https://nalar.dev/tags/xs-leaks/ Recent content in XS-Leaks on Nalar Hugo en-us Mon, 21 Sep 2026 00:00:00 +0000 https://nalar.dev/cross-origin-opener-policy-separates-window-relationships/ Mon, 21 Sep 2026 00:00:00 +0000 https://nalar.dev/cross-origin-opener-policy-separates-window-relationships/ <h1 id="cross-origin-opener-policy-separates-window-relationships">Cross-Origin-Opener-Policy Separates Window Relationships</h1> <p>A browser window can hold a reference to another top-level window. <code>window.open()</code> returns a <code>WindowProxy</code>, and an opened document may receive a <code>window.opener</code> reference. The same-origin policy restricts what cross-origin windows can inspect, but the relationship itself can still expose useful state and communication surfaces.</p> <p><code>Cross-Origin-Opener-Policy</code> (COOP) adds a boundary around that relationship. The response header influences whether a top-level document remains in a compatible browsing context group (BCG) or moves into a new one. When policies require separate groups, references between opener and opened document are severed.</p>