Browser security
Compatibility & evidence
Content execution

Subresource Integrity

Lets a document require external scripts and stylesheets to match expected digests.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS27WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

html.elements.script.integrity
  1. 1 – 4444 recorded releases
    Not supported
  2. 45 – 155110 recorded releases
    Works
html.elements.link.integrity
  1. 1 – 4444 recorded releases
    Not supported
  2. 45 – 155110 recorded releases
    Works

Edge

html.elements.script.integrity
  1. 12 – 165 recorded releases
    Not supported
  2. 17 – 15477 recorded releases
    Works
html.elements.link.integrity
  1. 12 – 165 recorded releases
    Not supported
  2. 17 – 15477 recorded releases
    Works

Firefox

html.elements.script.integrity
  1. 1 – 4245 recorded releases
    Not supported
  2. 43 – 157115 recorded releases
    Works
html.elements.link.integrity
  1. 1 – 4245 recorded releases
    Not supported
  2. 43 – 157115 recorded releases
    Works

Safari

html.elements.script.integrity
  1. 1 – 1118 recorded releases
    Not supported
  2. 11.1 – 2743 recorded releases
    Works
html.elements.link.integrity
  1. 1 – 1118 recorded releases
    Not supported
  2. 11.1 – 2743 recorded releases
    Works

Chrome for Android

html.elements.script.integrity
  1. 18 – 4421 recorded releases
    Not supported
  2. 45 – 155110 recorded releases
    Works
html.elements.link.integrity
  1. 18 – 4421 recorded releases
    Not supported
  2. 45 – 155110 recorded releases
    Works

Firefox for Android

html.elements.script.integrity
  1. 4 – 4236 recorded releases
    Not supported
  2. 43 – 157105 recorded releases
    Works
html.elements.link.integrity
  1. 4 – 4236 recorded releases
    Not supported
  2. 43 – 157105 recorded releases
    Works

Safari on iOS

html.elements.script.integrity
  1. 1 – 1115 recorded releases
    Not supported
  2. 11.3 – 2743 recorded releases
    Works
html.elements.link.integrity
  1. 1 – 1115 recorded releases
    Not supported
  2. 11.3 – 2743 recorded releases
    Works

Android WebView

html.elements.script.integrity
  1. 1 – 4416 recorded releases
    Not supported
  2. 45 – 155110 recorded releases
    Works
html.elements.link.integrity
  1. 1 – 4416 recorded releases
    Not supported
  2. 45 – 155110 recorded releases
    Works

Samsung Internet

html.elements.script.integrity
  1. 1.0 – 4.29 recorded releases
    Not supported
  2. 5.0 – 30.043 recorded releases
    Works
html.elements.link.integrity
  1. 1.0 – 4.29 recorded releases
    Not supported
  2. 5.0 – 30.043 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Unexpected third-party resource modification
  • CDN content substitution

Does not guarantee

  • Resources intentionally updated without matching metadata
  • Dynamic resources that cannot use stable digests
  • Compromise of the page that supplies integrity metadata

What you need before using it

  • Stable resource bytes
  • Correct CORS behaviour where required

Fallback to keep in place

Self-host critical resources or apply other supply-chain and CSP controls when stable integrity metadata is impractical.