# Chromium Patterns

> A pattern-language reference to Chromium's architecture, governance, and security response — for the engineers, executives, and agents who build on the browser engine.

This is the Chromium Patterns. It collects 64 articles organized as a pattern language across 8 sections. Updated 2026-06-25. Canonical URL: https://chromium.bartleyeditions.com/. Append `.md` to any article URL below for a clean Markdown copy (e.g. https://chromium.bartleyeditions.com/<slug>.md).

## Introduction

- [What's New](https://chromium.bartleyeditions.com/whats-new): A reverse-chronological record of recent additions, edits, and redrafts to Chromium Patterns, with per-checkpoint coverage metrics.
- [Article Map](https://chromium.bartleyeditions.com/article-map): An interactive graph of every entry in Chromium Patterns and how the entries connect through their Related links, clustered by section.

## Governance and Web Standards

- [Intent to Ship Pipeline](https://chromium.bartleyeditions.com/intent-ship-pipeline): The staged public process by which a new Blink web-platform feature moves from idea to Stable Chrome, with required artifacts and named approvers at every gate. (draft — not yet reviewed)
- [Three-LGTM API Owner Gate](https://chromium.bartleyeditions.com/three-lgtm-gate): The hard rule that an Intent to Ship clears only after three Blink API owners each post LGTM in the public thread — a named cross-cutting population, not the feature team. (draft — not yet reviewed)
- [Origin Trial](https://chromium.bartleyeditions.com/origin-trial): A time-boxed mechanism that exposes an experimental web-platform feature to bounded real-world traffic under signed-token consent from participating origins, generating compatibility and usage data before the Intent to Ship gate. (draft — not yet reviewed)
- [Deprecation Trial](https://chromium.bartleyeditions.com/deprecation-trial): A reverse origin trial: an existing web-platform feature is disabled for all origins except those that register for a continued-use window, giving dependent sites a calibrated migration period before removal. (draft — not yet reviewed)
- [WICG Explainer](https://chromium.bartleyeditions.com/wicg-explainer): The plain-language proposal document a contributor publishes in a Web Incubator Community Group repository, opening a Blink web-platform feature to public scrutiny before any code is merged. (draft — not yet reviewed)
- [Web Platform Backward Compatibility](https://chromium.bartleyeditions.com/web-backward-compatibility): Chromium's standing commitment not to break web content that already works, which constrains every feature addition and turns every feature removal into a measured, gated migration. (draft — not yet reviewed)
- [API Owner](https://chromium.bartleyeditions.com/api-owner): A named senior Blink reviewer whose LGTM on an Intent thread, alongside two others from the same appointed population, authorizes a web-platform feature to ship at Stable. (draft — not yet reviewed)
- [Experiment That Became Permanent](https://chromium.bartleyeditions.com/permanent-experiment): A feature launched as a time-boxed Origin Trial accumulates dependents, the sunset is never invoked, and it runs indefinitely as production code that never cleared the Intent to Ship gate. (draft — not yet reviewed)

## The Process Trust Model

- [Multi-Process Architecture](https://chromium.bartleyeditions.com/multi-process-architecture): The 2008 decision to run each renderer, GPU service, and network stack in its own OS process; every later Chromium security and performance pattern builds on the boundary this choice established. (draft — not yet reviewed)
- [Site Isolation](https://chromium.bartleyeditions.com/site-isolation): The 2018 decision to place each cross-site iframe in its own renderer process, refining the boundary from per-tab to per-site so an OS-enforced barrier protects sites from Spectre-class side channels. (draft — not yet reviewed)
- [Browser-Renderer Privilege Split](https://chromium.bartleyeditions.com/browser-renderer-split): The trust asymmetry between the privileged browser process and the deliberately unprivileged renderer processes, where 'sandboxed' means explicit OS-level capability denial at process creation, not container isolation. (draft — not yet reviewed)
- [Navigation Commit Pipeline](https://chromium.bartleyeditions.com/navigation-commit-pipeline): Chromium's browser-owned navigation state machine, from a requested URL through redirects, throttles, process selection, renderer commit, and the update of committed security state. (draft — not yet reviewed)
- [Process Consolidation Under Memory Pressure](https://chromium.bartleyeditions.com/process-consolidation-memory): Chromium merges multiple sites into one renderer process when available memory falls below a platform-specific threshold, releasing the Site Isolation boundary while preserving the browser-renderer privilege split. (draft — not yet reviewed)
- [Stateless IPC Interface](https://chromium.bartleyeditions.com/stateless-ipc-interface): Every Mojo method between renderer and browser carries everything needed to validate and execute the call in its one message; no prior call's state is load-bearing on a browser-side security check. (draft — not yet reviewed)
- [Sandbox Escape Chain](https://chromium.bartleyeditions.com/escape-chain): The class of full-host-compromise Chromium exploits that require three or more chained vulnerabilities to traverse the renderer's containment, the in-renderer V8 cage, and the renderer-to-browser process boundary. (draft — not yet reviewed)
- [Untrusted Renderer Axiom](https://chromium.bartleyeditions.com/untrusted-renderer-axiom): The foundational posture that the browser process must treat every message from a renderer as potentially attacker-controlled, regardless of any validation the renderer claims to have performed. (draft — not yet reviewed)
- [Stateful IPC Initialization](https://chromium.bartleyeditions.com/stateful-ipc-init): A Mojo interface requires sequential calls, later operations presuming state from an earlier Init; a compromised renderer reorders the sequence and the browser-side handler runs against state the renderer chose. (draft — not yet reviewed)
- [URLLoaderFactory Trust Boundary](https://chromium.bartleyeditions.com/url-loader-factory): The point where the privileged browser process stamps a renderer-initiated network request with its origin lock, isolation state, cookie policy, and trust level by creating the factory the renderer must use, rather than letting the renderer choose its own request authority. (draft — not yet reviewed)
- [Storage Partition Boundary](https://chromium.bartleyeditions.com/storage-partition-boundary): The browser-owned boundary that keys storage, communication APIs, service workers, blob URLs, HTTP cache entries, and network state by origin plus contextual site information rather than by origin alone. (draft — not yet reviewed)
- [Service Worker Fetch Routing Pipeline](https://chromium.bartleyeditions.com/service-worker-routing): Chromium's browser-owned path for deciding whether a controlled navigation or subresource request goes to a static router source, navigation preload, the HTTP cache, the network, or a service worker `FetchEvent`. (draft — not yet reviewed)
- [On-Device Model Service](https://chromium.bartleyeditions.com/device-model-service): Chromium's layered system for downloading, sandboxing, and executing a local foundation model: the Optimization Guide store, a dedicated model-service utility process, and the shared-model-with-LoRA pattern behind the built-in AI web APIs. (draft — not yet reviewed)

## Security Response and Vulnerability Classes

- [Embargoed Disclosure](https://chromium.bartleyeditions.com/embargoed-disclosure): The Chromium project holds confirmed high- and critical-severity vulnerabilities private for a window after a fix lands, so downstream consumers can integrate the patch before attackers reverse-engineer it from the public commit. (draft — not yet reviewed)
- [Downstream Advance Access](https://chromium.bartleyeditions.com/downstream-advance-access): The Chromium security team notifies a registered population of downstream vendors about high- and critical-severity vulnerabilities before public disclosure, so each vendor's build-and-release pipeline can finish inside the embargo window. (draft — not yet reviewed)
- [V8 Heap Sandbox](https://chromium.bartleyeditions.com/v8-heap-sandbox): The decision to isolate V8's JavaScript heap in a one-terabyte address region using 40-bit offsets instead of native pointers, so heap arbitrary read/write can't reach host memory. Default-on in Chrome 123, March 2024. (draft — not yet reviewed)
- [Rust in Chromium](https://chromium.bartleyeditions.com/rust-chromium): The decision to admit Rust as a production language for memory-safe Chromium components, starting with attacker-reachable parsers and bounded by OWNERS, toolchain, crate-import, and C++ interop rules. (draft — not yet reviewed)
- [MiraclePtr (BackupRefPtr)](https://chromium.bartleyeditions.com/miracle-ptr): The decision to turn many browser-process use-after-free bugs into crashes or memory leaks by replacing unowned C++ pointer fields with raw_ptr<T> backed by BackupRefPtr in PartitionAlloc. (draft — not yet reviewed)
- [Spanification and the Unsafe Buffers Discipline](https://chromium.bartleyeditions.com/spanification-unsafe-buffers): Chromium's practice of replacing raw buffer-pointer arithmetic with size-carrying containers and views, enforced by Clang's -Wunsafe-buffer-usage warning. (draft — not yet reviewed)
- [V8 Trusted Space](https://chromium.bartleyeditions.com/v8-trusted-space): The V8 address-space region holding runtime objects heap-sandbox corruption must not reach: bytecode arrays, dispatch tables, JIT code metadata, and trusted WasmInstanceObject fields. Sandboxed code reaches it through a handle-indexed pointer table. (draft — not yet reviewed)
- [mseal-Based Forward-Edge CFI](https://chromium.bartleyeditions.com/mseal-forward-cfi): The layered V8 hardening program that combines Linux's mseal syscall, PKEY-protected JIT memory, generated-code validation, and forward-edge CFI so renderer arbitrary read/write has a narrower path to shellcode or call-target hijack. (draft — not yet reviewed)
- [V8 Bytecode Verifier](https://chromium.bartleyeditions.com/bytecode-verifier): The static check V8 created for BytecodeArray execution, rejecting malformed bytecode before it can let in-cage corruption reach trusted-side interpreter state in configurations where the verifier is enabled. (draft — not yet reviewed)
- [Exploit Chain Anatomy](https://chromium.bartleyeditions.com/exploit-chain): The three-link structure of a modern full-host-compromise Chromium exploit, treated as the unit of incident analysis, CVE rating, and bounty calibration rather than the single bug. (draft — not yet reviewed)
- [High-Value Bug Bounty](https://chromium.bartleyeditions.com/vrp-bug-bounty): The Chromium Vulnerability Rewards Program pays tiered rewards for confirmed security bugs, reserving the largest payouts for full sandbox-escape chains and primitives that would otherwise sell on the offensive market. (draft — not yet reviewed)
- [Supply-Chain Vulnerability Lag](https://chromium.bartleyeditions.com/supply-chain-lag): A downstream product embeds Chromium, pins to a milestone, and lets the upstream patch cadence outrun its own release pipeline, leaving its users running bugs already fixed in Chrome Stable. (draft — not yet reviewed)

## Release Discipline and Feature Flags

- [Four-Channel Pipeline](https://chromium.bartleyeditions.com/four-channel-pipeline): Chromium's release pipeline gives Canary, Dev, Beta, and Stable distinct meanings, so a feature's channel state names the population, risk level, and operational warranty it has reached. (draft — not yet reviewed)
- [Finch Variations](https://chromium.bartleyeditions.com/finch-variations): Chromium's server-side variations system changes feature-flag values for named user populations without shipping a new binary, turning guarded features into graduated rollouts, A/B tests, or emergency kill-switches. (draft — not yet reviewed)
- [Feature Flag Guarding](https://chromium.bartleyeditions.com/feature-flag-guarding): Every new Chromium feature is gated behind a flag the moment its code lands; the flag defaults off, flips only when the launch gate authorizes it, and is removed once the feature reaches Stable. (draft — not yet reviewed)
- [Origin Trial Token Deployment](https://chromium.bartleyeditions.com/origin-trial-tokens): The operational deployment of an origin-trial token: registering an origin, receiving a signed token, and serving it via the Origin-Trial header or meta element, with the scope, expiry, and third-party rules that decide whether the feature actually activates. (draft — not yet reviewed)
- [Stable as Trust Boundary](https://chromium.bartleyeditions.com/stable-trust-boundary): Reaching the Stable channel is a standing warranty about what the Chromium project commits to its users, and a precise account of what that warranty does and does not cover. (draft — not yet reviewed)
- [Release Branch Merge Gate](https://chromium.bartleyeditions.com/release-merge-gate): A fix that has landed on main reaches an already-cut milestone branch only through a release-manager-gated cherry-pick whose criteria tighten as the branch nears Stable. (draft — not yet reviewed)
- [Zombie Origin Trial](https://chromium.bartleyeditions.com/zombie-origin-trial): An origin trial whose announced sunset never arrives: tokens keep working because the trial was never disabled server-side, so the operator runs production traffic on an unsupported feature with no migration window. (draft — not yet reviewed)

## Performance Model and Tradeoffs

- [RAIL Performance Model](https://chromium.bartleyeditions.com/rail-performance-model): The four-part user-centric performance framework — Response, Animation, Idle, Load — whose 50 ms response, 16 ms frame, 50 ms idle-chunk, and 5-second load budgets anchor every Chromium performance discussion. (draft — not yet reviewed)
- [Skia Graphite Transition](https://chromium.bartleyeditions.com/skia-graphite): The decision to replace Skia Ganesh with Skia Graphite as Chromium's GPU rasterization backend, authored against modern low-overhead graphics APIs, shipped first on Apple Silicon Macs, and still expanding across Dawn-backed platform paths. (draft — not yet reviewed)
- [IPC Integer Type Discipline](https://chromium.bartleyeditions.com/ipc-integer-discipline): Every size, count, and offset crossing a Mojo IPC boundary is carried in an explicitly-sized unsigned type and runs through checked arithmetic, so a hostile renderer can't weaponize the handler's integer math. (draft — not yet reviewed)
- [Memory Pressure Response](https://chromium.bartleyeditions.com/memory-pressure-response): Chromium degrades its memory footprint in ordered moves — tab discarding, renderer consolidation, GPU cache eviction, per-renderer trim — once the OS reports memory below threshold, trading isolation guarantees for session survival. (draft — not yet reviewed)
- [Rendering Pipeline](https://chromium.bartleyeditions.com/rendering-pipeline): Chromium's seven-stage RenderingNG sequence — Parse, Style, Layout, Paint, Compositing, Raster, Display — that turns HTML, CSS, and JavaScript into pixels, each stage on its own thread with a distinct failure mode. (draft — not yet reviewed)
- [Resource Loading Pipeline](https://chromium.bartleyeditions.com/resource-loading-pipeline): Chromium's two-tier scheduler (Blink's ResourceLoadScheduler in the renderer plus the network service's ResourceScheduler in the network process) that decides when and in what order a page's subresources are requested, upstream of the Rendering Pipeline. (draft — not yet reviewed)
- [Compositor Frame Scheduling](https://chromium.bartleyeditions.com/compositor-scheduling): The cc::Scheduler frame loop (BeginFrame through Commit, Activate, and Draw across two threads and three layer trees) that lets scroll and transform animation run at display refresh rate while the main thread is busy. (draft — not yet reviewed)
- [Surface Aggregation](https://chromium.bartleyeditions.com/surface-aggregation): How the Viz display compositor combines CompositorFrames from the browser UI and every sandboxed renderer into one screen image without any client trusting another's pixels. (draft — not yet reviewed)
- [V8 Compilation Tiers](https://chromium.bartleyeditions.com/v8-compilation-tiers): V8's Ignition, Sparkplug, Maglev, and TurboFan execution tiers, where runtime feedback decides when JavaScript earns faster machine code. (draft — not yet reviewed)
- [Main Thread Starvation](https://chromium.bartleyeditions.com/main-thread-starvation): A page holds the renderer's main thread past the RAIL Response budget with synchronous work; input events queue, frames drop, and the user perceives the page as locked up. (draft — not yet reviewed)
- [Input Event Pipeline](https://chromium.bartleyeditions.com/input-event-pipeline): The path an OS input event takes from the browser process into the renderer's compositor thread, answered there for scroll when possible and escalated to Blink's main thread only when correctness requires it. (draft — not yet reviewed)
- [Back/Forward Cache Eligibility Gate](https://chromium.bartleyeditions.com/bfcache-gate): The launch and debugging rule that keeps pages and web-platform features safe when Chromium freezes a document in the back/forward cache and restores it on history navigation. (draft — not yet reviewed)
- [Speculative Navigation Pipeline](https://chromium.bartleyeditions.com/speculative-navigation-pipeline): Chromium's browser-managed path for preparing a future document navigation before user commitment, through Speculation Rules prefetch, prerender, activation, cancellation, and diagnostic status. (draft — not yet reviewed)

## Coordination at Scale

- [OWNERS File Governance](https://chromium.bartleyeditions.com/owners-file-governance): Recursive directory-scoped code-review authority in Chromium: each directory's OWNERS file names the engineers whose LGTM the commit queue requires before any change in that directory can merge. (draft — not yet reviewed)
- [Commit Queue Gate](https://chromium.bartleyeditions.com/commit-queue-gate): The automated gate that turns a reviewed Chromium CL into a landed change only after CQ trybots, presubmits, and tree status pass. (draft — not yet reviewed)
- [Presubmit Script Gate](https://chromium.bartleyeditions.com/presubmit-script-gate): Directory-scoped executable policy in Chromium: PRESUBMIT.py checks run during upload, commit, and CQ processing so local invariants fail before a CL lands. (draft — not yet reviewed)
- [Chromium Waterfall](https://chromium.bartleyeditions.com/chromium-waterfall): The LUCI builder-group surface that shows Chromium's continuous-integration health across main CI, perf CI, try builders, and CQ builders. (draft — not yet reviewed)
- [Tree Sheriff](https://chromium.bartleyeditions.com/tree-sheriff): The rotating on-call role that keeps the Chromium build tree green: a Tree Sheriff reverts test-breaking changes without the author's permission and opens or closes the tree to gate further commits. (draft — not yet reviewed)
- [Perf Sheriff](https://chromium.bartleyeditions.com/perf-sheriff): The rotating on-call role that watches Chromium's performance regression dashboard, bisects each alert to a causative commit, and files an SLA-bound bug against the responsible team. (draft — not yet reviewed)
- [Conway's Law in Multi-Org Chromium](https://chromium.bartleyeditions.com/conways-law): Chromium's source-tree component boundaries mirror its contributing organizations, so the architecture can't be read as a purely technical optimum without naming who decided what at which scale. (draft — not yet reviewed)
- [Cross-Timezone Review Etiquette](https://chromium.bartleyeditions.com/cross-timezone-review): The conventions that keep Chromium code review moving across the eight-to-ten-hour gap between US and European contributors: self-sufficient change descriptions, explicit attention-set routing, and a 48-hour ping convention. (draft — not yet reviewed)

## Knowledge and Epistemology

- [Design Document Staleness](https://chromium.bartleyeditions.com/design-doc-staleness): A design document accurately described the architecture when written, then stopped tracking the code, and nothing in the page or the tooling warns the reader that its claims have drifted. (draft — not yet reviewed)
- [Tribal Knowledge](https://chromium.bartleyeditions.com/tribal-knowledge): The architectural constraints, historical rationale, and unwritten conventions senior Chromium contributors carry outside indexed records, available only by asking the right person. (draft — not yet reviewed)
- [Formal-Informal Channel Split](https://chromium.bartleyeditions.com/formal-informal-split): Chromium runs two communication systems at once — indexed, citable formal channels and ephemeral informal ones — and the freshest operational knowledge often lives in the informal half first. (draft — not yet reviewed)

## Optional

- [Colophon](https://chromium.bartleyeditions.com/colophon): Publication credits, copyright, and the editorial statement for Chromium Patterns — a sourced technical reference catalog, not advice.