Opaque origin for data: URLs

at a glance

why it exists

Before Chrome 150, a data: URL worker automatically inherited the same origin as the page that created it — for example, new Worker('data:text/javascript,...') from https://example.com ran with origin https://example.com. This meant the worker could:

• Open a BroadcastChannel and receive messages from other same-origin pages.
• Access same-origin localStorage, indexedDB, and other storage.
• Be used to exfiltrate data if the worker script came from untrusted input.

The HTML Living Standard (step 3 of the Worker settings object algorithm) specifies that workers created from opaque URLs such as data: should receive a unique opaque origin. Chrome 150 implements this. The worker still shares the same storage partition as its creator (so quota accounting is unchanged), but it no longer shares the creator's same-origin privileges.

what changes

example

// Before Chrome 150: worker inherited https://example.com origin.
// After Chrome 150: worker has a unique opaque origin.

const workerCode = `
  // This BroadcastChannel will no longer receive messages from the
  // parent page's origin in Chrome 150+ — the worker is now isolated.
  const bc = new BroadcastChannel('updates');
  bc.onmessage = (e) => console.log('received', e.data);
`;
const blob = new Blob([workerCode], { type: 'text/javascript' });
const url = URL.createObjectURL(blob); // blob: URLs retain creator origin
// ^ Use blob: URLs (still inherits origin) for workers that need same-origin access.
// data: URLs now produce opaque origins.

// Prefer blob: URLs when same-origin communication is intended:
const w = new Worker(url);

// data: URL workers are safe for sandboxed computation:
const sandboxed = new Worker('data:text/javascript,' + encodeURIComponent(workerCode));
// sandboxed.origin is opaque — can't reach parent's storage or channels.

browser support

see also

• Chrome Platform Status — Opaque origin for data: URLs
• HTML Living Standard — Worker settings object
• gendn — v150: Opaque origin for data: URL dedicated and shared workers