Chrome Network Action Predictor, Preloading all your Webpages

One of the useful features Chrome has had for a long is text prediction. When you start to search for something Google attempts to predict what you are looking for. This works for not only keywords but also for previous URLs that you may have visited.

Figure 1: Sample Google search with predictions

The toggle for preloading webpages in the current build of Chrome (88) can be found under:

Settings > Privacy and security > Cookies and other site data

Figure 2: Preload pages toggle in Chrome Settings

Well of course Google is tracking it all in a database. You can find it at the following path:

Windows:

C:\Users\<USERNAME>\Local\Google\Chrome\User Data\Default\Network Action Predictor

Android:

data\data\com.android.chrome\app_chrome\Default\Network Action Predictor

We don't get specific timestamps on when a hit was registered but we do get insight into what the user was typing out to get to a specific keyword or search. We also get the amount of hits and misses that specific URL receives. If a predicted URL is clicked on we get a hit added to the count. At this time I'm not exactly sure how long this data is retained.

The database consists of 4 tables, two of which are of interest include:

  • network_action_predictor
  • resource_prefetch_predictor_host_redirect

"Network_action_predictor" table contains the prediction information with text the user types, the URL that would be clickable and offered, and then the counts of hits and misses.

Figure 3: "network_action_predictor" table from Josh Hickman's Android 11 image

The "resource_prefetch_predictor_host_redirect" table contains only two columns, one with a URL and another with a protobuf blob. Decoding the blob using CyberChef we can see it pulls out the URL information alongside some other items.

Figure 4: protobuf blog from "resource_prefetch_predictor_host_redirect" table

The first #2 key is WebKit timestamp format which from what I can tell is the last visited date/time of that specific URL. We can also see here the network protocol (https) and the port number (443) the webpage used. It's unknown what the other values indicate at this time.

ALEAPP parser has been added to pull out the first table and an AXIOM custom artifact is already live on the Artifact Exchange.