Add Enterprise Policy for DataUrlInWebWorkerOpaqueOriginEnabled [chromium/src : main]

[gwsq (Gerrit)]

Attention needed from Pavol Marko and Victor Gabriel Savu

Message from gwsq

Reviewer source(s):
pma...@chromium.org, vsavu is from context(chrome/enterprise/gwsq/enterprise-policy-review.gwsq)

Open in Gerrit

Related details

Attention is currently required from:

• Pavol Marko
• Victor Gabriel Savu

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I0d3b00fb68436a11c564a6dcb2d3a2e14c98932d

Gerrit-Change-Number: 7742641

Gerrit-PatchSet: 3

Gerrit-Owner: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Reviewer: Pavol Marko <pma...@chromium.org>

Gerrit-Reviewer: Victor Gabriel Savu <vs...@google.com>

Gerrit-Reviewer: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-CC: Arnaud Mandy <arnaud...@intel.com>

Gerrit-CC: AyeAye <android-bu...@system.gserviceaccount.com>

Gerrit-CC: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: Enterprise Policy Reviews <enterprise-p...@google.com>

Gerrit-CC: Kenneth R Christiansen <kenneth.r.c...@intel.com>

Gerrit-CC: Wang, Wei4 <wei4...@intel.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-CC: gwsq

Gerrit-Attention: Victor Gabriel Savu <vs...@google.com>

Gerrit-Attention: Pavol Marko <pma...@chromium.org>

Gerrit-Comment-Date: Fri, 10 Apr 2026 06:57:55 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: No

[Victor Gabriel Savu (Gerrit)]

Attention needed from Pavol Marko and Yoshisato Yanagisawa

Victor Gabriel Savu added 2 comments

File components/policy/resources/templates/policy_definitions/Miscellaneous/DataUrlInWebWorkerOpaqueOriginEnabled.yaml

Line 3, Patchset 3 (Latest): If this policy is set to Enabled or left unset, Web Workers created from data: URLs will have a unique opaque origin. This is aligned with the HTML specification and improves security.

Victor Gabriel Savu . unresolved

Please include some background information. Ideally a link to more documentation for end users.

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/enterprise/description_guidelines.md

Line 7, Patchset 3 (Latest): This policy is intended to be temporary and will be removed in milestone 157.

Victor Gabriel Savu . unresolved

Is the default values for this policy changing with its introduction?

Open in Gerrit

Related details

Attention is currently required from:

• Pavol Marko
• Yoshisato Yanagisawa

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review

• No-Unresolved-Comments

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I0d3b00fb68436a11c564a6dcb2d3a2e14c98932d

Gerrit-Change-Number: 7742641

Gerrit-PatchSet: 3

Gerrit-Owner: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Reviewer: Pavol Marko <pma...@chromium.org>

Gerrit-Reviewer: Victor Gabriel Savu <vs...@google.com>

Gerrit-Reviewer: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-CC: Arnaud Mandy <arnaud...@intel.com>

Gerrit-CC: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: Enterprise Policy Reviews <enterprise-p...@google.com>

Gerrit-CC: Kenneth R Christiansen <kenneth.r.c...@intel.com>

Gerrit-CC: Wang, Wei4 <wei4...@intel.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-CC: gwsq

Gerrit-Attention: Pavol Marko <pma...@chromium.org>

Gerrit-Attention: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Comment-Date: Fri, 10 Apr 2026 07:45:46 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

[Yoshisato Yanagisawa (Gerrit)]

Attention needed from Pavol Marko and Victor Gabriel Savu

Yoshisato Yanagisawa added 2 comments

File components/policy/resources/templates/policy_definitions/Miscellaneous/DataUrlInWebWorkerOpaqueOriginEnabled.yaml

Line 3, Patchset 3: If this policy is set to Enabled or left unset, Web Workers created from data: URLs will have a unique opaque origin. This is aligned with the HTML specification and improves security.

Victor Gabriel Savu . unresolved

Please include some background information. Ideally a link to more documentation for end users.

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/enterprise/description_guidelines.md

Yoshisato Yanagisawa

I've updated the description to include a comprehensive Background paragraph that explains what a data: URL worker is and how the origin behavior is changing. Since there isn't a dedicated, admin-friendly external explainer for this specific security fix, providing the context directly inline in the policy description seemed like the most helpful approach for IT admins.

Line 7, Patchset 3: This policy is intended to be temporary and will be removed in milestone 157.

Victor Gabriel Savu . unresolved

Is the default values for this policy changing with its introduction?

Yoshisato Yanagisawa

Yes, Chrome's default behavior is changing (we are making the origins opaque by default), which is why this escape hatch policy is being introduced. I made sure the new description explicitly mentions that Chrome is changing its default behavior to clarify this point.

Open in Gerrit

Related details

Attention is currently required from:

• Pavol Marko
• Victor Gabriel Savu

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review
• No-Unresolved-Comments
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I0d3b00fb68436a11c564a6dcb2d3a2e14c98932d

Gerrit-Change-Number: 7742641

Gerrit-PatchSet: 5

Gerrit-Owner: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Reviewer: Pavol Marko <pma...@chromium.org>

Gerrit-Reviewer: Victor Gabriel Savu <vs...@google.com>

Gerrit-Reviewer: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-CC: Arnaud Mandy <arnaud...@intel.com>

Gerrit-CC: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: Enterprise Policy Reviews <enterprise-p...@google.com>

Gerrit-CC: Kenneth R Christiansen <kenneth.r.c...@intel.com>

Gerrit-CC: Wang, Wei4 <wei4...@intel.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-CC: gwsq

Gerrit-Attention: Victor Gabriel Savu <vs...@google.com>

Gerrit-Attention: Pavol Marko <pma...@chromium.org>

Gerrit-Comment-Date: Mon, 13 Apr 2026 00:19:55 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

Comment-In-Reply-To: Victor Gabriel Savu <vs...@google.com>

[Victor Gabriel Savu (Gerrit)]

Attention needed from Pavol Marko and Yoshisato Yanagisawa

Victor Gabriel Savu voted and added 4 comments

Votes added by Victor Gabriel Savu

Code-Review

+1

4 comments

File components/policy/resources/templates/policy_definitions/Miscellaneous/DataUrlInWebWorkerOpaqueOriginEnabled.yaml

Line 3, Patchset 3: If this policy is set to Enabled or left unset, Web Workers created from data: URLs will have a unique opaque origin. This is aligned with the HTML specification and improves security.

Victor Gabriel Savu . resolved

Please include some background information. Ideally a link to more documentation for end users.

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/enterprise/description_guidelines.md

Yoshisato Yanagisawa

I've updated the description to include a comprehensive Background paragraph that explains what a data: URL worker is and how the origin behavior is changing. Since there isn't a dedicated, admin-friendly external explainer for this specific security fix, providing the context directly inline in the policy description seemed like the most helpful approach for IT admins.

Victor Gabriel Savu

Acknowledged

Line 5, Patchset 5 (Latest): Web Workers can be created using a data: URL containing the worker's script. Previously, these workers inherited the origin of the page that created them, allowing them to access the same local storage, cookies, and other origin-bound data. To improve security and align with the HTML specification, Chrome is changing its default behavior so that workers created from data: URLs will now have a unique, opaque origin. This isolates them from the creator page's data.

Victor Gabriel Savu . unresolved

I think `data:`, specifically the `:` needs to be escaped or dropped from here and below.

Line 5, Patchset 5 (Latest): Web Workers can be created using a data: URL containing the worker's script. Previously, these workers inherited the origin of the page that created them, allowing them to access the same local storage, cookies, and other origin-bound data. To improve security and align with the HTML specification, Chrome is changing its default behavior so that workers created from data: URLs will now have a unique, opaque origin. This isolates them from the creator page's data.

Victor Gabriel Savu . unresolved

Be specific about the version.

Chrome is changing its default in MXXX ...

Line 7, Patchset 3: This policy is intended to be temporary and will be removed in milestone 157.

Victor Gabriel Savu . resolved

Is the default values for this policy changing with its introduction?

Yoshisato Yanagisawa

Yes, Chrome's default behavior is changing (we are making the origins opaque by default), which is why this escape hatch policy is being introduced. I made sure the new description explicitly mentions that Chrome is changing its default behavior to clarify this point.

Victor Gabriel Savu

Acknowledged

Open in Gerrit

Related details

Attention is currently required from:

• Pavol Marko
• Yoshisato Yanagisawa

Submit Requirements:

• Code-Coverage
• Code-Owners

• Code-Review

• No-Unresolved-Comments

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I0d3b00fb68436a11c564a6dcb2d3a2e14c98932d

Gerrit-Change-Number: 7742641

Gerrit-PatchSet: 5

Gerrit-Owner: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Reviewer: Pavol Marko <pma...@chromium.org>

Gerrit-Reviewer: Victor Gabriel Savu <vs...@google.com>

Gerrit-Reviewer: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-CC: Arnaud Mandy <arnaud...@intel.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: Enterprise Policy Reviews <enterprise-p...@google.com>

Gerrit-CC: Kenneth R Christiansen <kenneth.r.c...@intel.com>

Gerrit-CC: Wang, Wei4 <wei4...@intel.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-CC: chromiu...@luci-project-accounts.iam.gserviceaccount.com <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: gwsq

Gerrit-Attention: Pavol Marko <pma...@chromium.org>

Gerrit-Attention: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Comment-Date: Mon, 13 Apr 2026 12:47:52 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: Yes

Comment-In-Reply-To: Victor Gabriel Savu <vs...@google.com>

Comment-In-Reply-To: Yoshisato Yanagisawa <yyana...@chromium.org>

[Pavol Marko (Gerrit)]

Attention needed from Yoshisato Yanagisawa

Pavol Marko added 3 comments

File components/policy/resources/templates/policy_definitions/Miscellaneous/DataUrlInWebWorkerOpaqueOriginEnabled.yaml

Line 7, Patchset 5 (Latest): If this policy is set to Enabled or left unset, the new secure behavior is used, and Web Workers created from data: URLs will have a unique opaque origin.

Pavol Marko . unresolved

Should this say the "new default (more secure) behavior" ?

Line 15, Patchset 5 (Latest): dynamic_refresh: false

Pavol Marko . unresolved

Is it ? Will a change not affect new page loads?

Line 18, Patchset 5 (Latest):- caption: 'Opaque origins for data: URLs in Web Workers are enabled'

Pavol Marko . unresolved

Consider adding " (new default behavior)" and " (deprecated legacy behavior)" here and below

Open in Gerrit

Related details

Attention is currently required from:

• Yoshisato Yanagisawa

Gerrit-Attention: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Comment-Date: Tue, 14 Apr 2026 08:47:54 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

[Yoshisato Yanagisawa (Gerrit)]

Attention needed from Pavol Marko and Victor Gabriel Savu

Yoshisato Yanagisawa added 5 comments

File components/policy/resources/templates/policy_definitions/Miscellaneous/DataUrlInWebWorkerOpaqueOriginEnabled.yaml

Line 5, Patchset 5: Web Workers can be created using a data: URL containing the worker's script. Previously, these workers inherited the origin of the page that created them, allowing them to access the same local storage, cookies, and other origin-bound data. To improve security and align with the HTML specification, Chrome is changing its default behavior so that workers created from data: URLs will now have a unique, opaque origin. This isolates them from the creator page's data.

Victor Gabriel Savu . resolved

Be specific about the version.

Chrome is changing its default in MXXX ...

Yoshisato Yanagisawa

Done

Line 5, Patchset 5: Web Workers can be created using a data: URL containing the worker's script. Previously, these workers inherited the origin of the page that created them, allowing them to access the same local storage, cookies, and other origin-bound data. To improve security and align with the HTML specification, Chrome is changing its default behavior so that workers created from data: URLs will now have a unique, opaque origin. This isolates them from the creator page's data.

Victor Gabriel Savu . resolved

I think `data:`, specifically the `:` needs to be escaped or dropped from here and below.

Yoshisato Yanagisawa

Done

Line 7, Patchset 5: If this policy is set to Enabled or left unset, the new secure behavior is used, and Web Workers created from data: URLs will have a unique opaque origin.

Pavol Marko . resolved

Should this say the "new default (more secure) behavior" ?

Yoshisato Yanagisawa

Done

Line 15, Patchset 5: dynamic_refresh: false

Pavol Marko . resolved

Is it ? Will a change not affect new page loads?

Yoshisato Yanagisawa

You are right. Fixed.

Line 18, Patchset 5:- caption: 'Opaque origins for data: URLs in Web Workers are enabled'

Pavol Marko . resolved

Consider adding " (new default behavior)" and " (deprecated legacy behavior)" here and below

Yoshisato Yanagisawa

Done

Open in Gerrit

Related details

Attention is currently required from:

• Pavol Marko
• Victor Gabriel Savu

Submit Requirements:

• Code-Coverage
• Code-Owners

• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I0d3b00fb68436a11c564a6dcb2d3a2e14c98932d

Gerrit-Change-Number: 7742641

Gerrit-PatchSet: 7

Gerrit-Owner: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Reviewer: Pavol Marko <pma...@chromium.org>

Gerrit-Reviewer: Victor Gabriel Savu <vs...@google.com>

Gerrit-Reviewer: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-CC: Arnaud Mandy <arnaud...@intel.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: Enterprise Policy Reviews <enterprise-p...@google.com>

Gerrit-CC: Kenneth R Christiansen <kenneth.r.c...@intel.com>

Gerrit-CC: Wang, Wei4 <wei4...@intel.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-CC: chromiu...@luci-project-accounts.iam.gserviceaccount.com <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: gwsq

Gerrit-Attention: Victor Gabriel Savu <vs...@google.com>

Gerrit-Attention: Pavol Marko <pma...@chromium.org>

Gerrit-Comment-Date: Tue, 14 Apr 2026 11:04:54 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

Comment-In-Reply-To: Victor Gabriel Savu <vs...@google.com>

Comment-In-Reply-To: Pavol Marko <pma...@chromium.org>

[Victor Gabriel Savu (Gerrit)]

Attention needed from Pavol Marko and Yoshisato Yanagisawa

Victor Gabriel Savu voted Code-Review+1

Code-Review

+1

Open in Gerrit

Related details

Attention is currently required from:

• Pavol Marko
• Yoshisato Yanagisawa

Submit Requirements:

• Code-Coverage
• Code-Owners

• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I0d3b00fb68436a11c564a6dcb2d3a2e14c98932d

Gerrit-Change-Number: 7742641

Gerrit-PatchSet: 7

Gerrit-Owner: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Reviewer: Pavol Marko <pma...@chromium.org>

Gerrit-Reviewer: Victor Gabriel Savu <vs...@google.com>

Gerrit-Reviewer: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-CC: Arnaud Mandy <arnaud...@intel.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: Enterprise Policy Reviews <enterprise-p...@google.com>

Gerrit-CC: Kenneth R Christiansen <kenneth.r.c...@intel.com>

Gerrit-CC: Wang, Wei4 <wei4...@intel.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-CC: chromiu...@luci-project-accounts.iam.gserviceaccount.com <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: gwsq

Gerrit-Attention: Pavol Marko <pma...@chromium.org>

Gerrit-Attention: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Comment-Date: Tue, 14 Apr 2026 11:12:52 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Pavol Marko (Gerrit)]

Attention needed from Yoshisato Yanagisawa

Pavol Marko voted Code-Review+1

Code-Review

+1

Open in Gerrit

Related details

Attention is currently required from:

• Yoshisato Yanagisawa

Gerrit-Attention: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Comment-Date: Tue, 14 Apr 2026 11:26:26 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Yoshisato Yanagisawa (Gerrit)]

Attention needed from Rakina Zata Amni

Yoshisato Yanagisawa added 1 comment

Patchset-level comments

File-level comment, Patchset 7 (Latest):

Yoshisato Yanagisawa . resolved

Rakina: will you review content_browser_client.*?

Open in Gerrit

Related details

Attention is currently required from:

• Rakina Zata Amni

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I0d3b00fb68436a11c564a6dcb2d3a2e14c98932d

Gerrit-Change-Number: 7742641

Gerrit-PatchSet: 7

Gerrit-Owner: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-Reviewer: Pavol Marko <pma...@chromium.org>

Gerrit-Reviewer: Rakina Zata Amni <rak...@chromium.org>

Gerrit-Reviewer: Victor Gabriel Savu <vs...@google.com>

Gerrit-Reviewer: Yoshisato Yanagisawa <yyana...@chromium.org>

Gerrit-CC: Arnaud Mandy <arnaud...@intel.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: Enterprise Policy Reviews <enterprise-p...@google.com>

Gerrit-CC: Kenneth R Christiansen <kenneth.r.c...@intel.com>

Gerrit-CC: Wang, Wei4 <wei4...@intel.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-CC: chromiu...@luci-project-accounts.iam.gserviceaccount.com <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: gwsq

Gerrit-Attention: Rakina Zata Amni <rak...@chromium.org>

Gerrit-Comment-Date: Tue, 14 Apr 2026 13:34:15 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No