Public browser tests.

Content Security Policy

Policy parsing and enforcement behaviour across the CSP test suite.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Content Security Policycontent-security-policyreviewed test sourcelatest public results

Limit: Suite coverage does not establish that an application's policy is complete, effective, or deployed on every response.

CSP nonce sources

Nonce source parsing and script authorisation behaviour.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• CSP script-srccontent-security-policy/script-srcreviewed test sourcelatest public results

Limit: The mapping covers browser behaviour, not nonce unpredictability, per-response generation, reuse, or disclosure.

CSP hash sources

Hash source parsing and authorisation for inline script and style content.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• CSP script-srccontent-security-policy/script-srcreviewed test sourcelatest public results
• CSP style-srccontent-security-policy/style-srcreviewed test sourcelatest public results

Limit: The mapping does not establish that deployed hashes match every intended resource or remain current.

CSP strict-dynamic

strict-dynamic parsing, trust propagation, and fallback interactions.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• CSP script-srccontent-security-policy/script-srcreviewed test sourcelatest public results

Limit: Passing behaviour does not establish that an application's trusted loaders are safe.

CSP base-uri restriction

Base URL authorisation and blocking behaviour.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• CSP base-uricontent-security-policy/base-urireviewed test sourcelatest public results

Limit: The suite does not establish that an application prevents every unsafe absolute URL.

CSP frame-ancestors restriction

Embedding authorisation across same-origin, cross-origin, nested, and sandboxed cases.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• CSP frame-ancestorscontent-security-policy/frame-ancestorsreviewed test sourcelatest public results

Limit: The mapping does not establish that the deployed allowlist matches an application's intended embedding relationships.

CSP form-action restriction

Form destination authorisation, redirects, and target behaviour.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• CSP form-actioncontent-security-policy/form-actionreviewed test sourcelatest public results

Limit: The suite does not evaluate scripted requests, server authorisation, or whether every legitimate destination was inventoried.

CSP upgrade-insecure-requests

Eligible request rewriting and mixed-content interactions.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Upgrade Insecure Requestsupgrade-insecure-requestsreviewed test sourcelatest public results

Limit: The mapping does not prove that every upgraded endpoint supports correct HTTPS.

CSP sandbox

Sandbox token behaviour across frames, workers, redirects, and navigations.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• CSP sandboxcontent-security-policy/sandboxreviewed test sourcelatest public results

Limit: The suite cannot determine whether an application's selected sandbox tokens grant excessive capability.

Trusted Types enforcement

Trusted Types APIs, policy behaviour, CSP enforcement, and protected DOM sinks.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Trusted Typestrusted-typesreviewed test sourcelatest public results

Limit: The mapping does not establish complete sink coverage or the safety of application-authored policies.

Subresource Integrity

Integrity metadata parsing, digest matching, fetching, and CSP interactions.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Subresource Integritysubresource-integrityreviewed test sourcelatest public results

Limit: The suite does not establish that a deployment supplies current integrity metadata for every eligible resource.

Subresource Integrity Policy

Integrity-Policy parsing, blocking, report-only behaviour, destinations, sources, and reporting integration.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Subresource Integrity Policysubresource-integrity/integrity-policyreviewed test sourcelatest public results

Limit: The suite does not establish that every production resource carries current metadata or that reports are operationally reviewed.

Cross-Origin-Opener-Policy

Browsing-context isolation, opener relationships, reporting, and navigation behaviour.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Cross-Origin-Opener-Policyhtml/cross-origin-opener-policyreviewed test sourcelatest public results

Limit: The mapping does not establish compatibility with an application's popup and cross-window integrations.

Cross-Origin-Embedder-Policy

Cross-origin resource opt-in and embedder-policy enforcement.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Cross-Origin-Embedder-Policyhtml/cross-origin-embedder-policyreviewed test sourcelatest public results

Limit: The suite does not establish that all production dependencies opt in correctly.

Cross-Origin-Resource-Policy

Resource-policy enforcement across fetch and embedding contexts.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Cross-Origin-Resource-Policyfetch/cross-origin-resource-policyreviewed test sourcelatest public results

Limit: The mapping does not determine the correct resource-sharing policy for an application.

Credentialless cross-origin embedding

Credential omission and embedding behaviour under credentialless COEP.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• COEP credentiallesshtml/cross-origin-embedder-policy/credentiallessreviewed test sourcelatest public results

Limit: The suite does not establish that credential omission is suitable for every embedded resource.

Origin-Agent-Cluster

Origin-keyed agent-cluster opt-in and browsing behaviour.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Origin-keyed agent clustershtml/browsers/origin/origin-keyed-agent-clustersreviewed test sourcelatest public results

Limit: Agent clustering is not a guarantee of process isolation or an application authorisation boundary.

Fetch Metadata request headers

Sec-Fetch request-context header generation across request modes and destinations.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Fetch Metadatafetch/metadatareviewed test sourcelatest public results

Limit: The mapping does not test an application's server-side resource-isolation policy.

Permissions Policy

Policy parsing, inheritance, delegation, and feature-specific enforcement.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Permissions Policypermissions-policyreviewed test sourcelatest public results

Limit: The suite does not establish that an application selected the correct capabilities or frame allowlists.

HTTP Strict Transport Security

No exact suite mapping was retained at the reviewed revision.

No similar test is substituted when an exact link is unavailable.

Limit: Nearby HTTPS and navigation tests are not substituted for HSTS state, expiry, subdomain, or first-visit behaviour.

X-Content-Type-Options nosniff

nosniff enforcement for relevant script, style, and fetch responses.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Fetch nosnifffetch/nosniffreviewed test sourcelatest public results

Limit: The suite does not establish that a deployment sends correct Content-Type values for every response.

Clear-Site-Data

Directive parsing and browser-held data clearing behaviour.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Clear-Site-Dataclear-site-datareviewed test sourcelatest public results

Limit: The mapping does not establish correct logout sequencing, server-side revocation, or coverage of every storage mechanism.

Referrer Policy

Policy parsing and referrer delivery across navigation and resource contexts.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Referrer Policyreferrer-policyreviewed test sourcelatest public results

Limit: The suite does not establish that sensitive data is absent from URLs or other telemetry.

SameSite cookies

SameSite parsing and cookie delivery across same-site and cross-site contexts.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• SameSite cookiescookies/samesitereviewed test sourcelatest public results

Limit: The mapping does not establish that session cookies use an appropriate value or replace CSRF protection.

Partitioned cookies

Partition-key behaviour, redirects, subresources, and SameSite interactions.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Partitioned cookiescookies/partitioned-cookiesreviewed test sourcelatest public results

Limit: The mapping does not establish that a deployment needs partitioned state or declares all required attributes.

HttpOnly cookies

No exact suite mapping was retained at the reviewed revision.

No similar test is substituted when an exact link is unavailable.

Limit: General cookie tests are not substituted for the intended claim that script access is prevented by HttpOnly.

Secure cookie prefixes

__Secure-, __Host-, __Http-, and __Host-Http- prefix constraint behaviour.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Cookie prefixescookies/prefixreviewed test sourcelatest public results

Limit: Prefix enforcement does not establish sound session design or protection from every cookie-confusion attack.

WebAuthn platform authenticator detection

WebAuthn API and authenticator-availability behaviour within the WebAuthn suite.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Web Authenticationwebauthnreviewed test sourcelatest public results

Limit: The suite does not establish relying-party verification, recovery safety, or authenticator policy.

WebAuthn PRF extension

PRF extension parsing and credential operation behaviour within the WebAuthn suite.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Web Authenticationwebauthnreviewed test sourcelatest public results

Limit: The mapping does not establish authenticator support in a user's environment or a safe key-recovery design.

WebAuthn conditional mediation

Conditional mediation and related PublicKeyCredential behaviour within the WebAuthn suite.

Source reviewed 23 July 2026af38980d2fcd74af19a226f5f651051cc15940ed

• Web Authenticationwebauthnreviewed test sourcelatest public results

Limit: The suite does not establish a secure account, autofill, or recovery experience.

Permissions Policy: camera

Camera policy violation and potential-violation reports in enforced and report-only modes.

Source reviewed 11 October 2026cc74d2669f5de548e808779877d1d33339ec5115

• Camera policy reporting
  • permissions-policy/reporting/camera-potential-report-only.https.htmlreviewed test sourcelatest public results
  • permissions-policy/reporting/camera-potential-reporting.https.htmlreviewed test sourcelatest public results
  • permissions-policy/reporting/camera-report-only.https.htmlreviewed test sourcelatest public results
  • permissions-policy/reporting/camera-reporting.https.htmlreviewed test sourcelatest public results

Limit: These files also depend on reporting support and media-test automation. Their outcomes do not isolate basic camera blocking or cover every frame allowlist and device.

Permissions Policy: microphone

Microphone policy violation reports when audio access is blocked or allowed in report-only mode.

Source reviewed 11 October 2026cc74d2669f5de548e808779877d1d33339ec5115

• Microphone policy reporting
  • permissions-policy/reporting/microphone-report-only.https.htmlreviewed test sourcelatest public results
  • permissions-policy/reporting/microphone-reporting.https.htmlreviewed test sourcelatest public results

Limit: These files also depend on reporting support and media-test automation. Their outcomes do not isolate basic microphone blocking or cover every frame allowlist and device.

Permissions Policy: geolocation

Geolocation policy violation reports in enforced and report-only modes.

Source reviewed 11 October 2026cc74d2669f5de548e808779877d1d33339ec5115

• Geolocation policy reporting
  • permissions-policy/reporting/geolocation-report-only.https.htmlreviewed test sourcelatest public results
  • permissions-policy/reporting/geolocation-reporting.https.htmlreviewed test sourcelatest public results

Limit: Reporting support, location availability and user permission can affect these outcomes. They do not isolate basic geolocation blocking or cover every frame allowlist.

Clear-Site-Data: cache

Cache eviction, subsequent fetches, partitioning and back/forward cache behaviour.

Source reviewed 11 October 2026cc74d2669f5de548e808779877d1d33339ec5115

• Cache clearing
  • clear-site-data/clear-cache-bfcache-partitioning.tentative.https.htmlreviewed test sourcelatest public results
  • clear-site-data/clear-cache-bfcache.https.htmlreviewed test sourcelatest public results
  • clear-site-data/clear-cache-partitioning.tentative.https.htmlreviewed test sourcelatest public results
  • clear-site-data/clear-cache.https.htmlreviewed test sourcelatest public results

Limit: The selected files include wildcard-clearing cases and tentative partitioning tests. File totals do not isolate every cache directive subtest or prove that application logout removes all cached data.

Clear-Site-Data: cookies

Cookie visibility when Set-Cookie appears before or after a cookies-clearing header in the same response.

Source reviewed 11 October 2026cc74d2669f5de548e808779877d1d33339ec5115

• Cookie clearing and response header order
  • clear-site-data/set-cookie-after-clear-cookies.https.htmlreviewed test sourcelatest public results
  • clear-site-data/set-cookie-before-clear-cookies.https.htmlreviewed test sourcelatest public results

Limit: These two files cover response header ordering. They do not establish complete cookie-domain or partition coverage, server-side session revocation, or correct logout sequencing.

Clear-Site-Data: storage

Clearing supported storage backends and removing service-worker control from an existing client.

Source reviewed 11 October 2026cc74d2669f5de548e808779877d1d33339ec5115

• Storage clearing and service-worker control
  • clear-site-data/storage.https.htmlreviewed test sourcelatest public results

Limit: The file includes setup checks and selects backends available in that browser. Its totals do not prove coverage of every storage mechanism, partition or application data flow.