![Thomas Steiner](https://web.dev/images/authors/thomassteiner.jpg) Thomas Steiner [GitHub](https://github.com/tomayac) [LinkedIn](https://www.linkedin.com/in/thomassteinerlinkedin) [Mastodon](https://toot.cafe/@tomayac) [Bluesky](https://bsky.app/profile/tomayac.com) [Homepage](https://blog.tomayac.com/)


Published: November 10, 2026

<br />

Modern web apps often depend on large assets, such as JavaScript frameworks, game engines, and AI models. Despite the fact sites are using identical assets, each site has to download and store their own copy of each.

With the proposed [Cross-Origin Storage API](https://github.com/WICG/cross-origin-storage), COS for short, the client specifies the content it's looking for by its hash, and fetches it from any URL to share it across the designated sites (or all sites). This means an exact, known resource can be shared across sites, independent from serving the asset. With this proposal comes security benefits and safety challenges.

## Use cases

We've written at-length about the importance of [caching models](https://developer.chrome.com/docs/ai/cache-models.md.txt) and [caching any asset](https://web.dev/learn/pwa/caching) with the Cache Storage API. The Cross-Origin Storage API goes a step further, and could be beneficial when multiple related (or otherwise) websites need access to the same resource:

- **AI models:** Models like Gemma or Llama variants weigh anywhere from roughly a gigabyte to tens of gigabytes. Storing and retrieving one copy through COS avoids massive duplicate downloads. This is a major motivation behind the proposal.
- **Wasm modules:** Frameworks like Flutter ship Wasm files that are requested millions of times a day across thousands of distinct origins, always byte-identical.
- **Popular JavaScript libraries and frameworks:** Bundling vendor code separately and in its entirety (such as the complete, untreeshaken React library) lets multiple apps share one cached copy through COS.
- **Game engines:** Browser games built on engines like Godot or Unity can share the engine runtime through COS and fetch only game-specific assets over the network. Gaming portals that host many casual games across different origins or iframes benefit the most.
- **Large web fonts:** Icon fonts, emoji fonts, and fonts with broad Unicode coverage are downloaded across an enormous number of pages. Sharing them once through COS helps both performance and sustainability.

![Two unrelated Three.js games, Descent and Quake, share one copy of the engine through COS, inspected in DevTools.](https://developer.chrome.com/static/blog/introducing-cross-origin-storage/cos-quake.png) Two unrelated Three.js games, [Descent](https://tomayac.github.io/three-descent/) (in the background tab) and [Quake](https://web-ai-community.github.io/three-quake/) (in the foreground tab), share one copy of the engine through COS, inspected in DevTools. This screenshot is from an [experimental Chromium build](https://goo.gle/cos-chromium) and may not reflect the final design.

## The basic flow of working with COS

The COS API introduces a `navigator.crossOriginStorage.getFileHandle()` method through which web apps store and retrieve files across origin boundaries, identified by a cryptographic hash. The explainer has an example that shows the [basic flow of working with the API](https://github.com/WICG/cross-origin-storage#introduction).

> [!NOTE]
> **Note:** Apart from the imperative `navigator.crossOriginStorage` interface, there are additional COS integrations planned [for HTML](https://github.com/WICG/cross-origin-storage/#html-integration), [for CSS](https://github.com/WICG/cross-origin-storage/#css-integration), [for JavaScript](https://github.com/WICG/cross-origin-storage/#javascript-import-attribute-integration), and [for `fetch()`](https://github.com/WICG/cross-origin-storage/#fetch-integration).

## Try it today

There are two ways to experiment with COS right now:

- **Install a browser extension from the** [Chrome Web Store](https://chromewebstore.google.com/detail/cross-origin-storage/denpnpcgjgikjpoglpjefakmdcbmlgih), [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/cross-origin-storage/), or [Safari App Store](https://apps.apple.com/us/app/cross-origin-storage/id6788319695) to polyfill the API surface and all integrations. You can test the API flow in any browser. Or [load the extension unpacked](https://developer.chrome.com/docs/extensions/get-started/tutorial/hello-world.md.txt#load-unpacked) from its [source code](https://github.com/web-ai-community/cross-origin-storage-extension).
- **Experiment in Chromium** : There's an experimental Chromium implementation. Download it for macOS on Apple silicon or Linux x86_64 from [goo.gle/cos-chromium](https://goo.gle/cos-chromium), then open `about://flags`, search for "Cross-Origin Storage", set it to **Enabled** , and restart when prompted. This build includes a DevTools integration: find **Cross-origin storage** in the **Application** tab.

## Ecosystem interest

COS is an early-stage proposal, and a number of projects already ship experimental support, typically behind an opt-in flag and layered as a progressive enhancement:

- [**Emscripten**](https://emscripten.org/docs/compiling/CrossOriginStorage.html) shares generated Wasm output.
- [**Flutter**](https://github.com/flutter/flutter/issues/181433#issuecomment-4361950100) shares its Skia Wasm runtime.
- [**Transformers.js**](https://huggingface.co/docs/transformers.js/api/env#envtransformersenvironment--object) shares model weights and the Wasm runtimes they depend on.
- [**WebLLM**](https://webllm.mlc.ai/docs/user/advanced_usage.html#using-cross-origin-storage-cache) shares models and runtimes.
- [**wllama**](https://github.com/ngxson/wllama/pull/248) shares AI models.
- [**Nuxt.js**](https://github.com/danielroe/cross-origin-storage) loads shared dependencies from Cross-Origin Storage and maintains a [Vite COS plugin](https://github.com/danielroe/cross-origin-storage/tree/main/packages/vite-plugin-cross-origin-storage).
- [**Prompt API Polyfill**](https://www.npmjs.com/package/prompt-api-polyfill) shares AI models across its WebLLM and Transformers.js backends.
- [**Prebid.js**](https://github.com/prebid/Prebid.js/pull/15329) has a COS-ready CDN distribution of the header bidding library.

## Standardization

Cross-Origin Storage is an early-stage [WICG](https://www.w3.org/community/wicg/) proposal. You can read the early [W3C TAG Design Review](https://github.com/w3ctag/design-reviews/issues/1254).

- Host integrations are filed with their respective standards bodies:
  - [`crossoriginstorage` attribute](https://github.com/whatwg/html/issues/12770) and [`crossOriginStorage` import attribute](https://github.com/whatwg/html/issues/12771) with the WHATWG HTML Standard
  - [`cross-origin-storage()`](https://github.com/w3c/csswg-drafts/issues/14056) with the CSS Working Group
  - [`crossOriginStorage` request option](https://github.com/whatwg/fetch/issues/1954) with the Fetch Standard
- Cross-browser [**Web Platform Tests**](https://github.com/web-platform-tests/wpt/pull/61811) (work in progress)
- Standards positions have been requested from [**Mozilla**](https://github.com/mozilla/standards-positions/issues/1427) and [**WebKit**](https://github.com/WebKit/standards-positions/issues/703).

Feedback on the API and the proposal is welcome. You can file issues, [show support](https://github.com/WICG/cross-origin-storage/labels/expression%20of%20support), or open pull requests in the [Cross-Origin Storage repository](https://github.com/WICG/cross-origin-storage/).

## Resources

- Read the [explainer for the Cross-Origin Storage API](https://github.com/WICG/cross-origin-storage/) and the [spec draft](https://wicg.github.io/cross-origin-storage/).
- Follow the implementation of COS in Chrome by starring the [Cross-Origin Storage umbrella bug](https://issues.chromium.org/issues/547587764) and its [dependencies](https://issues.chromium.org/issues/547587764/dependencies).
- Check out the [Public Hash List explainer](https://github.com/WICG/cross-origin-storage/blob/main/public-hash-list/phl-explainer.md).
- Take the COS [security and privacy questionnaire](https://github.com/WICG/cross-origin-storage/blob/main/security-privacy-questionnaire.md).
- Review the [Intent to Prototype](https://groups.google.com/a/chromium.org/g/blink-dev/c/p5nq70aN63o/m/uNm_oaEOBQAJ) and the [Chrome Platform Status](https://chromestatus.com/feature/5163371507875840) entry.

Plus, check out this tooling and demos:

- [Awesome Cross-Origin Storage](https://github.com/tomayac/awesome-cross-origin-storage)
- [Cross-Origin Storage extension source and usage instructions](https://github.com/web-ai-community/cross-origin-storage-extension)

### Additional background reading

- [Gaining security and privacy by partitioning the cache](https://developer.chrome.com/blog/http-cache-partitioning.md.txt)
- [Experimenting with the proposed Cross-Origin Storage API in Transformers.js](https://huggingface.co/blog/cross-origin-storage)
- [HTTP cache partitioning: the same image, downloaded twice](https://joanleon.dev/en/http-cache-partitioning-cross-origin-storage/) by Joan León
- [Cross-Origin Storage API: Stop Downloading Twice](https://morello.dev/blog/cross-origin-storage-api) by Dennis Morello
- [I wanted the browser to just ship jQuery. Cross-Origin Storage came for rescue](https://alfy.blog/2026/08/31/cross-origin-storage.html) by Ahmad Alfy

### Talks and podcasts

- [ShopTalk Show 732: Thomas Steiner on New Cross-Origin Storage APIs](https://shoptalkshow.com/732/) (podcast)
- [Working Draft 723: Cross-Origin Storage API](https://workingdraft.de/723/) (podcast in German)
- [WeAreDevelopers: What is Cross-Origin Storage](https://www.wearedevelopers.com/videos/2162-what-is-cross-origin-storage-thomas-steiner) (podcast)
- [Cross-Origin Storage: a shared cache for the web](https://gitnation.com/contents/cross-origin-storage-a-shared-cache-for-the-web) at JSNation US 2026