Browser security
Compatibility & evidence
Content execution

Subresource Integrity Policy

Requires selected script and style requests to carry integrity metadata, with an optional report-only rollout mode.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157Works with limitsEvery required mapped feature is available, but BCD records one or more qualifications.
Safari27WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157Works with limitsEvery required mapped feature is available, but BCD records one or more qualifications.
Safari on iOS27WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Integrity-Policy
  1. 1 – 137136 recorded releases
    Not supported
  2. 138 – 15518 recorded releases
    Works
http.headers.Integrity-Policy-Report-Only
  1. 1 – 137136 recorded releases
    Not supported
  2. 138 – 15518 recorded releases
    Works

Edge

http.headers.Integrity-Policy
  1. 12 – 13765 recorded releases
    Not supported
  2. 138 – 15417 recorded releases
    Works
http.headers.Integrity-Policy-Report-Only
  1. 12 – 13765 recorded releases
    Not supported
  2. 138 – 15417 recorded releases
    Works

Firefox

http.headers.Integrity-Policy
  1. 1 – 144147 recorded releases
    Not supported
    • Partial implementation
    • Reporting <code>endpoints</code> are ignored (violations are logged to console).
  2. 145 – 15713 recorded releases
    Works with limits
    • Partial implementation
    • Reporting <code>endpoints</code> are ignored (violations are logged to console).
http.headers.Integrity-Policy-Report-Only
  1. 1 – 144147 recorded releases
    Not supported
    • Partial implementation
    • Reporting <code>endpoints</code> are ignored (violations are logged to console).
  2. 145 – 15713 recorded releases
    Works with limits
    • Partial implementation
    • Reporting <code>endpoints</code> are ignored (violations are logged to console).

Safari

http.headers.Integrity-Policy
  1. 1 – 18.653 recorded releases
    Not supported
  2. 26 – 278 recorded releases
    Works
http.headers.Integrity-Policy-Report-Only
  1. 1 – 18.653 recorded releases
    Not supported
  2. 26 – 278 recorded releases
    Works

Chrome for Android

http.headers.Integrity-Policy
  1. 18 – 137113 recorded releases
    Not supported
  2. 138 – 15518 recorded releases
    Works
http.headers.Integrity-Policy-Report-Only
  1. 18 – 137113 recorded releases
    Not supported
  2. 138 – 15518 recorded releases
    Works

Firefox for Android

http.headers.Integrity-Policy
  1. 4 – 144128 recorded releases
    Not supported
    • Partial implementation
    • Reporting <code>endpoints</code> are ignored (violations are logged to console).
  2. 145 – 15713 recorded releases
    Works with limits
    • Partial implementation
    • Reporting <code>endpoints</code> are ignored (violations are logged to console).
http.headers.Integrity-Policy-Report-Only
  1. 4 – 144128 recorded releases
    Not supported
    • Partial implementation
    • Reporting <code>endpoints</code> are ignored (violations are logged to console).
  2. 145 – 15713 recorded releases
    Works with limits
    • Partial implementation
    • Reporting <code>endpoints</code> are ignored (violations are logged to console).

Safari on iOS

http.headers.Integrity-Policy
  1. 1 – 18.650 recorded releases
    Not supported
  2. 26 – 278 recorded releases
    Works
http.headers.Integrity-Policy-Report-Only
  1. 1 – 18.650 recorded releases
    Not supported
  2. 26 – 278 recorded releases
    Works

Android WebView

http.headers.Integrity-Policy
  1. 1 – 137108 recorded releases
    Not supported
  2. 138 – 15518 recorded releases
    Works
http.headers.Integrity-Policy-Report-Only
  1. 1 – 137108 recorded releases
    Not supported
  2. 138 – 15518 recorded releases
    Works

Samsung Internet

http.headers.Integrity-Policy
  1. 1.0 – 29.051 recorded releases
    Not supported
  2. 30.01 recorded release
    Works
http.headers.Integrity-Policy-Report-Only
  1. 1.0 – 29.051 recorded releases
    Not supported
  2. 30.01 recorded release
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Executable subresources without integrity metadata
  • Incomplete SRI deployment coverage

Does not guarantee

  • Incorrect but well-formed integrity metadata
  • Compromise of the document that declares the policy
  • Resource types outside the selected blocked destinations

What you need before using it

  • SRI metadata on affected resources
  • Reporting endpoints when policy reports are required

Fallback to keep in place

Inventory executable resources and enforce equivalent build-time checks where Integrity Policy is unavailable.