Cross-origin isolation

Observe isolation in the current document, not in an entire site

The browser crossOriginIsolated flag reports whether the currently executing document is isolated under the effective browsing context and document policies. This tool reads that flag only after you explicitly choose Check this page. It also records whether the browser considers the document a secure context, whether the window is top-level, whether SharedArrayBuffer is exposed, and whether the optional browser-specific memory measurement API is available. It does not retrieve HTTP headers or inspect all tabs and applications. An isolated observation is not a security grade or a promise about any other page.

Understand the relationship to COOP, COEP and permissions policy

For an ordinary top-level page to become cross-origin isolated, browsers commonly require Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Embedder-Policy: require-corp or credentialless, and permission to use the cross-origin-isolated feature. These mechanisms have different responsibilities: COOP influences browsing-context groups and opener relationships, while COEP governs embedding of cross-origin resources. The resulting browser flag is the observed outcome, not proof of any individual header value. To inspect declarations separately, use Security Headers and Trust Boundaries.

Check the application you actually control

Use the read-only capture expression provided by this page in the developer console of your own authorised application. It emits only a fixed versioned object of boolean capability flags, a permission-state label and a top-level-document flag. It does not read cookies, request URLs, DOM content, credentials, resource names or header values. Paste the returned JSON into this page for a local explanation. Imports are strictly parsed as data and are always marked user-supplied and unverified; this site cannot independently prove which page produced them.

Treat unavailable and contradictory evidence conservatively

An unavailable crossOriginIsolated property is not converted to false. A browser that cannot expose its permissions policy receives unavailable, not allowed. A capture claiming isolation=true while also claiming an insecure context or an explicitly denied isolation permission is rejected as contradictory under this diagnostic profile. A false isolation flag is a direct observation but not a diagnosis of missing COOP, missing COEP, third-party resource blocking, frame ancestry or permission policy; those causes require independent request and response evidence.

Do not confuse feature exposure with working application behavior

SharedArrayBuffer exposure is a capability indicator, not a test of transferring shared memory to a Worker or whether the application can run concurrent work. The optional user-agent-specific memory API may be unavailable for reasons unrelated to isolation, including browser implementation and user policy. The tool does not measure timer precision or memory use. Enabling restrictive isolation policies can affect popups, third-party login windows, cross-origin frames, images and scripts, so changes should be verified in an authorised test environment.

Bounds, privacy, no-network behavior and reproducibility

The imported snapshot limit is 8 KiB and it must contain exactly the documented seven fields. The existing strict JSON parser rejects duplicate object keys and excessive nesting. No arbitrary URL, script, command or embedded resource is executed by importing a capture. The runtime shares the existing browser-only Content Security Policy, blocking network connections after its assets are loaded. Explicit JSON export contains only enumerated capability results, uncertainty notes and fixed limits, not the original capture, page URL, origin, header values or credentials. Editing, clearing, reloading or leaving the page removes the displayed result.

Method references and related tools

MDN crossOriginIsolated explains observed browser state, while COOP and COEP describe response policy prerequisites. This tool does not inspect those headers or certify actual resource compatibility.

Security headers and trust boundaries · All tools · Overall measurement methodology