#1254: Incubation: Cross-Origin Storage

Visit on Github

Opened Aug 5, 2026

Explainer

https://github.com/WICG/cross-origin-storage/blob/main/README.md

The explainer

Where and by whom is the work is being done?

  • GitHub repo: https://github.com/WICG/cross-origin-storage/
  • Primary contacts:
    • Thomas Steiner (@tomayac), Google, Developer Relations Engineer
    • Christian Liebel (@christianliebel ), Thinktecture, Consultant
    • François Beaufort (@beaufortfrancois), Google, Developer Relations Engineer
  • Organization/project driving the design: Google
  • This work is being funded by: Google
  • Incubation and standards groups that have discussed the design:
  • Standards group(s) that you expect to discuss and/or adopt this work when it's ready: WHATWG

Feedback so far

You should also know that...

Public Hash List

Companion design document for the Public Hash List (PHL), the mechanism this proposal leans on for its main cross-site-disclosure mitigation: https://github.com/WICG/cross-origin-storage/blob/main/public-hash-list/phl-explainer.md

Public Hash List implementation

A prototype implementation of the Public Hash List is available. The actual Public Hash List is created on a weekly basis based on a GitHub Action.

Browser extensions

Browser extensions that implement the API (including Public Hash List gating) exist for all browsers:

Developer interest

Developer interest is tracked in the Web / Framework developer views notes section of the ChromeStatus entry.

Awesome Cross-Origin Storage

More demos and resources are tracked on the Awesome Cross-Origin Storage list.

<!-- Content below this is maintained by @w3c-tag-bot -->

Track conversations at https://tag-github-bot.w3.org/gh/w3ctag/design-reviews/1254

Discussions

Comment by @tomayac Aug 7, 2026 (See Github)

If you want to experience Cross-Origin Storage (COS) in two real browsers, I managed to add full imperative COS API support (navigator.crossOriginStorage) to both Servo and Ladybird (personal prototypes). I'm keeping track of the learnings in the implementation notes, which hopefully will be useful for other vendors.

Comment by @tomayac Aug 7, 2026 (See Github)

You can find Web Platform Tests in https://github.com/web-platform-tests/wpt/pull/61811.

Comment by @tomayac Aug 9, 2026 (See Github)

Also see:

Comment by @tomayac Aug 14, 2026 (See Github)

We're now at four personal prototype implementations that pass all WPTs:

(Click on the Releases link of each repo for runnable binaries.)