Skip to content

Archive

COOP

1 articles
Cybersecurity 16 Sep 2026 9 min read

Cross-Origin Opener Policy Separates Window Relationships at the Browsing Context Boundary

Cross-Origin Opener Policy Separates Window Relationships at the Browsing Context Boundary A browser can prevent a cross-origin popup from reading most properties of its opener and still preserve a live relationship between the two windows. The same-origin policy restricts direct access to a foreign document, but a cross-origin WindowProxy can remain reachable, expose a limited interface, participate in navigation relationships, and carry observable state such as whether the referenced window is closed.