COOP (Cross-Origin-Opener-Policy) controls whether your page shares a browsing context group with windows it opens or that open it. COEP (Cross-Origin-Embedder-Policy) controls which cross-origin resources your page may load. Set together, they make a page cross-origin isolated, which unlocks features such as SharedArrayBuffer.
Definitions in plain words
A browsing context group is the set of windows and tabs that can hold references to each other, for example through the value returned by window.open(). By default, a page you open can keep a reference back to you, and you can keep one to it.
COOP lets a page say "do not put me in a group with documents I do not trust." When a page lands in a new group, references between it and its opener are severed, and the browser may give it its own process. MDN notes this also blocks a class of cross-origin attacks known as XS-Leaks, because an attacker can no longer open your page and inspect the returned window.
COEP works on the other side of the page. It decides what the page may embed. Under the default value, unsafe-none, the page can load cross-origin images, scripts and similar resources without anyone's explicit permission. Under require-corp, it can only load resources that are same-origin, that opt in with a Cross-Origin-Resource-Policy header, or that are fetched in CORS mode and allowed by CORS.
Which feature needs them
MDN states that some features, including access to SharedArrayBuffer and unthrottled timers through Performance.now(), are only available when the document is cross-origin isolated. To get there you need all of the following:
- COOP set to
same-origin. - COEP set to
require-corporcredentialless. - The feature not blocked by a Permissions-Policy for cross-origin-isolated.
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
You can confirm the result in the browser. The crossOriginIsolated property is true on a document that qualifies, and your code can check it before creating a SharedArrayBuffer.
Do you need them if you use none of those features?
Not necessarily. COOP has a security benefit by itself, since severing the opener link reduces what other windows can learn about your page. COEP, however, mostly matters as the price of isolation. If you do not need SharedArrayBuffer or precise timers, COEP can break embeds for little gain.
| Goal | COOP | COEP |
|---|---|---|
| Use SharedArrayBuffer | same-origin | require-corp or credentialless |
| Cut the opener link only | same-origin or same-origin-allow-popups | not needed |
| Leave behaviour unchanged | unsafe-none (default) | unsafe-none (default) |
A rollout path that avoids surprises
- List every cross-origin resource the page loads: images, scripts, fonts, iframes, analytics tags.
- For each one, decide whether the owner can add a CORP header, whether you can load it with the
crossoriginattribute, or whether it should go. - Add a
report-toparameter to COEP, with a matching Reporting-Endpoints header, so the browser tells you what was blocked. - Turn on the headers on a staging host first and watch the reports.
- Check
crossOriginIsolatedin the console before shipping the feature that depends on it.
Pages that open a payment or sign-in popup need extra care with COOP. The next post in this series covers the same-origin-allow-popups value that exists for that case: COOP same-origin-allow-popups and OAuth popups.
Quick check
Does COEP replace CORS?
No. MDN says COEP governs resources requested in no-cors mode. Requests made in cors mode are still controlled by CORS, and COEP does not override a CORP or CORS policy the resource already has.
Will COOP same-origin break my site?
It can break flows that rely on a reference to a window you opened or one that opened you, such as some popup logins. Test those flows before enforcing it.
How do I know isolation worked?
Read crossOriginIsolated in the page console. If it is false, check both headers, and any Permissions-Policy that blocks the feature.
Safeguard builds SBOMs and scans dependencies, which helps you see which third-party packages and scripts your front end actually pulls in before you decide what COEP will block. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
