Browser & Web Performance Senior interview questions and answers

75 questions for a Browser & Web Performance (Senior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.What does Site Isolation in Chromium guarantee?
  2. 2.Why did browsers disable SharedArrayBuffer by default and then re-enable it only for cross-origin isolated pages?
  3. 3.Which pair of headers makes a page cross-origin isolated (self.crossOriginIsolated === true)?
  4. 4.After enabling COEP: require-corp, third-party images stopped loading. What are the options?
  5. 5.What does Cross-Origin-Opener-Policy: same-origin protect against, besides enabling isolation?
  6. 6.What is Cross-Origin-Resource-Policy: same-site for?
  7. 7.What are Fetch Metadata request headers like Sec-Fetch-Site useful for on the server?
  8. 8.What are XS-Leaks?
  9. 9.Why can a transform animation stay smooth even when the main thread is blocked by a long task?
  10. 10.What is the frame budget for 60 Hz rendering and why is it lower than 16.7 ms in practice?
  11. 11.Why can a single class change on <body> be expensive in a large app?
  12. 12.What does 'layer explosion' refer to?
  13. 13.What does content-visibility: hidden do differently from display: none?
  14. 14.In what case can content-visibility: auto make CLS or scrolling worse?
  15. 15.What does 'paint holding' in Chromium do for same-origin navigations?
  16. 16.What does the Long Animation Frames (LoAF) API add over the Long Tasks API?
  17. 17.Why can hydration hurt INP on server-rendered pages?
  18. 18.What does scheduler.postTask(fn, { priority: "background" }) let you do?
  19. 19.INP is poor, but every event handler takes under 20 ms. What should you look at?
  20. 20.Why is lab INP debugging often misleading compared to the field?
  21. 21.How can garbage collection affect INP?
  22. 22.Why are rendering updates in requestAnimationFrame sometimes a hidden source of poor INP?
  23. 23.Why are Core Web Vitals assessed at the 75th percentile?
  24. 24.Your RUM shows LCP p75 got worse, but Lighthouse scores are unchanged. What's a likely reason?
  25. 25.How should performance budgets be enforced in CI for reliable results?
  26. 26.What's the benefit of sending LCP attribution (element, sub-parts) along with the value?
  27. 27.What effect does bfcache eligibility have on field metrics?
  28. 28.Which header has historically prevented a page from entering bfcache in Chrome?
  29. 29.How should a page react when it is being prerendered via Speculation Rules?
  30. 30.What's a trade-off of inlining critical CSS in the HTML?
  31. 31.How does streaming HTML from the server help LCP?
  32. 32.With HTTP/2 or HTTP/3, why might bundling everything into one JS file still not be ideal?
  33. 33.What is the main pitfall of a cache key that includes unnecessary request data, like all cookies?
  34. 34.What is web cache poisoning?
  35. 35.Why might ETags generated from inode or modification time cause poor cache revalidation behind a load balancer?
  36. 36.What problem do targeted headers like CDN-Cache-Control solve?
  37. 37.What does Cache-Control: immutable change?
  38. 38.Why is caching an authenticated API response in a shared CDN cache dangerous even with a short TTL?
  39. 39.What's wrong with this CORS check?
  40. 40.Why is allowing Origin: null in CORS risky?
  41. 41.Does a correct CORS configuration protect an API from CSRF?
  42. 42.An internal service on http://192.168.0.10 should not be reachable by scripts on public websites. What browser mechanism addresses this?
  43. 43.Why do preflights hurt performance in an API-heavy SPA, and how can you reduce them?
  44. 44.What does 'strict-dynamic' in a CSP do?
  45. 45.Why are host-allowlist CSPs like script-src 'self' https://cdn.example.com often bypassable?
  46. 46.Why should a strict CSP include base-uri 'none' (or 'self')?
  47. 47.How do you roll out a new CSP without breaking production?
  48. 48.What do Trusted Types enforce?
  49. 49.What is mutation XSS (mXSS)?
  50. 50.What is DOM clobbering?
  51. 51.Why is it better to encode output for its context than to filter 'bad' input once on arrival?
  52. 52.What does an HttpOnly session cookie NOT protect against when there's XSS?
  53. 53.What is the danger of injecting server data into an inline script like this?
  54. 54.Where should HTML from users be sanitized in a system that renders it in a web app and a mobile app?
  55. 55.What does the __Host- cookie name prefix guarantee?
  56. 56.Why doesn't SameSite protect against attacks from a compromised subdomain like blog.example.com?
  57. 57.What does CHIPS (Partitioned cookies) change for an embedded widget?
  58. 58.What happens when an origin's storage exceeds the browser's quota or the device runs low on disk?
  59. 59.What is storage partitioning in modern browsers?
  60. 60.Why can a single large HTML document still have a slow TTFB with HTTP/3 and a CDN?
  61. 61.What does HTTP/2 connection coalescing allow?
  62. 62.Why is 'domain sharding' an anti-pattern with HTTP/2?
  63. 63.What does TLS 1.3 improve for page load compared to TLS 1.2?
  64. 64.What's the point of Link: <...>; rel=preload sent as an HTTP header instead of in HTML?
  65. 65.Why is a sandboxed iframe on a separate origin a common way to render untrusted HTML (e.g. user-generated widgets)?
  66. 66.Why is allow-scripts allow-same-origin on a sandboxed iframe with same-origin content dangerous?
  67. 67.What is the purpose of HSTS preloading?
  68. 68.Which approach to third-party scripts limits both performance and security risk the most?
  69. 69.Why should the CSP be sent as an HTTP header rather than a <meta> tag when possible?
  70. 70.What does a service worker mean for XSS impact?
  71. 71.What is the most important limitation of a Web Application Firewall (WAF) against XSS?
  72. 72.What's the main idea of the RAIL performance model?
  73. 73.The hero heading fades in with an animation from opacity: 0. How can this affect LCP?
  74. 74.Why do 'anti-flicker' snippets of client-side A/B testing tools often hurt LCP?
  75. 75.Why doesn't loading a popular font from a public font CDN benefit from other sites' caches anymore?