the reader to keep the useful ink. In its March 2010 security explanation, it described three changes then approaching the Firefox development tree. Visited links could vary in color but not in layout or resource-loading behavior that a page might measure. Layout work for visited and unvisited links would follow more uniform paths. When page JavaScript asked getComputedStyle() for a link, it would receive the unvisited values. The human eye got a purple reminder; the page's measuring tape got the blue answer.

That was a clever arrangement with a stubborn premise: the browser still knew a link had been visited, potentially through a click made somewhere else, and it drew the result in the page. The defenses concentrated on stopping the page from reading what the browser had drawn. Chrome's April 2025 account described the older visited history as unpartitioned. A link visited from one site could look visited when a different site displayed that same destination. The browser had turned a personal navigation record into a signal available at a new address.

Chrome 136 changed the address book. Its release notes, dated 29 April 2025, say :visited styling is tied to the top-level site and frame origin where the link was clicked. Chrome's detailed explanation adds the destination URL to that key. If a reader follows a link from Site A to Site B, A can remember its own outgoing path. Site C cannot decorate its link to B with A's memory. A site's own internal links have a narrow exception: the site can show those pages as visited even when the click began elsewhere, because it can already observe visits to its own pages.

The W3C's January 2026 Selectors Level 4 working draft puts the design choice in view. It discusses approaches that suppress visited matching, hide style information from scripts, or restrict matching to history an origin could have observed. Its appendix sketches the same three-part record: destination URL, initiating origin and top-level site. It shows how the problem moved from “what may a script read?” toward “which site is entitled to see this purple mark?”

This is a modest but revealing piece of Internet history. A useful interface hint became a side channel because the browser reused one memory across unrelated pages. Mozilla concealed the answer while keeping the hint. Chrome scoped the memory itself. The link can still help a reader retrace steps. The gossip now has a much smaller room.