demo · v137

Cross-site Blob Navigation

The carve-out: top-level navigations to a blob: URL stay keyed by frame origin (not by storage partition). Subframe navigations to a foreign blob URL are blocked. This page sets two iframes loose on the same blob URL and reports who renders it.

probing…
blob URL(none yet)
top-level origin—

same-origin iframe

third-party (sandbox)

waiting…

the code

// Mint an HTML blob URL.
const html = "<h1>hello from a blob</h1>";
const url  = URL.createObjectURL(new Blob([html], { type: "text/html" }));

// Top-level navigation: still keyed by frame origin → works.
window.open(url, "_blank");

// Same-origin iframe: same storage partition → works.
sameFrame.src = url;

// Sandboxed (opaque-origin) iframe: foreign partition → blocked.
crossFrame.src = url;  // load fails / about:blank

see also