Chrome 141/Firefox 140 storage access activation per origin #28682

chrisdavidmills · 2025-12-16T16:59:49Z

Summary

While using the Storage Access API, when embedded content activates a previously-granted storage-access permission via the requestStorageAccess() method, 3rd party cookies are now only sent with requests to the calling embed's exact origin.

Previously, 3rd party cookies were sent with requests to the calling embed's site.

This behavioral change has occurred in:

Chrome 141: See https://chromestatus.com/feature/5169937372676096.
Firefox 140: See https://wpt.fyi/results/storage-access-api/requestStorageAccess-cross-origin-fetch.sub.https.window.html?run_id=5176618970775552

This PR adds notes in relevant places to document this change.

cc @cfredric / @hamishwillee — I'd appreciate your input on this one, folks.

Test results and supporting details

Related issues

github-actions · 2025-12-16T17:00:27Z

Tip: Review these changes grouped by change (recommended for most PRs), or grouped by feature (for large PRs).

http/headers/Activate-Storage-Access.json

Co-authored-by: Chris Fredrickson <[email protected]>

cfredric

Chrome details LGTM!

chrisdavidmills · 2026-01-05T12:14:27Z

Hi @caugner! Do you have time to look at this one?

api/Document.json

caugner

Should we actually move this into a behavioral subfeature? (This sounds like a spec change!?)

caugner · 2026-01-14T17:25:06Z

api/Document.json

            "firefox": {
-              "version_added": "65"
+              "version_added": "65",
+              "notes": "From version 140 onwards, activating the `storage-access` permission via `requestStorageAccess()` results in third-party cookies being sent only with requests to the calling embed's exact origin (see [bug 1965817](https://bugzil.la/1965817)). Before version 140, it resulted in third-party cookies being sent with requests to the calling embed's site."


I asked internally for confirmation that this is the right bug.

cfredric · 2026-01-14T22:49:09Z

(This sounds like a spec change!?)

Yup - the corresponding spec change was privacycg/storage-access#213.

caugner · 2026-01-15T08:58:33Z

Yup - the corresponding spec change was privacycg/storage-access#213.

Thanks! Based on that, the subfeature could be called strict_same_origin_policy.

chrisdavidmills · 2026-01-15T09:13:52Z

Yup - the corresponding spec change was privacycg/storage-access#213.

Thanks! Based on that, the subfeature could be called strict_same_origin_policy.

To clarify, how would you represent this in the current setup? This isn't a separate feature; it's represented as notes hanging off the requestStorageAccess() feature.

caugner · 2026-01-15T09:50:49Z

To clarify, how would you represent this in the current setup? This isn't a separate feature; it's represented as notes hanging off the requestStorageAccess() feature.

I would add a subfeature api.Document.requestStorageAccess.strict_same_origin_policy with the description explaining the new behavior.

chrisdavidmills · 2026-01-16T14:00:35Z

To clarify, how would you represent this in the current setup? This isn't a separate feature; it's represented as notes hanging off the requestStorageAccess() feature.

I would add a subfeature api.Document.requestStorageAccess.strict_same_origin_policy with the description explaining the new behavior.

OK, I've done so.

api/Document.json

caugner · 2026-01-16T14:20:18Z

api/Document.json

-              "notes": "Client-side storage access granted per-page ([see explanation](https://developer.mozilla.org/docs/Web/API/Storage_Access_API#how_it_works))"
+              "notes": [
+                "Client-side storage access is granted per-page ([see explanation](https://developer.mozilla.org/docs/Web/API/Storage_Access_API#how_it_works)).",
+                "`storage-access` activation results in third-party cookies being sent with requests to the calling embed's site."


Either this note describes the expected behavior before the spec change (then let's remove this note), or it describes a particular Chrome behavior before the spec change (then let's remove the note to the subfeature).

Rats, I meant to remove that note, but forgot. Removed now.

I also updated the URL on the remaining note line to point directly at the note that explains "granted per-page", as the existing URL wasn't very effective.

Co-authored-by: Claas Augner <[email protected]>

Chrome 141/Firefox 140 storage access activation per origin

258f40b

github-actions bot added data:http Compat data for HTTP features. https://developer.mozilla.org/docs/Web/HTTP data:api Compat data for Web APIs. https://developer.mozilla.org/docs/Web/API size:s [PR only] 7-24 LoC changed labels Dec 16, 2025

cfredric reviewed Dec 16, 2025

View reviewed changes

http/headers/Activate-Storage-Access.json Outdated Show resolved Hide resolved

Update http/headers/Activate-Storage-Access.json

f762117

Co-authored-by: Chris Fredrickson <[email protected]>

github-actions bot removed the data:http Compat data for HTTP features. https://developer.mozilla.org/docs/Web/HTTP label Dec 17, 2025

chrisdavidmills requested a review from caugner December 17, 2025 10:12

cfredric approved these changes Dec 17, 2025

View reviewed changes

Merge branch 'main' into storage-access-activation-per-origin-not-site

87efd15

caugner requested changes Jan 13, 2026

View reviewed changes

api/Document.json Outdated Show resolved Hide resolved

api/Document.json Outdated Show resolved Hide resolved

api/Document.json Outdated Show resolved Hide resolved

chrisdavidmills added 2 commits January 14, 2026 10:44

Merge branch 'main' into storage-access-activation-per-origin-not-site

6b8aeeb

fixes for caugner review comments

30dd2a4

github-actions bot added size:m [PR only] 25-100 LoC changed and removed size:s [PR only] 7-24 LoC changed labels Jan 14, 2026

chrisdavidmills requested a review from caugner January 14, 2026 10:48

caugner requested changes Jan 14, 2026

View reviewed changes

api/Document.json Outdated Show resolved Hide resolved

revert unwanted changes

013858e

github-actions bot added size:s [PR only] 7-24 LoC changed and removed size:m [PR only] 25-100 LoC changed labels Jan 14, 2026

chrisdavidmills requested a review from caugner January 14, 2026 17:11

caugner reviewed Jan 14, 2026

View reviewed changes

chrisdavidmills added 2 commits January 16, 2026 13:00

Merge branch 'main' into storage-access-activation-per-origin-not-site

e615c8b

Add separate strict_same_origin_policy feature

60207ab

github-actions bot added size:m [PR only] 25-100 LoC changed and removed size:s [PR only] 7-24 LoC changed labels Jan 16, 2026

chrisdavidmills requested a review from caugner January 16, 2026 14:00

caugner requested changes Jan 16, 2026

View reviewed changes

chrisdavidmills and others added 2 commits January 16, 2026 15:20

Update api/Document.json

2c160fc

Co-authored-by: Claas Augner <[email protected]>

Remove note, improve URL

8eec95a

chrisdavidmills requested a review from caugner January 16, 2026 15:31

caugner approved these changes Jan 16, 2026

View reviewed changes

Chrome 141/Firefox 140 storage access activation per origin #28682

Are you sure you want to change the base?

Chrome 141/Firefox 140 storage access activation per origin #28682

Conversation

chrisdavidmills commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test results and supporting details

Related issues

Uh oh!

github-actions bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

cfredric left a comment

Choose a reason for hiding this comment

Uh oh!

chrisdavidmills commented Jan 5, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

caugner left a comment

Choose a reason for hiding this comment

Uh oh!

caugner Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

cfredric commented Jan 14, 2026

Uh oh!

caugner commented Jan 15, 2026

Uh oh!

chrisdavidmills commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

caugner commented Jan 15, 2026

Uh oh!

chrisdavidmills commented Jan 16, 2026

Uh oh!

Uh oh!

caugner Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

chrisdavidmills Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chrisdavidmills commented Dec 16, 2025 •

edited

Loading

github-actions bot commented Dec 16, 2025 •

edited

Loading

chrisdavidmills commented Jan 15, 2026 •

edited

Loading