Cybersecurity
21 Sep 2026
6 min read
Cross-Origin-Opener-Policy Separates Window Relationships
Cross-Origin-Opener-Policy Separates Window Relationships A browser window can hold a reference to another top-level window. window.open() returns a WindowProxy, and an opened document may receive a window.opener reference. The same-origin policy restricts what cross-origin windows can inspect, but the relationship itself can still expose useful state and communication surfaces. Cross-Origin-Opener-Policy (COOP) adds a boundary around that relationship. The response header influences whether a top-level document remains in a compatible browsing context group (BCG) or moves into a new one. When policies require separate groups, references between opener and opened document are severed.