@@ -6393,6 +6393,12 @@ function wp_set_client_side_media_processing_flag(): void {
63936393
63946394 wp_add_inline_script ( 'wp-block-editor ' , 'window.__clientSideMediaProcessing = true ' , 'before ' );
63956395
6396+ $ chromium_version = wp_get_chromium_major_version ();
6397+
6398+ if ( null !== $ chromium_version && $ chromium_version >= 137 ) {
6399+ wp_add_inline_script ( 'wp-block-editor ' , 'window.__documentIsolationPolicy = true; ' , 'before ' );
6400+ }
6401+
63966402 /*
63976403 * Register the @wordpress/vips/worker script module as a dynamic dependency
63986404 * of the wp-upload-media classic script. This ensures it is included in the
@@ -6405,15 +6411,33 @@ function wp_set_client_side_media_processing_flag(): void {
64056411 );
64066412}
64076413
6414+ /**
6415+ * Returns the major Chrome/Chromium version from the current request's User-Agent.
6416+ *
6417+ * Matches all Chromium-based browsers (Chrome, Edge, Opera, Brave).
6418+ *
6419+ * @since 7.0.0
6420+ *
6421+ * @return int|null The major Chrome version, or null if not a Chromium browser.
6422+ */
6423+ function wp_get_chromium_major_version (): ?int {
6424+ if ( empty ( $ _SERVER ['HTTP_USER_AGENT ' ] ) ) {
6425+ return null ;
6426+ }
6427+ if ( preg_match ( '#Chrome/(\d+)# ' , $ _SERVER ['HTTP_USER_AGENT ' ], $ matches ) ) {
6428+ return (int ) $ matches [1 ];
6429+ }
6430+ return null ;
6431+ }
6432+
64086433/**
64096434 * Enables cross-origin isolation in the block editor.
64106435 *
64116436 * Required for enabling SharedArrayBuffer for WebAssembly-based
6412- * media processing in the editor.
6437+ * media processing in the editor. Uses Document-Isolation-Policy
6438+ * on supported browsers (Chromium 137+).
64136439 *
64146440 * @since 7.0.0
6415- *
6416- * @link https://web.dev/coop-coep/
64176441 */
64186442function wp_set_up_cross_origin_isolation (): void {
64196443 if ( ! wp_is_client_side_media_processing_enabled () ) {
@@ -6439,26 +6463,22 @@ function wp_set_up_cross_origin_isolation(): void {
64396463}
64406464
64416465/**
6442- * Starts an output buffer to send cross-origin isolation headers .
6466+ * Sends the Document-Isolation-Policy header for cross-origin isolation.
64436467 *
6444- * Sends headers and uses an output buffer to add crossorigin="anonymous"
6445- * attributes where needed.
6468+ * Uses an output buffer to add crossorigin="anonymous" where needed.
64466469 *
64476470 * @since 7.0.0
6448- *
6449- * @link https://web.dev/coop-coep/
6450- *
6451- * @global bool $is_safari
64526471 */
64536472function wp_start_cross_origin_isolation_output_buffer (): void {
6454- global $ is_safari ;
6473+ $ chromium_version = wp_get_chromium_major_version () ;
64556474
6456- $ coep = $ is_safari ? 'require-corp ' : 'credentialless ' ;
6475+ if ( null === $ chromium_version || $ chromium_version < 137 ) {
6476+ return ;
6477+ }
64576478
64586479 ob_start (
6459- static function ( string $ output ) use ( $ coep ): string {
6460- header ( 'Cross-Origin-Opener-Policy: same-origin ' );
6461- header ( "Cross-Origin-Embedder-Policy: $ coep " );
6480+ static function ( string $ output ): string {
6481+ header ( 'Document-Isolation-Policy: isolate-and-credentialless ' );
64626482
64636483 return wp_add_crossorigin_attributes ( $ output );
64646484 }
0 commit comments