Compare security-feature support across browsers
This table uses the current version of each browser recorded in the selected MDN data. To check the older versions your own website supports, use the browser planner.
| Control | Chrome 150 | Edge 150 | Firefox 152 | Safari 26.5 | Chrome for Android 150 | Firefox for Android 152 | Safari on iOS 26.5 | Android WebView 150 | Samsung Internet 29.0 |
|---|---|---|---|---|---|---|---|---|---|
| CSP | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| CSP nonces | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data |
| CSP hashes | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data | Not enough browser data |
| strict-dynamic | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| CSP base-uri | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| frame-ancestors | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| form-action | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| Upgrade insecure requests | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| CSP sandbox | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| Trusted Types | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| SRI | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| Integrity Policy | Works | Works | Works with limits | Works | Works | Works with limits | Works | Works | Not supported |
| COOP | Works | Works | Works | Works | Works | Works | Works | Not supported | Works |
| COEP | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| CORP | Works with limits | Works | Works | Works | Works with limits | Works | Works | Works with limits | Works |
| COEP credentialless | Works | Works | Works | Not supported | Works | Not supported | Not supported | Works | Works |
| Origin-Agent-Cluster | Works | Works | Works | Unknown | Works | Works | Not supported | Works | Works |
| Fetch Metadata | Works | Works | Works | Not supported | Works | Works | Not supported | Works | Works |
| Permissions Policy | Works | Works | Not supported | Not supported | Works | Not supported | Not supported | Works | Works |
| HSTS | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| nosniff | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| Clear-Site-Data | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| Referrer Policy | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| SameSite | Works | Works | Works | Works with limits | Works | Works | Works | Works | Works |
| CHIPS | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| HttpOnly | Works | Works | Works | Works | Works | Works | Works | Works | Works |
| Cookie prefixes | Works | Works | Works | Not supported | Works | Works | Not supported | Works | Not supported |
| Platform WebAuthn | Works | Works | Works with limits | Works | Works | Works | Works | Not supported | Works |
| WebAuthn PRF | Works | Works | Works | Not supported | Works | Not supported | Not supported | Not supported | Works |
| Conditional WebAuthn | Works | Works | Works | Works | Works | Works | Works | Not supported | Works |
“Works” does not mean “securely configured”.It means the browser feature is supported without a known limitation in the selected MDN data. ControlCurrent has not inspected your website or tested whether the feature is enforced.