◆Error Codes Wiki

Cross-Origin Embedder Policy — COEP Blocking Resources and SharedArrayBuffer

Warning4xx client error

Overview

Fix Cross-Origin-Embedder-Policy (COEP) errors blocking images, scripts, and iframes while enabling SharedArrayBuffer and cross-origin isolation.

Key Details

  • COEP requires all cross-origin resources to explicitly opt-in via CORS or CORP headers
  • Enabling COEP (require-corp) is required for cross-origin isolation and SharedArrayBuffer access
  • Resources without proper CORS/CORP headers are blocked, breaking images, scripts, and iframes from third parties
  • Cross-origin isolation requires both COEP: require-corp and COOP: same-origin headers
  • SharedArrayBuffer is needed for WebAssembly threads and high-resolution timers

Common Causes

  • Third-party resources (images, ads, analytics scripts) not sending CORS or CORP headers
  • Enabling COEP without auditing all cross-origin resources loaded by the page
  • iframe content not setting Cross-Origin-Resource-Policy header
  • CDN serving resources without Access-Control-Allow-Origin header

Steps

  1. 1Audit all cross-origin resources on your page using Chrome DevTools Network tab filtered by 'blocked:mixed-content'
  2. 2For resources you control: add Cross-Origin-Resource-Policy: cross-origin header
  3. 3For resources you do not control: use crossorigin attribute on img/script tags and verify the server sends CORS headers
  4. 4Use COEP: credentialless (instead of require-corp) for a less restrictive policy that still enables isolation
  5. 5Test cross-origin isolation: check self.crossOriginIsolated in the browser console

Tags

coepcross-origin-isolationshared-array-buffercorpsecurity

More in 4xx Client Error

http-400-bad-requestHTTP 400 Bad Request — What It Means & How to Fix It
Error
http-401-unauthorizedHTTP 401 Unauthorized — What It Means & How to Fix It
Error
http-402-payment-requiredHTTP 402 Payment Required — What It Means & How to Fix It
Error
http-403-forbiddenHTTP 403 Forbidden — What It Means & How to Fix It
Error
http-404-not-foundHTTP 404 Not Found — What It Means & How to Fix It
Error
http-405-method-not-allowedHTTP 405 Method Not Allowed — What It Means & How to Fix It
Error

Frequently Asked Questions

Cross-origin isolation enables SharedArrayBuffer (required for WebAssembly threads) and high-resolution timers. It was restricted after Spectre/Meltdown vulnerabilities to prevent side-channel attacks.