Browser security
Compatibility & evidence
Cross-origin isolation

Cross-Origin-Resource-Policy

Lets a resource state which origins or sites may embed it without CORS.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155Works with limitsEvery required mapped feature is available, but BCD records one or more qualifications.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android155Works with limitsEvery required mapped feature is available, but BCD records one or more qualifications.
Firefox for Android157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS27WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView155Works with limitsEvery required mapped feature is available, but BCD records one or more qualifications.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Cross-Origin-Resource-Policy
  1. 1 – 7272 recorded releases
    Not supported
    • Until version 75, downloads for files with this header would fail in Chrome. See <a href="https://crbug.com/41452948">bug 41452948</a>.
    • From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See <a href="https://crbug.com/40127935">bug 40127935</a>. From version 86, partial PDF loading is disabled.
  2. 73 – 15582 recorded releases
    Works with limits
    • Until version 75, downloads for files with this header would fail in Chrome. See <a href="https://crbug.com/41452948">bug 41452948</a>.
    • From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See <a href="https://crbug.com/40127935">bug 40127935</a>. From version 86, partial PDF loading is disabled.

Edge

http.headers.Cross-Origin-Resource-Policy
  1. 12 – 187 recorded releases
    Not supported
  2. 79 – 15475 recorded releases
    Works

Firefox

http.headers.Cross-Origin-Resource-Policy
  1. 1 – 7376 recorded releases
    Not supported
  2. 74 – 15784 recorded releases
    Works

Safari

http.headers.Cross-Origin-Resource-Policy
  1. 1 – 11.119 recorded releases
    Not supported
  2. 12 – 2742 recorded releases
    Works

Chrome for Android

http.headers.Cross-Origin-Resource-Policy
  1. 18 – 7249 recorded releases
    Not supported
    • Until version 75, downloads for files with this header would fail in Chrome Android. See <a href="https://crbug.com/41452948">bug 41452948</a>.
    • From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See <a href="https://crbug.com/40127935">bug 40127935</a>. From version 86, partial PDF loading is disabled.
  2. 73 – 15582 recorded releases
    Works with limits
    • Until version 75, downloads for files with this header would fail in Chrome Android. See <a href="https://crbug.com/41452948">bug 41452948</a>.
    • From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See <a href="https://crbug.com/40127935">bug 40127935</a>. From version 86, partial PDF loading is disabled.

Firefox for Android

http.headers.Cross-Origin-Resource-Policy
  1. 4 – 6862 recorded releases
    Not supported
  2. 79 – 15779 recorded releases
    Works

Safari on iOS

http.headers.Cross-Origin-Resource-Policy
  1. 1 – 11.316 recorded releases
    Not supported
  2. 12 – 2742 recorded releases
    Works

Android WebView

http.headers.Cross-Origin-Resource-Policy
  1. 1 – 7244 recorded releases
    Not supported
    • Until version 75, downloads for files with this header would fail in WebView Android. See <a href="https://crbug.com/41452948">bug 41452948</a>.
    • From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See <a href="https://crbug.com/40127935">bug 40127935</a>. From version 86, partial PDF loading is disabled.
  2. 73 – 15582 recorded releases
    Works with limits
    • Until version 75, downloads for files with this header would fail in WebView Android. See <a href="https://crbug.com/41452948">bug 41452948</a>.
    • From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See <a href="https://crbug.com/40127935">bug 40127935</a>. From version 86, partial PDF loading is disabled.

Samsung Internet

http.headers.Cross-Origin-Resource-Policy
  1. 1.0 – 10.225 recorded releases
    Not supported
  2. 11.0 – 30.027 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Cross-origin resource inclusion
  • Selected speculative side-channel exposure

Does not guarantee

  • Authorised CORS reads
  • Application authorisation
  • Resources served without the header

What you need before using it

  • An accurate resource-sharing model

Fallback to keep in place

Use authentication, CORS, and response minimization appropriate to each resource.