Browser security
Compatibility & evidence
Cross-origin isolation

Credentialless cross-origin embedding

Allows selected cross-origin no-CORS resources to load without credentials under COEP.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27Not supportedAt least one required mapped feature is not available at this browser baseline.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157Not supportedAt least one required mapped feature is not available at this browser baseline.
Safari on iOS27Not supportedAt least one required mapped feature is not available at this browser baseline.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 1 – 9594 recorded releases
    Not supported
  2. 96 – 15560 recorded releases
    Works

Edge

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 12 – 9523 recorded releases
    Not supported
  2. 96 – 15459 recorded releases
    Works

Firefox

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 1 – 118121 recorded releases
    Not supported
  2. 119 – 15739 recorded releases
    Works

Safari

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 1 – 2761 recorded releases
    Not supported

Chrome for Android

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 18 – 9571 recorded releases
    Not supported
  2. 96 – 15560 recorded releases
    Works

Firefox for Android

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 4 – 157141 recorded releases
    Not supported

Safari on iOS

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 1 – 2758 recorded releases
    Not supported

Android WebView

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 1 – 9566 recorded releases
    Not supported
  2. 96 – 15560 recorded releases
    Works

Samsung Internet

http.headers.Cross-Origin-Embedder-Policy.credentialless
  1. 1.0 – 16.236 recorded releases
    Not supported
  2. 17.0 – 30.016 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Credential-bearing cross-origin resource inclusion
  • Isolation deployment gaps

Does not guarantee

  • Public resource disclosure
  • Application authorisation
  • CORS correctness

What you need before using it

  • COEP deployment
  • A resource inventory that tolerates credential omission

Fallback to keep in place

Use require-corp with explicit CORS or CORP opt-in from embedded resources.