Cross-Origin-Opener-Policy
Separates your pages from windows that opened them, or that they open.
Recommended value
Cross-Origin-Opener-Policy: same-origin
What it does
By default a window opened by, or opening, another window shares a browsing context group with it, which leaves a live cross-origin reference between the two. That reference has been the basis of several side-channel and tab-nabbing attacks.
same-origin severs it, and is also one of the two headers required to enable cross-origin isolation, which unlocks SharedArrayBuffer and high-resolution timers.
The practical snag is OAuth and payment popups that rely on window.opener to post results back. same-origin-allow-popups keeps those working while still protecting against being opened by a hostile page.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: