Intent to Prototype: Cross-Origin Storage
Thomas Steiner
Contact emails
natt...@google.com, gde...@google.com, rez...@google.com, pme...@google.com, fbea...@google.com, christi...@gmail.com, to...@google.com
Explainer
https://github.com/WICG/cross-origin-storage/blob/main/README.md
Specification
https://wicg.github.io/cross-origin-storage
Summary
Cross-Origin Storage (COS), is a content-addressable browser cache that shares files across origins by hash, with k-anonymity-based availability gating to prevent cross-site tracking. It provides a secure mechanism for web applications to store and retrieve large files across different origins. Utilizing cryptographic hashes to identify and verify files, this feature allows developers to share common assets—such as AI models, WebAssembly modules, and popular JavaScript libraries—across multiple domains without redundant downloads. The hash is the key for the resource and sharing doesn't depend on fetching the resource from a shared location. This significantly reduces network costs, startup latency, and client-side storage overhead while maintaining strict user privacy and security boundaries.
Blink component
Blink>Storage>CrossOriginStorage (CrossOriginStorage requested in https://crbug.com/547587761)
Web Feature ID
Missing feature (web-platform-dx/web-features#4029)
Motivation
Without a standardized way to share stored assets across different domains, web applications that rely on large files are forced to download and store them redundantly. For example, when multiple sites utilize the exact same multi-gigabyte AI model or large WebAssembly module, users must wait for the same massive files to download repeatedly, consuming vast amounts of network bandwidth and valuable client-side disk space. Traditional HTTP caching cannot solve this because browsers partition caches by the top-level origin to prevent cross-site tracking and side-channel attacks. The Cross-Origin Storage API resolves this conflict by establishing a secure, opt-in mechanism to query and share verified resources across origins based solely on their cryptographic hashes, which eliminates wasteful duplicate downloads while fully preserving modern privacy boundaries.
Initial public proposal
https://github.com/explainers-by-googlers/cross-origin-storage
Search tags
Goals for experimentation
Further verify the API design choices after the initial extension-based implementation, which already resulted in API changes and has been stable since.
Requires code in //chrome?
False
Tracking bug
Launch bug
https://launch.corp.google.com/launch/4497559
Estimated milestones
No milestones specified
Link to entry on the Chrome Platform Status
https://chromestatus.com/feature/5163371507875840?gate=5180051919339520
This intent message was generated by Chrome Platform Status.