Third-party iframe Cache Storage clearing test

What this tests

This page embeds a cross-site iframe from another origin. The iframe writes a persistent tracking id into its own Cache Storage (window.caches) and reads it back. Cache Storage is origin-scoped and disk-backed, so a third-party frame can use it to re-identify a visitor across sessions, exactly like a third-party cookie.

Brave's "Forget me when I close this site" (Forgetful Browsing) shield is supposed to purge all storage tied to the embedding first-party site once its last tab is closed, including partitioned third-party storage. This checks whether the iframe's Cache Storage is included in that purge.

How to run it

1. Open Brave's Shields panel for this site and enable "Forget me when I close this site". Reload the page.
2. Click Set tracking id to have the iframe write a fresh id into its Cache Storage.
3. Click Get tracking id to confirm the iframe reads it back.
4. Close every tab open to this first-party origin (and optionally quit Brave). Wait at least 30 seconds.
5. Reopen the browser, return to this page, and click Get tracking id without setting one first.

Expected behavior

• With Forgetful Browsing on: after closing the site the id should be gone. Getting the id should report no id. If the same id comes back, the iframe's Cache Storage survived the close and the shield failed to clear third-party storage – a cross-session tracking leak.
• With the shield off: the id is expected to persist. This confirms the test actually persists third-party state.

Run

First-party origin:

Third-party iframe origin:

Set tracking id Get tracking id Clear tracking id

Tracking id: —

Third-party frame