On desktop Chrome, SharedArrayBuffer
has been only available to pages that are cross-origin isolated since Chrome 92. However, doing so requires loaded cross-origin resources to comply with certain rules (for example, served with a specific HTTP header such as Cross-Origin-Resource-Policy
).
To make it easier for developers to enable cross-origin isolation, Chrome has been working to introduce new options to relax the requirements for cross-origin resources:
Cross-Origin-Embedder-Policy: credentialless
: Load cross-origin resources without CORP headers using COEP: credentialless- iframe credentialless: Easily embed iframes in COEP environments
Cross-Origin-Opener-Policy: restrict-properties
: Secure popup interactions with restrict-properties
By incorporating these new options, we hope you will be able to enable cross-origin isolation with relaxed requirements without reducing the security level.
If your site relies on SharedArrayBuffer with site isolation, we have been running a deprecation trial so your website can be exempted from the restrictions. This trial provides more time, given that it has taken time to define the specifications and implement them.
As the ongoing deprecation trial is about to expire while we are still working on remaining solutions, the deprecation trial of SharedArrayBuffer
on desktop will be extended until Chrome 124. You don't have to take any action if you are already registered for the ongoing trial.