ControlCurrentbrowser security planning
Content execution

CSP frame-ancestors restriction

Restricts which parent documents may embed a page in a frame.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.0.7.

BrowserMinimumOutcomeReason
Chrome150WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge150WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox152WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari26.5WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android150WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android152WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS26.5WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView150WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet29.0WorksEvery required mapped BCD feature is available without a recorded qualification.

What this feature can and cannot do

Helps protect against

  • Clickjacking
  • Unapproved cross-origin embedding

Does not guarantee

  • Same-origin UI redressing
  • Pop-up windows
  • Application authorisation

What you need before using it

  • An explicit inventory of permitted embedding origins

Fallback to keep in place

Retain application-level anti-framing design and legacy X-Frame-Options where needed.