Overview

Webkit and Chromium engine both perform pre-connections when visiting sites, even with uBlock Origin installed. Users cannot disable this in the options. The only browsers that mitigate this are Brave (Chromium), who remove them altogether, and Firefox (not by default, but users can still change it). uBlock Origin disables speculative connections by default, but this only works in Firefox:

[This] does not cause DNS lookups, preconnections and prefetches to be reliably blocked, because Chromium [and Webkit] allows web pages to override that user setting.

Speculative connections include:

DNS request prefetching (e.g. "Link prefetching" in Webkit Experiments)
Network Preloading
Preloading resources (e.g. "Link preload responsive images" in Webkit Experiments)

You may find a description and related website explanations on each of these here. The descriptions are geared towards Firefox preferences, but the content is applicable to all browsers.

Example

Here's an example from cnn.com that I took a screenshot of in Orion's console:

So, in this example, even though I have uBlock Origin blocking Google Tag Manager, Chrome, Safari, Orion all preload it despite my tracking settings.

Conclusion

Blocking trackers isn't enough. We need to remove altogether (or turn off by default) all preloading, prefetching, and preconnections. This will put Orion's tracking mitigations further inline with Brave and hardened Firefox.

Remove speculative connections from Orion