Browser security
Compatibility & evidence
Content execution

CSP frame-ancestors restriction

Restricts which parent documents may embed a page in a frame.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS27WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Content-Security-Policy.frame-ancestors
  1. 1 – 3939 recorded releases
    Not supported
  2. 40 – 155115 recorded releases
    Works

Edge

http.headers.Content-Security-Policy.frame-ancestors
  1. 12 – 143 recorded releases
    Not supported
  2. 15 – 15479 recorded releases
    Works

Firefox

http.headers.Content-Security-Policy.frame-ancestors
  1. 1 – 3235 recorded releases
    Not supported
    • Partial implementation
    • Before Firefox 58, <code>frame-ancestors</code> is ignored in <code>Content-Security-Policy-Report-Only</code>.
  2. 33 – 5725 recorded releases
    Works with limits
    • Partial implementation
    • Before Firefox 58, <code>frame-ancestors</code> is ignored in <code>Content-Security-Policy-Report-Only</code>.
  3. 58 – 157100 recorded releases
    Works

Safari

http.headers.Content-Security-Policy.frame-ancestors
  1. 1 – 9.115 recorded releases
    Not supported
  2. 10 – 2746 recorded releases
    Works

Chrome for Android

http.headers.Content-Security-Policy.frame-ancestors
  1. 18 – 3916 recorded releases
    Not supported
  2. 40 – 155115 recorded releases
    Works

Firefox for Android

http.headers.Content-Security-Policy.frame-ancestors
  1. 4 – 3226 recorded releases
    Not supported
    • Partial implementation
    • Before Firefox for Android 58, <code>frame-ancestors</code> is ignored in <code>Content-Security-Policy-Report-Only</code>.
  2. 33 – 5725 recorded releases
    Works with limits
    • Partial implementation
    • Before Firefox for Android 58, <code>frame-ancestors</code> is ignored in <code>Content-Security-Policy-Report-Only</code>.
  3. 58 – 15790 recorded releases
    Works

Safari on iOS

http.headers.Content-Security-Policy.frame-ancestors
  1. 1 – 911 recorded releases
    Not supported
  2. 9.3 – 2747 recorded releases
    Works

Android WebView

http.headers.Content-Security-Policy.frame-ancestors
  1. 1 – 3911 recorded releases
    Not supported
  2. 40 – 155115 recorded releases
    Works

Samsung Internet

http.headers.Content-Security-Policy.frame-ancestors
  1. 1.0 – 3.27 recorded releases
    Not supported
  2. 4.0 – 30.045 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Clickjacking
  • Unapproved cross-origin embedding

Does not guarantee

  • Same-origin UI redressing
  • Pop-up windows
  • Application authorisation

What you need before using it

  • An explicit inventory of permitted embedding origins

Fallback to keep in place

Retain application-level anti-framing design and legacy X-Frame-Options where needed.