demo · v137

Blob URL Partitioning

A blob: URL is now keyed to the top-level storage partition that created it. Same-origin same-partition fetches succeed. Cross-site fetches/navigations to a foreign blob URL fail — closing the historical sidechannel where blob URLs leaked across sites.

probing…
blob URL(none yet)
top-level origin—
iframe (third-party)
awaiting actions…

the code

// Top-level page mints a blob URL.
const url = URL.createObjectURL(new Blob(["hello"]));

// Same partition: fetch works.
await fetch(url);  // 200 OK

// Cross-site iframe tries to fetch the same URL.
// Pre-v137: worked.  Post-v137: throws / 0-status.
postMessage({ type: "fetch", url }, iframeOrigin);

see also