Skip to tool
SECURITY DIAGNOSTICS · LOCAL BROWSER ONLY

Cross-origin isolation

Observe actual browser cross-origin isolation and dependent capability availability locally, or inspect a redacted capture from an authorised document.

Check the actual document capability state

Choose Check this page to inspect the currently loaded diagnostic document. This does not inspect every page in an application and does not fetch response headers or run a network test.

Inspect an application you control

On a page you own or are authorised to inspect, use this read-only expression in its developer console. Copy the returned JSON string without its surrounding console quotation marks. It reads capability flags and a permissions-policy result, not cookies, URLs, headers, page contents or personal identifiers.

Imported captures are unverified user-supplied observations, never trusted proof of an origin or deployment. Maximum input: 8 KiB. No pasted input is executed.

What this check cannot diagnose

crossOriginIsolated reports the state of the observed document. It does not reveal which COOP, COEP, Permissions-Policy, resource response, worker or frame condition caused an unavailable state. SharedArrayBuffer visibility does not prove successful worker transfer, and API availability does not establish real memory performance or timer precision.

Isolation changes can affect popups, sign-in redirects, cross-origin images, frames and external resources. Verify those flows with authorised browser tests rather than automatically applying headers from this result. No page is reloaded or policy is changed by this tool.

Read this tool’s methodology · Security tools