Months ago I noticed something strange in the Little Snitch Network Monitor: Safari was still connecting to web sites after every window had been closed. At the time, I thought this was just a Safari bug. I brought the issue to the attention of some Safari engineers, who I had hoped would look into it. Since then, Safari has seen several software updates, and recently I remembered to check again to see whether the issue was resolved. Unfortunately I could still reproduce it, so I decided to investigate further. To my horror, I discovered that Chrome and Firefox were doing it too. That’s too much a coincidence to be a bug, right? Could it be that web browsers are keeping open connections after windows are closed on purpose? If you don’t have Little Snitch installed on the Mac (you should!), you can still see the open (ESTABLISHED) connections using the lsof (list open files) command-line tool in Terminal:
lsof -i TCP
You can also see the resulting web traffic by taking a packet trace with tcpdump or a GUI such as Wireshark.
My next thought was to compare regular browser windows with private (incognito) windows. And this made a world of difference! Closing the private window closed the connections
— source lapcatsoftware.com | Jeff Johnson | Mar 17 2021