v150 · Workers · Security
Communication Tester
Chrome 150 assigns data: URL workers an opaque (null) origin. This changes which communication channels still work. postMessage still works (it's structural, not origin-based). BroadcastChannel is blocked (origin-scoped). localStorage and IndexedDB are inaccessible. This tester probes each channel live.
Key distinction:
postMessage is bidirectional messaging — it works between any two endpoints regardless of origin. BroadcastChannel, localStorage, and IndexedDB are origin-scoped — a null origin cannot join the page's channel or access the page's storage.
—works
—blocked/fails
—tests run
postMessage (direct)
untested
Create a data: URL worker. Send it a postMessage. Worker echoes back. Should still work — postMessage is not origin-gated.
//…
BroadcastChannel
untested
Open a BroadcastChannel on both the page and the data: worker. The worker's message should NOT reach the page — null origin is in a different channel namespace.
//…
self.origin in worker
untested
Ask the data: URL worker to report
self.origin. In Chrome 150 this should be "null" (opaque origin), not the page's origin.//…
localStorage access
untested
Ask the data: URL worker to read localStorage. A null-origin context cannot access storage — should throw a SecurityError.
//…
Transferable objects (postMessage)
untested
Transfer an ArrayBuffer to and from a data: URL worker. Transferables are structural and bypass origin checks — should work fine.
//…
Blob URL worker (workaround)
untested
Create the same worker from a Blob URL instead. The Blob URL inherits the page's origin — BroadcastChannel and storage work again.
//…
see also
- Origin Isolation Demo — worker origin probe
- Migration Patterns — before/after code
- data: URL Worker Test — live worker test
- Blob URL Converter — convert data: URL scripts to Blob URLs
implementation reference
Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗