Cybersecurity glossary
What is Cross-Origin Isolation?
Learn what cross-origin isolation is, how COOP and COEP enable it, why browsers gate SharedArrayBuffer behind isolation, and how to adopt isolation without breaking third-party embeds.
Definition
Cross-origin isolation is a browser security state where a document runs in a separate process-like boundary from untrusted origins, achieved when Cross-Origin Opener Policy and Cross-Origin Embedder Policy are enforced together, exposing window.crossOriginIsolated and unlocking gated APIs.
Why cross-origin isolation matters
Modern web apps want powerful primitives—shared memory, fine-grained timing, and WASM threads—without giving every cross-origin script and iframe a seat at the same table. After Spectre-class attacks, browsers stopped handing out those capabilities to arbitrary pages.
Cross-origin isolation is the platform's answer: a document proves it has severed risky opener ties and blocked unapproved cross-origin embeds. Only then does window.crossOriginIsolated become true and gated APIs become available under the browser's threat model.
How cross-origin isolation works
Isolation is not a single header. The browser evaluates COOP on the document, COEP on embed rules, and CORP or CORS opt-in on each cross-origin subresource. All pieces must align for the isolated state.
Document sends COOP
Cross-Origin-Opener-Policy: same-origin detaches cross-origin opener relationships.
Document sends COEP
Cross-Origin-Embedder-Policy: require-corp blocks cross-origin resources without opt-in.
Subresources opt in
Cross-origin scripts, workers, images, and fonts declare CORP or CORS compatibility.
Browser promotes isolation
When requirements are met, the browsing context becomes cross-origin isolated.
Gated APIs unlock
Features such as SharedArrayBuffer become available where the platform ties them to isolation.
JavaScript can verify
window.crossOriginIsolated reports true, letting apps adjust behavior or telemetry.
Isolation building blocks
COOP
Isolates the document from cross-origin openers and shared browsing context groups.
COEP
Requires every cross-origin embed to opt in, preventing silent third-party inclusion.
CORP
Lets resource owners explicitly allow cross-origin loading under COEP.
CORS
Alternative opt-in for certain fetches when COEP policies accept CORS-enabled resources.
crossOriginIsolated
Runtime flag applications read to confirm the page reached the isolated state.
credentialless
A COEP variant that loads cross-origin resources without credentials in some deployments.
Isolation vs everyday security headers
| Control | Role in isolation | What it is not |
|---|---|---|
| COOP same-origin | Required opener isolation for the document | A clickjacking or CSP substitute |
| COEP require-corp | Required embedder lockdown | A WAF or API auth layer |
| CORP cross-origin | Opt-in for cross-origin static assets | Permission to read private API JSON |
| CSP | Complementary script and frame policy | Sufficient alone for crossOriginIsolated |
| HTTPS | Prerequisite transport security | Equivalent to process-level isolation |
Adoption checklist
- Confirm product need for SharedArrayBuffer, WASM threads, or other gated APIs before enforcing isolation.
- Enable COOP and COEP in staging with reporting before production enforcement.
- Audit every cross-origin script, font, image, iframe, and worker for CORP or CORS opt-in.
- Inventory OAuth and payment popups that depend on window.opener across origins.
- Provide self-hosted or proxied alternatives when vendors cannot emit compatible headers.
- Set isolation headers on HTML entry documents served through CDNs, not only origin hits.
- Monitor window.crossOriginIsolated in synthetic checks after deploys.
- Document exceptions; credentialless COEP is not a drop-in for every third-party embed.
Limits and pitfalls
Isolation is brittle. One cross-origin image without CORP can prevent the entire page from becoming isolated. Teams sometimes disable COEP globally instead of fixing asset headers, which forfeits both isolation and its security benefits.
Isolation also does not make a page safe from XSS or CSRF. It narrows cross-origin process and embed relationships. Application vulnerabilities remain application problems.
The practical takeaway
Cross-origin isolation is a browser state earned through COOP, COEP, and careful subresource opt-in. It unlocks powerful APIs and hardens the boundary between your document and untrusted origins.
Treat isolation as a coordinated platform project: map embeds, negotiate vendor headers, test auth popups, and verify window.crossOriginIsolated in production—not as a single-header toggle.
Related security terms
Cross-Origin Opener Policy (COOP)
Isolates browsing context groups from cross-origin openers; required for isolation.
Cross-Origin Embedder Policy (COEP)
Blocks cross-origin embeds unless resources opt in; the second isolation requirement.
Cross-Origin Resource Policy (CORP)
Header subresources use to opt into loading on an isolated page.
Cross-Origin Resource Sharing (CORS)
Alternative opt-in path for cross-origin resources under COEP require-corp.
Frequently asked questions
What is cross-origin isolation in simple terms?
It is a strict browser mode where your page is walled off from other origins' windows and untrusted cross-origin embeds. You get it by sending the right COOP and COEP headers, and the page can check window.crossOriginIsolated.
Which headers enable cross-origin isolation?
Typically Cross-Origin-Opener-Policy: same-origin together with Cross-Origin-Embedder-Policy: require-corp (or credentialless in some setups). Both must be set on the document and its nested navigations as required by the platform.
Why did browsers require isolation for SharedArrayBuffer?
High-resolution timers and shared memory increase side-channel risk such as Spectre. Isolation reduces cross-origin data in the same sensitive process context, so browsers gate those APIs behind COOP and COEP.
How do I check if a page is isolated?
In JavaScript, window.crossOriginIsolated returns true in an isolated context. DevTools application panels and reporting headers also help verify COOP and COEP are present on the HTML response.
Will isolation break third-party widgets?
Often yes, unless those resources send CORP cross-origin or CORS opt-in compatible with COEP. Plan a migration: self-host, proxy, or negotiate headers with vendors before enforcing require-corp in production.
Is isolation the same as HTTPS?
No. HTTPS encrypts transport. Cross-origin isolation is an additional browser boundary for window relationships and embeds. Secure sites still need deliberate COOP and COEP to become isolated.
References
Explore authoritative guidance and frameworks related to cross-origin isolation.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.