demo · v142

Isolation Audit

A live probe of every isolation signal available in this browser: crossOriginIsolated, document.domain writability, performance.now() timer clamping, and originAgentCluster. Results feed a Spectre risk meter. Try to allocate a SharedArrayBuffer and see whether isolation is strong enough.

isolation checklist

Spectre risk meter

high risk calculating… low risk
—

SharedArrayBuffer test

SharedArrayBuffer is only available when the page is cross-origin isolated. Clicking the button attempts to allocate a 1 MB SAB and reports whether it succeeds.

Not tested yet.

expected headers for full origin isolation

required response headers
Cross-Origin-Opener-Policy: same-origin Closes the opener browsing context group checking
Cross-Origin-Embedder-Policy: require-corp Requires CORP on all subresources checking
Origin-Agent-Cluster: ?1 Opts page into per-origin process isolation checking

site-keyed vs origin-keyed — what's the difference?

site-keyed (pre-Chrome 142 default)

  • All same-site origins share one renderer process (e.g. app.example.com + cdn.example.com)
  • A Spectre gadget in a low-trust same-site origin can read memory from the high-trust origin
  • document.domain can be written to relax the same-origin policy within a site
  • Origin isolation requires explicit opt-in via Origin-Agent-Cluster: ?1

origin-keyed (Chrome 142 stronger default)

  • Each origin gets its own renderer process — app.example.com ≠ cdn.example.com
  • Memory is not shared between origins; Spectre cross-origin reads fail
  • document.domain writes are blocked (or produce a security error)
  • Enables SharedArrayBuffer + high-resolution timers when paired with COOP + COEP

relevant API

// Check isolation level in JS
console.log(window.crossOriginIsolated);   // true = COOP+COEP both set
console.log(window.originAgentCluster);    // true = per-origin agent cluster

// timer clamping (anti-Spectre measure when NOT isolated)
// performance.now() resolution drops to 100µs or coarser without isolation
const t1 = performance.now();
/* tiny task */
const t2 = performance.now();
console.log("resolution hint:", t2 - t1, "ms");

// SharedArrayBuffer: only works with crossOriginIsolated === true
const sab = new SharedArrayBuffer(1024 * 1024); // throws if not isolated

see also