Open Bug 1459357 (corb) Opened 4 years ago Updated 11 months ago

Cross-Origin Read Blocking (CORB)


(Core :: DOM: Core & HTML, enhancement, P3)




Fission Milestone Future


(Reporter: lukasza, Unassigned)


(Blocks 3 open bugs)


Cross-origin read blocking, better known as CORB, is an algorithm by which dubious cross-origin resource fetches are identified and blocked before they reach a web page. CORB reduces the risk of leaking sensitive data by keeping it further from cross-origin web pages.  In most browsers, it keeps such data out of untrusted script execution contexts. In browsers with Site Isolation, it can keep such data out of untrusted renderer processes entirely, helping even against side channel attacks.

More info:
- Explainer:
- WhatWG issue:
- PR for Fetch spec changes:
- Initial public support from Firefox:!msg/site-isolation-dev/pp5C8XKz7AI/2zNOn-S_BgAJ
Mentor: annevk
Alias: corb
See Also: → corp
FYI: I'm about to land the Fetch PR. It standardizes all the bits of CORB that can be implemented without sniffing the response. Tests can be found in fetch/corb in web-platform-tests.
Ever confirmed: true
Blocks: fetch
See Also: → cowp
Component: Security → DOM
Priority: -- → P3
Fission Milestone: --- → Future

I'm no longer convinced we should do this. Bug 1532642 is a much more secure approach that seems doable.

Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.