Web developers
Check whether a security feature will work for your supported browsers and learn which fallback should remain in place.
Browser security planning
Choose security features your supported browsers can handle
Select the oldest browser versions your website needs to support. ControlCurrent shows which security features should work, which need extra care, and where you may need a fallback.
- Uses published browser data
- Keeps known limitations visible
- Runs on your device
01 · works widely16features supported without a recorded limitation in current browsers
02 · needs care4features with at least one known browser limitation
03 · browser coverage9desktop and mobile browser families included
04 · data collection0visitor or website observations collected by this site
Who this is for
A practical guide for web and security teams
ControlCurrent is most useful when a team needs to balance stronger browser security with the older browser versions it has promised to support.
Security engineers
Build an explainable browser-security policy and review supplied header or deployment evidence without sending it to a service.
Platform and DevOps teams
Export repeatable results, compare changes, record approved exceptions, and add policy checks to continuous integration (CI).
Learners and reviewers
Understand what each browser protection does, where it is supported, and what it cannot guarantee.
Current browser versions
Security features at a glance
These cards show support in the current version of nine desktop and mobile browsers. Browser support does not prove that a website has configured a feature correctly.
Content execution1 browser data record
Content Security Policy
Restricts the browser resources and execution paths that a document may use.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content executionBrowser data unavailable
CSP nonce sources
Authorises selected inline scripts with unpredictable, response-specific nonce values.
ChromeNot enough browser dataEdgeNot enough browser dataFirefoxNot enough browser dataSafariNot enough browser dataChrome for AndroidNot enough browser dataFirefox for AndroidNot enough browser dataSafari on iOSNot enough browser dataAndroid WebViewNot enough browser dataSamsung InternetNot enough browser data
Content executionBrowser data unavailable
CSP hash sources
Authorises exact inline script or style content through cryptographic source expressions.
ChromeNot enough browser dataEdgeNot enough browser dataFirefoxNot enough browser dataSafariNot enough browser dataChrome for AndroidNot enough browser dataFirefox for AndroidNot enough browser dataSafari on iOSNot enough browser dataAndroid WebViewNot enough browser dataSamsung InternetNot enough browser data
Content execution1 browser data record
CSP strict-dynamic
Allows trust from a nonce- or hash-authorised script to propagate to scripts it loads.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record
CSP base-uri restriction
Restricts which URLs a document may use as its base URL.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record
CSP frame-ancestors restriction
Restricts which parent documents may embed a page in a frame.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record
CSP form-action restriction
Restricts the destinations to which a document may submit forms.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record
CSP upgrade-insecure-requests
Asks the browser to rewrite eligible insecure resource requests to HTTPS.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution1 browser data record
CSP sandbox
Applies a configurable sandbox to a protected resource.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution2 browser data records
Trusted Types enforcement
Restricts selected DOM injection sinks to values created through approved policies.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution2 browser data records
Subresource Integrity
Lets a document require external scripts and stylesheets to match expected digests.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Content execution2 browser data records
Subresource Integrity Policy
Requires selected script and style requests to carry integrity metadata, with an optional report-only rollout mode.
ChromeWorksEdgeWorksFirefoxWorks with limitsSafariWorksChrome for AndroidWorksFirefox for AndroidWorks with limitsSafari on iOSWorksAndroid WebViewWorksSamsung InternetNot supported
Cross-origin isolation1 browser data record
Cross-Origin-Opener-Policy
Controls whether a document shares a browsing context group with cross-origin documents.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewNot supportedSamsung InternetWorks
Cross-origin isolation1 browser data record
Cross-Origin-Embedder-Policy
Requires embedded cross-origin resources to opt in through CORS or resource policy.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Cross-origin isolation1 browser data record
Cross-Origin-Resource-Policy
Lets a resource state which origins or sites may embed it without CORS.
ChromeWorks with limitsEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorks with limitsFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorks with limitsSamsung InternetWorks
Cross-origin isolation1 browser data record
Credentialless cross-origin embedding
Allows selected cross-origin no-CORS resources to load without credentials under COEP.
ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks
Cross-origin isolation1 browser data record
Origin-Agent-Cluster
Requests origin-keyed browser agent clustering for a document.
ChromeWorksEdgeWorksFirefoxWorksSafariUnknownChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks
Cross-origin isolation4 browser data records
Fetch Metadata request headers
Supplies request context that servers can use in a resource-isolation policy.
ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record
Permissions Policy
Controls whether a document and its embedded frames may use selected browser capabilities.
ChromeWorksEdgeWorksFirefoxNot supportedSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetWorks
Transport and response hardening1 browser data record
HTTP Strict Transport Security
Tells supporting browsers to use HTTPS for a host during a declared period.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Transport and response hardening1 browser data record
X-Content-Type-Options nosniff
Prevents selected responses from being interpreted as a different MIME type.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Transport and response hardening1 browser data record
Clear-Site-Data
Requests removal of selected browser-held data for an origin.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record
Referrer Policy
Limits referrer information sent with navigations and subresource requests.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record
SameSite cookies
Restricts when cookies are attached to cross-site requests.
ChromeWorksEdgeWorksFirefoxWorksSafariWorks with limitsChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record
Partitioned cookies
Stores selected cross-site cookies in a partition keyed by the top-level site.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy1 browser data record
HttpOnly cookies
Prevents browser scripts from reading a cookie through ordinary cookie APIs.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewWorksSamsung InternetWorks
Browser privacy2 browser data records
Secure cookie prefixes
Applies browser-enforced naming constraints to __Secure-, __Host-, __Http-, and __Host-Http- cookies.
ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSNot supportedAndroid WebViewWorksSamsung InternetNot supported
Authentication1 browser data record
WebAuthn platform authenticator detection
Detects whether a user-verifying platform authenticator is available.
ChromeWorksEdgeWorksFirefoxWorks with limitsSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewNot supportedSamsung InternetWorks
Authentication2 browser data records
WebAuthn PRF extension
Derives scoped pseudorandom outputs from a compatible WebAuthn credential.
ChromeWorksEdgeWorksFirefoxWorksSafariNot supportedChrome for AndroidWorksFirefox for AndroidNot supportedSafari on iOSNot supportedAndroid WebViewNot supportedSamsung InternetWorks
Authentication1 browser data record
WebAuthn conditional mediation
Allows passkey suggestions to participate in a credential input flow without an immediate modal prompt.
ChromeWorksEdgeWorksFirefoxWorksSafariWorksChrome for AndroidWorksFirefox for AndroidWorksSafari on iOSWorksAndroid WebViewNot supportedSamsung InternetWorks
What ControlCurrent can tell you
What works, what needs care, and what needs a fallback
Create a browser plan to see whether each security feature is supported at the oldest browser versions you choose. Known limitations stay visible instead of being reduced to a simple yes or no.
What ControlCurrent cannot prove
- That every page and environment uses the feature correctly.
- That a browser or website has no security defects.
- That other layers of security are no longer needed.
- That a browser policy is right for every organisation.
You can also check information collected from a deployment without asking ControlCurrent to visit the website. The result is a review aid, not a security certificate.