Cross-Origin-Opener-Policy

A page opened with `window.open` receives a reference to its opener, and the opener receives a reference to it. Both persist across navigation.

Even across origins, a limited set of operations remains available: navigating the other window, reading how many frames it has, closing it.

That is enough for a tab-napping attack, where a page opened from yours later navigates your tab to a convincing imitation while the visitor is elsewhere.

It is also enough to be a timing side channel, which is why the policy became a precondition for restoring precise timers after Spectre.

`unsafe-none` is the default: the relationship is retained, which is how the web has always worked.

`same-origin-allow-popups` keeps references to windows this document opens, while severing the reference from an opener of another origin. This is the pragmatic middle setting.

`same-origin` severs both directions unless the other document is same-origin and also sets the policy. This is the strict setting and the one cross-origin isolation requires.

`rel="noopener"` on a link achieves the same severing for that one link, and has been the default for `target="_blank"` in browsers for several years.

A `report-to` variant of each value sends violation reports without enforcing, which is how a deployment is measured before it is switched on.

Popup-based authentication flows, where a login window communicates its result back to the opener. These require the opener reference.

Payment flows using the same pattern.

Anything using `window.postMessage` between a page and a popup of another origin.

`same-origin-allow-popups` exists precisely for these cases: it keeps what those flows need while removing the inbound risk.

Setting `Cross-Origin-Opener-Policy: same-origin` together with `Cross-Origin-Embedder-Policy: require-corp` puts the document in a cross-origin isolated state.

That state restores `SharedArrayBuffer` and high-resolution `performance.now`, both of which were restricted after the speculative execution vulnerabilities.

Applications that need them — video editors, emulators, anything compiled to WebAssembly with threads — have to adopt both headers, and therefore have to bring every embedded resource into compliance.

For an ordinary site that does not need those capabilities, `same-origin-allow-popups` alone is a sensible improvement with a much smaller cost.

Test before enforcing: `self.crossOriginIsolated` in the console reports whether the state was achieved, and the network panel names each resource that blocked it.