v132 · security

Document-Isolation-Policy

Document-Isolation-Policy allows a document to enable crossOriginIsolation for itself, without having to deploy COOP or COEP, and regardless of the crossOriginIsolation status of the page. The policy is backed by process isolation. Additionally, the document non-CORS cross-origin subresources will either be loaded without credentials or will need to have a C

concepts

  1. Document-Isolation-Policy

    Standalone agent cluster + Spectre-isolation without COOP/COEP coordination.

  2. popup compatibility

    Why DIP exists: the COOP+COEP severing problem mapped against opener / 3p-iframe scenarios.

  3. live COI probe

    Four live probes — crossOriginIsolated, SharedArrayBuffer, measureUserAgentSpecificMemory(), timer resolution — that actually invoke each API and report the real outcome.

  4. policy comparator

    COOP+COEP vs DIP credentialless vs DIP require-corp. Side-by-side cards with effects, complexity, and a "pick this one if…" verdict.

why it shipped

Developers want to build applications that are fast using SharedArrayBuffers (SAB), which can improve computation time by ~40%. But SharedArrayBuffers allow to create high-precision timers that can be exploited in a Spectre attack, allowing to leak cross-origin user data. To mitigate the risk, SharedArrayBuffers are gated behind crossOriginIsolation (COI). CrossOriginIsolation requires to deploy both Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP). Both have proven hard to deploy, COOP because it prevents communication with cross-origin popups, and COEP because it imp

references