Title
Missing Cross-Origin-Embedder-Policy (COEP) Header Weakens Browser Cross-Origin Isolation
Summary
During the security assessment, it was identified that the Amplenote login page does not return the Cross-Origin-Embedder-Policy (COEP) HTTP response header.
Without the COEP header, the application cannot achieve full browser cross-origin isolation. This weakens browser-enforced protections against modern web attacks such as XS-Leaks and prevents the application from taking advantage of advanced browser security features such as SharedArrayBuffer. Although this issue is generally considered a defense-in-depth weakness, it is recommended to implement COEP on authentication pages handling sensitive user credentials.
Technical Description
The Cross-Origin-Embedder-Policy (COEP) response header instructs browsers to require that embedded cross-origin resources explicitly authorize embedding using CORS or Cross-Origin-Resource-Policy (CORP).
During testing of:
https:
the HTTP response did not include the following security header:
Cross-Origin-Embedder-Policy
A secure implementation should include:
Cross-Origin-Embedder-Policy: require-corp
Without this header:
Full browser cross-origin isolation cannot be achieved.
Protection against XS-Leaks is reduced.
Embedded resources are not required to explicitly opt into cross-origin embedding.
High-security browser features remain unavailable.
Defense-in-depth against browser-based attacks is weakened.
Steps to Reproduce
Open:
https:
Intercept the request using Burp Suite or open Developer Tools → Network.
Reload the page.
Select the main document request.
Inspect the HTTP response headers.
Observe that the following header is absent:
Cross-Origin-Embedder-Policy
Alternatively verify using:
curl -I https:
Confirm that no Cross-Origin-Embedder-Policy header is returned.
Working Proof of Concept (PoC)
HTTP Response Verification
curl -I https:
Example Response:
HTTP/2 200 OK
Content-Type: text/html
Missing:
Cross-Origin-Embedder-Policy
Browser Verification
Visit:
https:
Open Developer Tools → Network.
Reload the page.
Select the HTML document.
Review the response headers.
Observed:
Cross-Origin-Embedder-Policy:
(Not Present)
Browser Console Verification
Execute:
window.crossOriginIsolated
Output:
false
The false value indicates that the page is not cross-origin isolated, which is consistent with the absence of the COEP header.
Demonstration of Exploitation
Scenario 1 – Reduced Browser Isolation
Because COEP is not enabled, browsers do not require embedded cross-origin resources to explicitly authorize embedding through CORS or CORP, reducing browser-enforced isolation.
Scenario 2 – Increased Exposure to XS-Leaks
Attackers may combine browser timing behavior and cross-origin resource loading with other vulnerabilities to infer sensitive information about authenticated users.
Scenario 3 – Missing Full Cross-Origin Isolation
Modern browser isolation requires:
Cross-Origin-Opener-Policy (COOP)
Cross-Origin-Embedder-Policy (COEP)
Cross-Origin-Resource-Policy (CORP)
Without COEP, the application cannot benefit from full cross-origin isolation.
Attack Scenario
An attacker identifies that the login page does not implement COEP.
The attacker hosts a malicious webpage that interacts with browser behavior involving cross-origin resources.
Since browser cross-origin isolation is incomplete, browser protections are reduced.
The attacker combines this weakness with additional browser-based vulnerabilities.
The overall attack surface for authenticated users is increased.
User Impact
Successful exploitation may result in:
Reduced browser security isolation.
Increased exposure to XS-Leaks.
Reduced protection against browser side-channel attacks.
Greater risk when combined with other client-side vulnerabilities.
Business Impact
The absence of the COEP header may result in:
Reduced defense-in-depth.
Increased browser attack surface.
Inability to enable advanced browser security features.
Increased risk when chained with other vulnerabilities.
Potential reputational damage.
Increased remediation and incident response costs.
Remediation
Configure the web server to include the following HTTP response header on HTML responses:
Cross-Origin-Embedder-Policy: require-corp
Additionally:
Implement Cross-Origin-Opener-Policy: same-origin.
Configure Cross-Origin-Resource-Policy (CORP) where appropriate.
Review all third-party embedded resources for compatibility before enabling COEP.
Validate browser functionality after deployment.
Include COEP in the application's standard HTTP security header baseline.