Cybersecurity glossary
What is Cross-Origin Embedder Policy (COEP)?
Learn what Cross-Origin Embedder Policy (COEP) is, how it restricts cross-origin embeds unless resources opt in, why it pairs with COOP for isolation, and how to adopt it safely.
Definition
Cross-Origin Embedder Policy (COEP) is an HTTP response header that instructs the browser to block the page from loading cross-origin resources unless those resources explicitly opt in via CORS or Cross-Origin-Resource-Policy, enabling stronger cross-origin isolation.
Why COEP exists
Modern browsers isolate origins by default, but pages still embed large amounts of cross-origin content: CDNs, analytics, fonts, media, and widgets. Some powerful features and Spectre-era mitigations need a clearer guarantee that a document is not mixed with arbitrary unconsenting cross-origin resources.
Cross-Origin Embedder Policy (COEP) gives a page that guarantee. When enabled with require-corp, the embedder refuses cross-origin resources that have not opted in. Paired with COOP, this is the usual path to a cross-origin isolated browsing context.
How COEP works
COEP is delivered as an HTTP response header on the document. The browser then applies embedder checks to subresources and nested frames.
Document declares COEP
The page response includes Cross-Origin-Embedder-Policy: require-corp (or a compatible value).
Browser loads subresources
Images, scripts, styles, fonts, media, workers, and frames are requested as usual.
Same-origin resources pass
Resources from the document’s own origin are not subject to the cross-origin opt-in requirement.
Cross-origin resources need opt-in
They must present CORP or be loaded in a mode that satisfies CORS/CORP rules for COEP.
Non-opted resources are blocked
Missing headers cause load failures visible in DevTools and broken UI until fixed.
Isolation features unlock
With COOP+COEP isolation complete, certain high-risk APIs become available under browser policy.
COEP, CORP, and CORS
| Header / mechanism | Role with COEP |
|---|---|
| COEP on the document | Requires cross-origin embeds to opt in before loading into this page. |
| Cross-Origin-Resource-Policy on resources | Resource declares who may include it (same-origin, same-site, or cross-origin). |
| CORS on resources | Alternative opt-in path for some request modes so COEP can accept the resource. |
| COOP on the document | Isolates the browsing context; together with COEP establishes cross-origin isolation. |
Practical adoption pattern
Inventory embeds
List every cross-origin script, image CDN, font host, frame, and media provider on critical pages.
Prefer first-party hosting
Self-host critical static assets when vendors cannot send CORP/CORS headers.
Add CORP on your CDNs
Ensure your own cross-origin asset hosts send appropriate Cross-Origin-Resource-Policy values.
Enable with COOP
Set Cross-Origin-Opener-Policy to a isolating value such as same-origin when isolation is the goal.
Checklist before enforcing COEP
- Test in staging with browser DevTools network and console for blocked cross-origin loads.
- Coordinate with third parties that must support CORP or CORS for your embed patterns.
- Verify workers, WASM, and audio/video pipelines—not only visible images.
- Set COOP intentionally; COEP alone may not produce the isolation state you expect.
- Monitor real-user errors after rollout; embed failures can be geographically or A/B specific.
- Document why isolation is required so future developers do not remove headers to 'fix ads'.
- Remember CSP and COEP solve different problems; do not treat one as a substitute for the other.
- Re-check mobile webviews and embedded partner experiences that may lack header support.
When not to rush COEP
Marketing sites heavy with unmanaged third-party tags may break extensively under require-corp. If you do not need cross-origin isolation APIs, prioritize CSP, HTTPS, and cookie security first. Adopt COEP when product requirements or threat models justify the embed inventory work.
The practical takeaway
Cross-Origin Embedder Policy (COEP) blocks cross-origin embeds unless resources explicitly opt in. It is a cornerstone of cross-origin isolation when combined with COOP, and a compatibility project for any page that leans on third-party content.
Enable COEP deliberately: inventory embeds, fix CORP/CORS on required resources, pair with COOP, and verify that the isolation benefits outweigh the operational cost.
Related security terms
Cross-Origin Opener Policy (COOP)
Companion header that isolates browsing contexts and, with COEP, enables cross-origin isolation.
Cross-Origin Resource Sharing (CORS)
One opt-in mechanism that can allow cross-origin resources under COEP.
Same-Origin Policy (SOP)
The baseline browser model that COEP strengthens for embedded resource control.
Content Security Policy (CSP)
A separate policy layer controlling script and content sources rather than embedder isolation.
Frequently asked questions
What is COEP in simple terms?
COEP tells the browser that a page will only embed cross-origin images, scripts, frames, and other resources if those resources explicitly allow it. This helps isolate the page from unconsenting cross-origin content.
What does Cross-Origin-Embedder-Policy: require-corp mean?
require-corp means cross-origin resources must explicitly opt in through CORS or a Cross-Origin-Resource-Policy header. Resources without opt-in are blocked from loading into the page.
Why do developers enable COEP?
COEP, usually combined with COOP, creates a cross-origin isolated context. That isolation unlocks powerful APIs such as SharedArrayBuffer in modern browsers and reduces certain cross-origin attack surfaces.
Is COEP the same as CORS?
No. CORS is a mechanism for relaxing same-origin read restrictions when servers opt in. COEP is a page policy that requires embedded cross-origin resources to opt in before they can load.
What breaks when enabling COEP?
Third-party images, scripts, fonts, frames, and media that lack CORP or CORS headers often stop loading. Teams must inventory embeds and coordinate with vendors or self-host resources.
How do resource owners opt in for COEP pages?
They can send Cross-Origin-Resource-Policy (for example, cross-origin) or serve the resource with CORS headers that permit the embedding origin, depending on resource type and usage.
Do all sites need COEP?
No. Enable it when you need cross-origin isolation or a stricter embed posture and can afford the compatibility work. Many sites never require SharedArrayBuffer-level isolation.
References
Explore authoritative guidance and frameworks related to cross-origin embedder policy (coep).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.