Cross-Origin-Embedder-Policy · ControlCurrent

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

Browser	Minimum	Outcome	Reason
Chrome	155	Works	Every required mapped BCD feature is available without a recorded qualification.
Edge	154	Works	Every required mapped BCD feature is available without a recorded qualification.
Firefox	157	Works	Every required mapped BCD feature is available without a recorded qualification.
Safari	27	Works	Every required mapped BCD feature is available without a recorded qualification.
Chrome for Android	155	Works	Every required mapped BCD feature is available without a recorded qualification.
Firefox for Android	157	Works	Every required mapped BCD feature is available without a recorded qualification.
Safari on iOS	27	Works	Every required mapped BCD feature is available without a recorded qualification.
Android WebView	155	Works	Every required mapped BCD feature is available without a recorded qualification.
Samsung Internet	30.0	Works	Every required mapped BCD feature is available without a recorded qualification.

The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Cross-Origin-Embedder-Policy

1 – 8181 recorded releases
Not supported
83 – 15573 recorded releases
Works

Edge

http.headers.Cross-Origin-Embedder-Policy

12 – 8110 recorded releases
Not supported
83 – 15472 recorded releases
Works

Firefox

http.headers.Cross-Origin-Embedder-Policy

1 – 7881 recorded releases
Not supported
79 – 15779 recorded releases
Works

Safari

http.headers.Cross-Origin-Embedder-Policy

1 – 15.127 recorded releases
Not supported
15.2 – 2734 recorded releases
Works

Chrome for Android

http.headers.Cross-Origin-Embedder-Policy

18 – 8158 recorded releases
Not supported
83 – 15573 recorded releases
Works

Firefox for Android

http.headers.Cross-Origin-Embedder-Policy

4 – 6862 recorded releases
Not supported
79 – 15779 recorded releases
Works

Safari on iOS

http.headers.Cross-Origin-Embedder-Policy

1 – 15.124 recorded releases
Not supported
15.2 – 2734 recorded releases
Works

Android WebView

http.headers.Cross-Origin-Embedder-Policy

1 – 8556 recorded releases
Not supported
86 – 15570 recorded releases
Works

Samsung Internet

http.headers.Cross-Origin-Embedder-Policy

1.0 – 12.129 recorded releases
Not supported
13.0 – 30.023 recorded releases
Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

A fixed result snapshot

What those browser runs reported

Reviewed 11 October 2026

These are published results from specific stable-labelled browser builds. They are separate from the compatibility calculation and from evidence about your application. File outcomes and subtest counts stay separate. OK describes a completed harness, which can still contain failing subtests; Pass and Fail can also describe tests without a harness.

Exact browser builds, systems and source revision

firefox 157.0 · linux 22.04 · stable
Run 4877098740350976 · 2026-10-06T10:36:34.451Z to 2026-10-06T11:50:28.028Z
cc74d2669f5de548e808779877d1d33339ec5115
safari 27.0 (22625.1.29.11.27) · mac 27.0 · stable
Run 5164107446878208 · 2026-10-06T06:14:03.64Z to 2026-10-06T09:13:55.471Z
cc74d2669f5de548e808779877d1d33339ec5115
chrome 154.0.8037.92 · linux 22.04 · stable
Run 6218298311311360 · 2026-10-06T07:44:01.102Z to 2026-10-06T11:57:16.569Z
cc74d2669f5de548e808779877d1d33339ec5115

“Stable” is the upstream run label. Complete runtime flags were not supplied by the summary API. These results do not cover every browser version, mobile platform or operating system.

Cross-Origin-Embedder-Policy

html/cross-origin-embedder-policy

104 test files retained from 104 returned search matches. Only this exact directory prefix is included. This is the returned result inventory, not a claim that every possible suite test ran.

Browser build	Subtests passed / reported	File outcomes
firefox 157.0	443 / 580	93 OK · 11 Timeout
safari 27.0 (22625.1.29.11.27)	457 / 580	97 OK · 7 Timeout
chrome 154.0.8037.92	543 / 580	102 OK · 2 Timeout

Read all 104 retained file results

Test file	firefox	safari	chrome
`about-blank-popup.https.html`	OK · 0/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`blob.https.html`	OK · 9/9 subtests	Timeout · 6/9 subtests	OK · 9/9 subtests
`block-local-documents-inheriting-none.https.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`cache-storage-reporting-dedicated-worker.https.html`	OK · 0/2 subtests	OK · 0/2 subtests	OK · 2/2 subtests
`cache-storage-reporting-document.https.html`	Timeout · 0/2 subtests	Timeout · 0/2 subtests	OK · 2/2 subtests
`cache-storage-reporting-service-worker.https.html`	OK · 0/2 subtests	OK · 0/2 subtests	OK · 2/2 subtests
`cache-storage-reporting-shared-worker.https.html`	OK · 0/2 subtests	OK · 0/2 subtests	OK · 2/2 subtests
`coep-frame-javascript.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`coep-on-response-from-service-worker.https.html`	OK · 13/13 subtests	OK · 13/13 subtests	OK · 13/13 subtests
`credentialless/cache-storage.https.window.html?dedicated_worker`	OK · 14/14 subtests	OK · 13/14 subtests	OK · 14/14 subtests
`credentialless/cache-storage.https.window.html?document`	OK · 14/14 subtests	OK · 13/14 subtests	OK · 14/14 subtests
`credentialless/cache-storage.https.window.html?service_worker`	OK · 14/14 subtests	OK · 13/14 subtests	OK · 14/14 subtests
`credentialless/cache-storage.https.window.html?shared_worker`	OK · 14/14 subtests	OK · 13/14 subtests	OK · 14/14 subtests
`credentialless/cache.window.html`	OK · 1/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`credentialless/cross-origin-isolated.window.html`	OK · 5/5 subtests	OK · 3/5 subtests	OK · 5/5 subtests
`credentialless/dedicated-worker.https.window.html`	OK · 7/7 subtests	OK · 4/7 subtests	Timeout · 6/7 subtests
`credentialless/fetch.https.window.html`	OK · 13/13 subtests	OK · 12/13 subtests	OK · 13/13 subtests
`credentialless/iframe-coep-credentialless.https.window.html?1-4`	OK · 4/4 subtests	OK · 1/4 subtests	OK · 4/4 subtests
`credentialless/iframe-coep-credentialless.https.window.html?5-9`	OK · 5/5 subtests	OK · 2/5 subtests	OK · 5/5 subtests
`credentialless/iframe-coep-credentialless.https.window.html?9-last`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`credentialless/iframe-coep-none.https.window.html?1-4`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`credentialless/iframe-coep-none.https.window.html?5-last`	OK · 2/2 subtests	OK · 2/2 subtests	OK · 2/2 subtests
`credentialless/iframe-coep-redirect.https.window.html?1-4`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`credentialless/iframe-coep-redirect.https.window.html?5-last`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`credentialless/iframe-coep-require-corp.https.window.html?1-4`	OK · 4/4 subtests	OK · 3/4 subtests	OK · 4/4 subtests
`credentialless/iframe-coep-require-corp.https.window.html?5-9`	OK · 5/5 subtests	OK · 4/5 subtests	OK · 5/5 subtests
`credentialless/iframe-coep-require-corp.https.window.html?9-last`	OK · 4/4 subtests	OK · 2/4 subtests	OK · 4/4 subtests
`credentialless/iframe.window.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`credentialless/image.https.window.html`	OK · 7/7 subtests	OK · 5/7 subtests	OK · 7/7 subtests
`credentialless/link.https.window.html`	OK · 7/7 subtests	OK · 6/7 subtests	OK · 7/7 subtests
`credentialless/redirect.window.html`	OK · 5/5 subtests	OK · 2/5 subtests	OK · 5/5 subtests
`credentialless/reporting-navigation.https.window.html`	Timeout · 6/13 subtests	Timeout · 6/13 subtests	OK · 13/13 subtests
`credentialless/reporting-subresource-corp.https.window.html`	Timeout · 0/1 subtests	Timeout · 0/1 subtests	OK · 1/1 subtests
`credentialless/script.https.window.html`	OK · 7/7 subtests	OK · 6/7 subtests	OK · 7/7 subtests
`credentialless/service-worker-coep-credentialless-proxy.https.window.html`	Timeout · 0/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`credentialless/service-worker-coep-none-proxy.https.window.html`	Timeout · 0/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`credentialless/service-worker.https.window.html`	OK · 5/5 subtests	OK · 4/5 subtests	OK · 5/5 subtests
`credentialless/shared-worker.https.window.html?request_origin=cross_origin&worker_coep=credentialless&window_coep=credentialless`	OK · 1/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`credentialless/shared-worker.https.window.html?request_origin=cross_origin&worker_coep=credentialless&window_coep=none`	OK · 1/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`credentialless/shared-worker.https.window.html?request_origin=cross_origin&worker_coep=none&window_coep=credentialless`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`credentialless/shared-worker.https.window.html?request_origin=cross_origin&worker_coep=none&window_coep=none`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`credentialless/shared-worker.https.window.html?request_origin=same_origin&worker_coep=credentialless&window_coep=credentialless`	OK · 1/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`credentialless/shared-worker.https.window.html?request_origin=same_origin&worker_coep=credentialless&window_coep=none`	OK · 1/1 subtests	OK · 0/1 subtests	OK · 1/1 subtests
`credentialless/shared-worker.https.window.html?request_origin=same_origin&worker_coep=none&window_coep=credentialless`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`credentialless/shared-worker.https.window.html?request_origin=same_origin&worker_coep=none&window_coep=none`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`credentialless/video.https.window.html`	OK · 6/6 subtests	OK · 5/6 subtests	OK · 6/6 subtests
`credentialless/websocket.https.window.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`cross-origin-isolated-permission-iframe.https.window.html`	OK · 3/8 subtests	OK · 3/8 subtests	OK · 8/8 subtests
`cross-origin-isolated-permission-worker.https.window.html`	OK · 8/15 subtests	OK · 13/15 subtests	OK · 14/15 subtests
`data.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`dedicated-worker-cache-storage.https.html`	OK · 8/8 subtests	OK · 8/8 subtests	OK · 8/8 subtests
`dedicated-worker.https.html`	OK · 11/14 subtests	OK · 11/14 subtests	OK · 12/14 subtests
`header-parsing.https.html`	Timeout · 15/25 subtests	OK · 25/25 subtests	OK · 25/25 subtests
`iframe-history-none-require-corp.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`javascript.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`meta-http-equiv.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`multi-globals/workers-coep-report.https.html`	OK · 0/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`no-secure-context.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`non-initial-about-blank.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`none-load-from-cache-storage.https.html`	OK · 29/29 subtests	OK · 29/29 subtests	OK · 29/29 subtests
`none-sw-from-none.https.html`	OK · 13/13 subtests	OK · 13/13 subtests	OK · 13/13 subtests
`none-sw-from-require-corp.https.html`	OK · 13/13 subtests	OK · 13/13 subtests	OK · 13/13 subtests
`none.https.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`reflection-credentialless.tentative.https.any.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-credentialless.tentative.https.any.serviceworker-module.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-credentialless.tentative.https.any.serviceworker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-credentialless.tentative.https.any.sharedworker-module.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-credentialless.tentative.https.any.sharedworker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-credentialless.tentative.https.any.worker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-require-corp.tentative.https.any.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-require-corp.tentative.https.any.serviceworker-module.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-require-corp.tentative.https.any.serviceworker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-require-corp.tentative.https.any.sharedworker-module.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-require-corp.tentative.https.any.sharedworker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-require-corp.tentative.https.any.worker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-unsafe-none.tentative.https.any.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-unsafe-none.tentative.https.any.serviceworker-module.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-unsafe-none.tentative.https.any.serviceworker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-unsafe-none.tentative.https.any.sharedworker-module.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-unsafe-none.tentative.https.any.sharedworker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`reflection-unsafe-none.tentative.https.any.worker.html`	OK · 0/1 subtests	OK · 0/1 subtests	OK · 0/1 subtests
`report-only-require-corp.https.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`reporting-navigation.https.html`	Timeout · 14/30 subtests	OK · 30/30 subtests	OK · 28/30 subtests
`reporting-report-to-must-be-string.https.window.html`	Timeout · 0/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`reporting-subresource-corp.https.html`	Timeout · 2/26 subtests	Timeout · 12/26 subtests	Timeout · 24/26 subtests
`reporting-to-document-reporting-endpoint.https.window.html`	OK · 0/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`reporting-to-endpoint.https.html`	OK · 0/5 subtests	OK · 0/5 subtests	OK · 0/5 subtests
`reporting-to-frame-owner.https.html`	Timeout · 3/9 subtests	Timeout · 3/9 subtests	OK · 9/9 subtests
`reporting-to-worker-owner.https.html`	Timeout · 3/9 subtests	Timeout · 3/9 subtests	OK · 9/9 subtests
`require-corp-about-blank.https.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`require-corp-about-srcdoc.https.html`	OK · 3/3 subtests	OK · 3/3 subtests	OK · 3/3 subtests
`require-corp-cached-images.https.html`	OK · 5/5 subtests	OK · 5/5 subtests	OK · 5/5 subtests
`require-corp-load-from-cache-storage.https.html`	OK · 27/29 subtests	OK · 29/29 subtests	OK · 29/29 subtests
`require-corp-revalidated-images.https.html`	OK · 5/5 subtests	OK · 5/5 subtests	OK · 5/5 subtests
`require-corp-sw-from-none.https.html`	OK · 13/13 subtests	OK · 13/13 subtests	OK · 13/13 subtests
`require-corp-sw-from-require-corp.https.html`	OK · 13/13 subtests	OK · 13/13 subtests	OK · 13/13 subtests
`require-corp-sw.https.html`	OK · 6/6 subtests	OK · 6/6 subtests	OK · 6/6 subtests
`require-corp-worker-script-revalidation.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`require-corp.https.html`	OK · 16/16 subtests	OK · 16/16 subtests	OK · 16/16 subtests
`sandbox.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`service-worker-cache-storage.https.html`	OK · 4/4 subtests	OK · 4/4 subtests	OK · 4/4 subtests
`shared-workers.https.html`	OK · 5/11 subtests	OK · 6/11 subtests	OK · 5/11 subtests
`srcdoc.https.html`	OK · 1/1 subtests	OK · 1/1 subtests	OK · 1/1 subtests
`worker-inheritance.sub.https.html`	OK · 8/9 subtests	OK · 5/9 subtests	OK · 9/9 subtests

Pinned API query Test source at the run revision

Source-response fingerprint

SHA-256 a569846ac4ba84e7b564f50d81df83f90330ff32c3020bf04fc6b558a931ff2d

The digest identifies the complete downloaded directory response used for this projection, before file selection. It does not authenticate the runner or prove that the results are truthful.

What this feature can and cannot do

Helps protect against

Uncontrolled cross-origin embedding
Cross-origin isolation gaps

Does not guarantee

Application authorisation
All data leakage
Resources that are already same-origin

What you need before using it

Compatible embedded resources
Usually COOP for cross-origin isolation

Fallback to keep in place

Keep sensitive operations independent of cross-origin isolation and review embedded resource origins.