A new browser tab can remain connected to the page that opened it. That relationship is useful for payment windows, sign-in flows, and small application tools. It can also become a security boundary that developers forget exists.
Cross-Origin Opener Policy, or COOP, lets a website decide whether a top-level document should share a browsing context group with its opener. When policies do not match, the browser places the documents in separate groups and severs the scripting reference between them.
How Cross-Origin Opener Policy separates windows
A browsing context group is a set of windows, tabs, or frames that can hold references to one another under browser rules. JavaScript that calls window.open() normally receives a WindowProxy representing the opened document. The opened page may also see its opener through window.opener.
The same-origin policy limits what cross-origin documents can read and change, but the connection is not meaningless. A cross-origin window can access a small set of properties and perform actions such as navigation in permitted cases. It can also create observable behavior that contributes to cross-site leaks.
COOP is delivered as the Cross-Origin-Opener-Policy response header. It tells the browser whether the new document should remain in the current group or trigger a group switch. The HTML Standard defines the processing model, while MDN's COOP reference explains the directives and practical behavior.
The default keeps compatibility
The default directive is unsafe-none. Documents without a stricter policy can generally share a browsing context group when the other side also uses the default. This preserves long-standing web behavior, including many popup-based integrations.
The name sounds severe, but it does not mean the page has disabled every browser protection. The same-origin policy still applies. It means the document has not asked for the stronger opener isolation that COOP can provide.
Our guide to the same-origin policy explains which cross-origin interactions the browser already restricts. COOP builds on that foundation by controlling group membership and opener references at the top-level document boundary.
What same-origin changes
Cross-Origin-Opener-Policy: same-origin creates the strictest common deployment. A document remains in the same browsing context group only when the other document is same-origin and uses a matching policy. Other navigations move into a new group.
After separation, the opener's proxy for the new document behaves as though the window is closed. The opened document no longer has a usable connection back to the opener. That makes it harder for an unrelated site to keep a handle to a sensitive application it opened.
This protection helps address XS-Leaks, a family of attacks that infer cross-origin information through observable side effects. COOP does not eliminate every cross-site leak, but it removes important communication and observation paths created by shared opener relationships.
Why popups complicate deployment
Many sites rely on cross-origin popups for OAuth sign-in, payments, document pickers, and customer support. A strict same-origin policy can break those flows when the application expects to retain a reference to the popup or receive a response through its opener.
same-origin-allow-popups offers a deliberate compatibility option. It isolates the protected document from many cross-origin openers while allowing it to open documents that use the default policy and keep them in its group. This can support trusted integrations that cannot deploy matching COOP headers.
The tradeoff must be tested, not guessed. Authentication providers and payment services often use redirects across several origins. A flow may appear to work until its final callback tries to communicate with a window that the browser has separated.
COOP and browser process isolation are related
A browsing context group is a web-platform concept, not a guarantee that each document receives a dedicated operating-system process. Browsers decide how to map sites and groups onto renderer processes according to architecture, available memory, and security policy.
Still, a COOP group switch creates a boundary the browser can use for stronger isolation. Our article on browser site isolation explains how Chromium separates sites to limit the consequences of renderer compromise. COOP lets a server express a more specific relationship between top-level documents.
Developers should not treat COOP as a substitute for preventing cross-site scripting. If hostile code runs inside the protected origin, it already occupies the trusted side of the boundary.
Cross-origin isolation needs COEP too
Some powerful browser features require a page to be cross-origin isolated. A common configuration combines Cross-Origin-Opener-Policy: same-origin with a compatible Cross-Origin-Embedder-Policy, or COEP.
COOP separates the top-level browsing context group. COEP controls which cross-origin resources may be embedded. Together they can make features such as SharedArrayBuffer available in contexts that meet the browser's isolation requirements.
The page can check window.crossOriginIsolated rather than assuming that headers were received correctly. A CDN, reverse proxy, redirect, or embedded resource can cause a deployment to fall short of the intended state.
Roll out without breaking real workflows
- Inventory every popup, new-tab flow, and use of
window.openerorwindow.open(). - Test sign-in, payment, sharing, file-picker, and support integrations across their complete redirect chains.
- Begin with
Cross-Origin-Opener-Policy-Report-Onlywhere reporting support fits the deployment. - Choose
same-origin-allow-popupsonly for documented compatibility needs. - Verify
window.crossOriginIsolatedwhen a feature depends on full cross-origin isolation. - Combine COOP with strong script controls, Fetch Metadata defenses, and careful
postMessageorigin checks.
Cross-Origin Opener Policy is a small header with visible consequences. It changes which windows are allowed to remain neighbors inside the browser. For sensitive applications, that explicit separation is often safer than inheriting decades-old popup behavior by default.
Browse with more intention
Noorani brings prayer times, Qibla, tracker blocking, and privacy into one calm desktop browser built for how Muslims live online.