Partitioned cookie repro

Plant a nonce'd Partitioned cookie, then sweep the store.

A credentialless iframe gets an ephemeral cookie partition (nonce on the key, never written to disk). If that frame sets Set-Cookie: …; Partitioned; Secure; SameSite=None, the cookie lives in memory until the frame/session dies. Ghostery, Auto-Delete Cookies, and any extension that calls chrome.cookies.getAll({}) will hit that cookie and trip the serialize-on-nonce crash.

How to trip CHECK

  1. Leave this tab open so the credentialless frame stays alive.
  2. Wait until the status table shows the cookie was planted.
  3. Click CHECK in your test extension (or let Ghostery / Auto-Delete Cookies scan).

The cookie is transient. Closing this tab, navigating away, or discarding the frame evaporates it.

Status

Secure context -
credentialless supported -
Frame origin -
Frame loaded -
Header cookie visible -
document.cookie write -
Fetch Set-Cookie -
document.cookie -
Last update -

Waiting to plant the credentialless frame…

Credentialless frame

This iframe is created with credentialless, so Chromium assigns a nonce'd partition key. The document response and a same-frame fetch both send a CHIPS cookie. Use ?frameOrigin=https://other-host if you need a cross-origin embed of the same app.