v137 · security · headers
Isolation Feature Probe
Probe this page's isolation status: crossOriginIsolated, SharedArrayBuffer availability, high-resolution timer precision, and which headers are active. Then compare the three paths to cross-origin isolation — COOP+COEP, Document-Isolation-Policy, and no isolation — in a feature matrix.
This page's isolation status
Isolation flags
Available APIs
Path comparison matrix
| Feature | No isolation | COOP + COEP | Document-Isolation-Policy (v137) |
|---|---|---|---|
| crossOriginIsolated = true | ✗ | ✓ | ✓ |
| SharedArrayBuffer available | ✗ | ✓ | ✓ |
| High-res performance.now() | Jittered | ✓ Precise | ✓ Precise |
| Allows popups to non-isolated pages | ✓ | ✗ (COOP blocks) | ✓ |
| Allows cross-origin iframes without COEP | ✓ | ✗ (COEP blocks) | ✓ |
| Works in cross-origin iframes | ✓ | ⚠ requires parent opt-in | ✓ |
| Required HTTP headers | none | COOP: same-origin COEP: require-corp |
Document-Isolation-Policy: isolate-and-require-corp |
Header snippet
## Option A — COOP + COEP (blocks popups and non-CORP iframes)
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
## Option B — Document-Isolation-Policy (Chrome 137+)
## Achieves crossOriginIsolated without restricting popups or embedders
Document-Isolation-Policy: isolate-and-require-corp
Document-Isolation-Policy lets a page opt in to cross-origin isolation
(
crossOriginIsolated = true) without needing COOP, which blocks same-origin
popups, or COEP, which requires all embedded resources to opt in. It's designed for
pages that need SharedArrayBuffer but can't retrofit their entire
infrastructure with COOP/COEP headers.