That depends on cache headers sent from the server, which the attacker controls