v137 · security

Document-Isolation-Policy

Document-Isolation-Policy allows a document to enable crossOriginIsolation for itself, without having to deploy COOP or COEP, and regardless of the crossOriginIsolation status of the page. The policy is backed by process isolation. Additionally, the document non-CORS cross-origin subresources will either be loaded without credentials or will need to have a C

concepts

  1. Document-Isolation-Policy

    A new header that opts a document into its own agent cluster + Spectre-isolation, without requiring COOP/COEP coordination across all subresources.

  2. DIP vs COOP+COEP

    Side-by-side capability matrix and live probes — popup messaging, third-party assets — for the trade-off that kept Gmail/Meet/Zoom off SharedArrayBuffer for years.

  3. Policy Builder

  4. Isolation Feature Probe

    Probes this page's live isolation status — crossOriginIsolated, SharedArrayBuffer availability, timer precision, Atomics, and Wasm threads — then shows a side-by-side feature matrix comparing No Isolation, COOP+COEP, and Document-Isolation-Policy.

    Pick a DIP value plus your page’s embed shape; the builder generates the exact response headers, decides crossOriginIsolated / SAB / process-isolation, and shows what each cross-origin subresource will do.

why it shipped

Developers want to build applications that are fast using SharedArrayBuffers (SAB), which can improve computation time by ~40%. But SharedArrayBuffers allow to create high-precision timers that can be exploited in a Spectre attack, allowing to leak cross-origin user data. To mitigate the risk, SharedArrayBuffers are gated behind crossOriginIsolation (COI). CrossOriginIsolation requires to deploy both Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP). Both have proven hard to deploy, COOP because it prevents communication with cross-origin popups, and COEP because it imp

references