Cross-origin isolation in a privacy-focused setup

Cross-origin isolation is a browser security boundary that can limit some risks from content loaded across websites. It does not hide your IP address, prevent tracking, or make browsing anonymous, so treat it as one security property rather than a complete privacy setting.

To evaluate it, check whether the specific page you care about is isolated, then consider whether its security benefits and compatibility fit your setup. A browser feature report can provide context, but the page itself determines whether isolation is active.

How cross-origin isolation works

A website can ask the browser to isolate a page from other websites' browsing contexts. The site does this with response headers, mainly Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy. These are instructions sent by the website, not a switch you turn on in your computer's privacy settings.

The policies work together. The opener policy can separate a page from other pages opened in the same browser window group. The embedder policy restricts which cross-origin resources the page can use, unless those resources explicitly allow it. This can require a site to adjust how it loads images, scripts, fonts, videos, or other embedded content.

Pages generally need to be served in a secure context, such as over HTTPS, and their resources need to meet the browser's cross-origin rules. When isolation is active, a page can also use certain browser capabilities, including shared memory features that are otherwise restricted. The exact behavior depends on the browser and the page's configuration.

What it protects, and what it does not

Isolation can help reduce exposure to some cross-origin attacks, including certain side-channel attacks that try to infer information across security boundaries. It is mainly a protection for the page and the data it handles. It does not guarantee that the website is trustworthy or that its code has no security flaws.

It also does not prevent a website from collecting information that the browser normally shares with it. A page may still see your public IP address, use cookies or other storage, and collect information about your visit. Cross-origin isolation does not replace tracker controls, careful permission choices, a VPN, or privacy protections built into the browser.

Isolation can affect compatibility. A page may be unable to load a third-party resource unless that resource allows it, and features that depend on pop-up windows or embedded content may behave differently. A site that needs isolation should test its sign-in flows, media, and other external integrations before relying on it.

Check whether the page you are using is isolated

1. Open Browser Info to review the browser engine, privacy details, permissions, and reported feature support. This gives you browser context, but it does not confirm the isolation status of every website.
2. Open the exact website or web app you want to evaluate in the same browser. Isolation is a property of the page you are using, so checking a different site does not answer the question.
3. In Chrome or Edge, open the browser menu and choose More tools › Developer tools, then select the Console panel. If the panel is not visible, look for it among the developer tools tabs.
4. Type crossOriginIsolated in the console and press Enter. The browser returns true if the current page is cross-origin isolated, or false if it is not.
5. Repeat the check after navigating to another page or opening the app in a new tab. A result applies to the page currently open, not to every tab or every website in the browser.

Use the console only to check this simple browser property. Do not paste scripts or commands from an unfamiliar page into developer tools.

What the result means for your setup

The result is true

The current page has isolation enabled in this browser. This confirms a useful security configuration for that page, but it does not show whether the site handles your data responsibly or whether its other privacy practices meet your needs. Review the site's privacy information and the permissions you have granted separately.

The result is false

The page is not isolated in this browsing context. That does not automatically mean your browser is unsafe or that the site is malicious. The site may not need isolation, may not have configured the required headers, or may be operating in a context where the policies are unavailable.

The page stops working when isolation is enabled

That is usually a site compatibility issue, not evidence that your privacy settings are broken. A cross-origin resource may not allow the page to use it under the required policy. If you manage the site, check its response headers and update or replace resources that do not meet the browser's cross-origin requirements. If you are just visiting, report the issue to the site owner rather than trying to change browser security behavior.

Use it as one part of a privacy review

For a privacy-focused setup, check separate controls for separate risks. Review camera, microphone, location, and notification permissions in the browser. Limit third-party cookies or tracking where your browser offers those controls, and avoid granting access a site does not need. Cross-origin isolation is not a replacement for any of these choices.

If you run a website, enable isolation only after testing the pages and external resources that matter. If you are evaluating a site as a visitor, check the page you use and treat the result as a narrow security signal, not a privacy score or a promise of anonymity.