Interestingly enough they are already blocking these attacks for background requests, see https://github.com/chromium/chromium/blob/83.0.4103.53/third_party/bli

Interestingly enough they are already blocking these attacks for background requests, see https://github.com/chromium/chromium/blob/83.0.4103.53/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc#L251 https://github.com/chromium/chromium/blob/83.0.4103.53/third... Perhaps they simply forgot to cover also the WebSockets case, or the discussion on the related bug was not allowing for expanding the coverage.