v150 · Security · Workers

data: URL Worker Test

Spin up a worker from a data: URL and probe its origin. Chrome 150 aligns with the spec: self.origin reports "null" (opaque) instead of inheriting the page's origin. The test also checks whether BroadcastChannel, localStorage, and IndexedDB are accessible — all origin-sensitive APIs that behave differently for opaque origins.

Detecting Chrome version…

Page origin (window.location.origin)

—

BroadcastChannel nuance: an opaque-origin worker may still construct new BroadcastChannel(name). The isolation boundary is that its messages are scoped to a different origin namespace, so the page should not receive a broadcast from the data: URL worker.

What changed and how to migrate

Before Chrome 150 (spec non-compliant)

// Worker inherited page origin — could join
// BroadcastChannels and read localStorage
const code = `
  // self.origin === "https://yoursite.com"
  const bc = new BroadcastChannel('shared');
  bc.postMessage({ from: 'worker' });
`;
const w = new Worker(
  'data:text/javascript,' + encodeURIComponent(code)
);

Chrome 150+ (spec compliant — use Blob URL)

// Worker gets page origin — BroadcastChannel works
const code = `
  // self.origin === "https://yoursite.com"
  const bc = new BroadcastChannel('shared');
  bc.postMessage({ from: 'worker' });
`;
const blob = new Blob([code], { type: 'text/javascript' });
const url = URL.createObjectURL(blob);
const w = new Worker(url);

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗

What changed and how to migrate

see also

implementation reference