Cross-Origin Storage (COS)

[tomayac]

WebKittens

@annevk @hober @marcoscaceres

Title of the proposal

Cross-Origin Storage (COS)

URL to the spec

https://wicg.github.io/cross-origin-storage/

URL to the spec's repository

https://github.com/WICG/cross-origin-storage

Issue Tracker URL

No response

Explainer URL

No response

TAG Design Review URL

w3ctag/design-reviews#1254

Mozilla standards-positions issue URL

mozilla/standards-positions#1427

WebKit Bugzilla URL

https://bugs.webkit.org/show_bug.cgi?id=324017

Radar URL

rdar://problem/187835839

Description

Public Hash List

Companion design document for the Public Hash List (PHL), the mechanism this proposal leans on
for its main cross-site-disclosure mitigation:
https://github.com/WICG/cross-origin-storage/blob/main/public-hash-list/phl-explainer.md

Public Hash List implementation

A prototype implementation of the Public Hash List is available. The actual Public Hash List is created on a weekly basis based on a GitHub Action.

Browser extensions

Browser extensions that implement the API (including Public Hash List gating) exist for all browsers:

• Chrome
• Firefox
• Safari

Developer interest

Developer interest is tracked in the Web / Framework developer views notes section of the ChromeStatus entry.

Awesome Cross-Origin Storage

More demos and resources are tracked on the Awesome Cross-Origin Storage list.

Web Engines Hackfest

This proposal was discussed at the Web Engines Hackfest 2026 (and 2025): Igalia/webengineshackfest#85

• Notes
• Slides

[tomayac]

If you want to experience Cross-Origin Storage (COS) in two real browsers, I managed to add full imperative COS API support (navigator.crossOriginStorage) to both Servo and Ladybird (personal prototypes). I'm keeping track of the learnings in the implementation notes, which hopefully will be useful for other vendors.

[tomayac]

You can find Web Platform Tests in web-platform-tests/wpt#61811.

[tomayac]

Also see:

• Add crossoriginstorage attribute to <link> and <script> whatwg/html#12770
• Add crossOriginStorage import attribute (COS integration) whatwg/html#12771
• [css-values-5] Proposal for a new <request-url-modifier> called <cross-origin-storage> w3c/csswg-drafts#14056

[tomayac]

FYI, a prototype implementation that passes all WPTs (web-platform-tests/wpt#61811) is available on https://github.com/tomayac/WebKit (see Releases for runnable binaries).

[annevk]

This feature is a bit hard to take seriously because as I understand it, it's disabled the moment you bring Chromium on par with other engines in terms of privacy.

[tomayac]

This feature is a bit hard to take seriously because as I understand it, it's disabled the moment you bring Chromium on par with other engines in terms of privacy.

Thanks a lot for for engaging, @annevk!

You're right that under the present framing this API would be a problem for browsers that have third-party cookies disabled. Tying its availability exclusively to third-party cookies was too limiting, and it left the actual risk unaddressed in exactly the browsers where it matters most.

In WICG/cross-origin-storage#73, we're working on a way to make the API implementable in browsers both with and without third-party cookies enabled. Would you be willing to take a look and let us know whether that direction is one that could get you to consider the feature?