Upcoming changes related to SharedArrayBuffer in M92.

[Karan Bhatia]

Hi, 

If your extension doesn’t depend on SharedArrayBuffer, you can stop reading now. 

As part of M92, SharedArrayBuffer will be limited to cross origin isolated pages on Desktop Chrome.

1. If your extension uses SharedArrayBuffers in a content script, this usage may break. Content scripts largely share the same privileges as the host page; as such, SharedArrayBuffers will only be available if the host page is cross-origin isolated. Extensions can move such usages to their background context. This is not unique to SharedArrayBuffers, and so moving privileged usage to the background context is generally encouraged.

2. If your extension uses SharedArrayBuffers in an extension context (iframe, background scripts etc.), no action is needed for M92. Extension contexts are temporarily exempted from the cross origin isolation requirement. However, this will change in M94 (see below).

In M93, we are introducing two new manifest keys —  cross_origin_embedder_policy and cross_origin_opener_policy — which will allow extensions to specify a value for these response headers for requests to the extension’s origin. This includes the extension's background context (service worker or background page), popup, options page, tabs that are open to an extension resource, etc. For example, a manifest like

{     "background": {       "scripts": ["background.js"]     },     "manifest_version": 2,     "name": "CrossOriginIsolation",     "version": "1.1",     "cross_origin_embedder_policy": {       "value": "require-corp"     },     "cross_origin_opener_policy": {       "value": "same-origin"     },     .... }

will allow the extension to opt into cross origin isolation for its origin. These manifest keys are available for experimentation starting release 93.0.4574.0. Note that opting into cross origin isolation has some associated side effects; read more about these here.

We plan to remove the special exemption for extensions and require them to opt into cross origin isolation to use APIs like SharedArrayBuffers beginning with M94. We’ll send another PSA when that happens. 

Please let us know if you have any questions in this regard. 

Thanks, 

Karan,

On behalf of the Chrome Extensions team.