Cross-origin isolation (COOP / COEP / CORP)
type: TechArticle
description: Three response headers — Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy — that sever risky cross-window and cross-origin links and defend against side-channel leaks.
language: en
is part of: Web Specification Studio
author: Web Specification Studio
publisher: Web Specification Studio
license: https://creativecommons.org/licenses/by/4.0/
date modified: 2026-06-11T00:00:00.000Z
citation: HTML Standard — Cross-Origin-Opener-Policy
  type: CreativeWork
  publisher: WHATWG
citation: Fetch Standard — Cross-Origin-Resource-Policy header
  type: CreativeWork
  publisher: WHATWG
citation: MDN — Cross-Origin-Opener-Policy
  type: CreativeWork
  publisher: MDN
citation: MDN — Cross-Origin-Resource-Policy
  type: CreativeWork
  publisher: MDN

Web Specification Studio
type: WebSite

Web Specification Studio
type: Organization

breadcrumb
type: BreadcrumbList
item list element: Home
  type: ListItem
  position: 1
  item: https://webspecification.com/
item list element: Spec
  type: ListItem
  position: 2
  item: https://webspecification.com/spec/
item list element: Security
  type: ListItem
  position: 3
  item: https://webspecification.com/spec/security/
item list element: Cross-origin isolation (COOP / COEP / CORP)
  type: ListItem
  position: 4
  item: https://webspecification.com/spec/security/cross-origin-isolation/