The HTTP Permissions-Policy header cross-origin-isolated directive controls whether the current document is allowed to use APIs that require cross-origin isolation .

Specifically, where a defined policy blocks use of this feature, the Window.crossOriginIsolated and WorkerGlobalScope.crossOriginIsolated properties will always return false , and the document will not benefit from reduced restrictions on the use of some APIs that are granted only to cross-origin isolated documents. This is true regardless of the Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy headers, and whether the document would have been cross-origin isolated had the permission been granted.

The APIs that require this permission include the use of SharedArrayBuffer objects and Performance.now() with unthrottled timers — see Window.crossOriginIsolated for information about other restricted APIs.

The permission can be used to maintain restrictions on access to the sensitive APIs unless they are actually needed by a cross-origin isolated document. Note that if the feature is not allowed, but it otherwise would have been cross-origin isolated, then in all other respects it is still cross-origin isolated. For example, it will only share a browsing context group with documents in the same origin.

A list of one or more origins for which permission is granted to use the feature. See Permissions-Policy > Syntax for more details.

Default policy

The default allowlist for cross-origin-isolated is self .

Specifications

This page was last modified on ⁨Jul 4, 2025⁩ by MDN contributors . View this page on GitHub • Report a problem with this content