Does a missing COOP header disable WebAssembly shared memory in all modern browsers?

Yes, a missing Cross-Origin-Opener-Policy (COOP) header disables WebAssembly shared memory and threads in all modern browsers. To use SharedArrayBuffer or atomics, the page must be in a "cross-origin isolated" state, which requires **both** COOP and Cross-Origin-Embedder-Policy (COEP) to be set correctly.

The security gate is not applied to the WebAssembly module itself, but to the browser's execution environment. If window.crossOriginIsolated is false, the browser will either block the creation of SharedArrayBuffer or prevent the instantiation of Wasm modules that require shared memory (threads).

Failure Surfaces and Partial Configurations

When only one header is set, the browser fails to achieve isolation, and the behavior typically manifests as follows:

• COOP set, COEP missing: The page is not cross-origin isolated. Attempting to use SharedArrayBuffer will throw a TypeError in Chrome and Firefox.
• COEP set, COOP missing: The page is not cross-origin isolated. Chrome treats this identically to a missing COOP header; shared memory features remain locked.
nn
• Firefox/Safari behavior: In these browsers, if crossOriginIsolated is false, a Wasm module compiled with shared memory support will usually fail to instantiate with a LinkError or TypeError because the SharedArrayBuffer constructor is not available.

Required Configuration for Shared Memory

To enable Wasm threads and shared memory, ensure your server provides the following HTTP headers:

1. Cross-Origin-Opener-Policy: same-origin
2. Cross-Origin-Embedder-Policy: require-corp (or credentialless-corp if handling cross-origin resources)

You can verify the state by running the following in the browser console:

console.log(window.crossOriginIsolated);

Recovery and Constraints

A page cannot regain shared memory after adding missing headers without a full page reload. The isolation state is determined during the initial document load. If you update your headers server-side, the user must refresh the page to re-evaluate the crossOriginIsolated status.

Note: If your application runs inside a sandboxed &<iframe>, shared memory may still be blocked regardless of headers unless the iframe is specifically configured to allow it.