Chromium with Cross-Origin Storage (Linux x64, 2026-08-17 · macOS arm64, 2026-08-19)

Unofficial developer builds of Chromium with the Cross-Origin Storage API, for Linux x86_64 and macOS on Apple Silicon.

Not an official Google Chrome release: unsigned, no auto-update, no security review, built from a development branch rather than trunk.

⚠️ You must enable the flag now

Unlike the previous build, the API is off by default — as an unshipped proposal should be. Enable it either way:

1. Open about://flags, search for Cross-Origin Storage, set it to Enabled, restart when prompted.
2. Or start the browser with the feature on: --enable-features=CrossOriginStorage

Without this, navigator.crossOriginStorage is undefined. That is the flag working, not a broken build.

Linux x86_64

tar -xzf chromium-cos-linux-x64.tar.gz
cd chromium-cos
./chrome --enable-features=CrossOriginStorage

Keep the files together. cross_origin_storage_public_hash_list.bin must stay beside the chrome binary — it is the Public Hash List (311,494 digests) that gates whether a '*'-scoped entry may be disclosed to an origin that did not store it. Without it nothing is ever shared cross-origin, because the gate fails closed.

macOS on Apple Silicon (arm64)

The app carries an ad-hoc signature only, so macOS quarantines it on download and refuses to launch it until that attribute is cleared:

unzip chromium-cos-macos-arm64.zip
cd chromium-cos-macos-arm64
xattr -dr com.apple.quarantine Chromium.app
./Chromium.app/Contents/MacOS/Chromium --enable-features=CrossOriginStorage

Here the Public Hash List ships inside the bundle, in Chromium Framework.framework/Resources/, so there is no loose file to keep beside the binary. Intel Macs are not covered by this archive.

navigator.crossOriginStorage is a secure-context API, so test over https:// or on http://localhost. See README.txt in either archive for a copy-paste smoke test.

The macOS build is newer than the Linux one

It was built on 2026-08-19 and carries three changes the 2026-08-17 Linux binary does not have.

A repeat write by an origin that already stores the entry no longer draws on the write budget. Content-addressability makes such a write free against quota, and the rate limiter now agrees: re-verifying bytes you already store adds no entry and no file. The exemption stays narrow — it applies only to a hash this origin is already a storing origin for, something it necessarily knows already, so the limiter still reports nothing about what any other origin holds.

A dropped browser pipe settles the promises waiting on it. For a context the browser refuses to serve at all — an opaque origin in practice — it closes the pipe instead of replying, which previously left those promises pending forever. They now reject with the same indistinguishable NotFoundError as any other refusal: the caller learns it was refused, never why.

The Public Hash List is bundled inside the Mac app. base::DIR_ASSETS resolves to the framework's Resources directory for a bundled app, so the list is placed there rather than shipped loose next to the binary.

Changes since 2026-08-16

The API no longer ships enabled. The previous two builds default-enabled an unlaunched web API for anyone who ran them. It is now behind about://flags#cross-origin-storage, and the underlying base::Feature (CrossOriginStorage, also the Finch handle) defaults to disabled — so a killswitch works in the direction a staged rollout actually needs.

Metrics. Four UseCounters record read and write intent and read outcome. A browser-side histogram, Storage.CrossOriginStorage.ReadOutcome, records why a read was not served — genuine miss, out of scope, absent from the Public Hash List, GREASE'd, or rate-limited. The API deliberately reports one indistinguishable error to callers for all of those, so the browser process is the only place the real distribution is knowable; it is what will show whether the Public Hash List is large enough to be worth having.

Changes since 2026-08-15

Handles are transferable. A handle can be postMessage()d to a same-origin worker or frame, carrying its readability with it, so a create-request handle that was never written through stays unreadable. Cross-origin transfers are not delivered.

⚠️ On-disk format changed (metadata v1 → v2). Entries written by the 2026-08-15 build cannot be read here and are deleted on first run, along with their bytes. Nothing meaningful is lost — COS is a content-addressable cache — but note that build stranded those bytes rather than reclaiming them; that leak is fixed.

Per-origin storage accounting changed. Every origin that stores an entry is charged its full size, while the global total counts it once. Splitting the cost fractionally was rejected: it would let an origin detect that another origin had stored a given hash by watching its own quota.

Public Hash List relicensed from MPL-2.0 to Apache-2.0 upstream. The list data is unchanged (sha256 1bc0a5fa5ea0e8e5f7e847f26e2c198641f0fb711e49ed60e4dddc44b0bb5132).

What works

The imperative navigator.crossOriginStorage API — all three disclosure scopes, Public Hash List availability gating, GREASE'ing, visibility upgrades, per-origin quota and eviction, rate limiting, Permissions Policy integration, and handle transfer. Available in windows, dedicated workers, shared workers and service workers.

Not implemented, each tracked separately: the declarative HTML attribute (547587766), the CSS modifier (547302826), the JS import attribute (547587768), and the DevTools (547587771) and extensions (547675864) surfaces.

Tracking bug: 547302825 · Umbrella: 547587764 · CL: 8256403

sha256 (chromium-cos-linux-x64.tar.gz): 7efccf9e3704dc8b08cc4016c279e144c679fdf748962f8c574fae2c5b159f56
sha256 (chromium-cos-macos-arm64.zip): eb19c2986d95cb1662ce519a9c8cbd63c23a7be32ceaf026e78c881ff9c2b2b2
The Linux archive bundles only the en-US locale; the macOS app bundles all of them.

Chromium with Cross-Origin Storage enabled (Linux x64, 2026-08-16)

Unofficial Linux x86_64 developer build of Chromium with the Cross-Origin Storage API enabled by default — no command-line flags needed.

Not an official Google Chrome release: unsigned, no auto-update, no security review, built from a development branch rather than trunk.

tar -xzf chromium-cos-linux-x64.tar.gz
cd chromium-cos
./chrome

navigator.crossOriginStorage is a secure-context API, so test over https:// or on http://localhost. See README.txt in the archive for a copy-paste smoke test.

Keep the files together. cross_origin_storage_public_hash_list.bin must stay beside the chrome binary — it is the Public Hash List (311,494 digests) that gates whether a '*'-scoped entry may be disclosed to an origin that did not store it. Without it nothing is ever shared cross-origin, because the gate fails closed.

Changes since the 2026-08-15 build

Handles are transferable. A FileSystemFileHandle for a COS entry can now be postMessage()d to a same-origin worker or frame. Readability travels with the handle rather than being re-evaluated on arrival, so a create-request handle that was never written through stays unreadable, and transferring one cannot be used to re-roll GREASE'ing. Cross-origin transfers are not delivered. The previous build predates this entirely.

Per-origin storage accounting changed. Every origin that stores an entry is now charged its full size, while the global total still counts it once. Previously the whole cost went to whichever origin wrote it first, so a second origin storing identical bytes was charged nothing. Splitting the cost fractionally was considered and rejected: it would let an origin detect that another origin had stored a given hash by watching its own remaining quota, which is exactly the disclosure the Public Hash List and availability gating exist to prevent.

⚠️ On-disk format changed (metadata v1 → v2). Entries written by the 2026-08-15 build cannot be read by this one. On first run they are deleted, along with their bytes. Nothing meaningful is lost — COS is a content-addressable cache, so anything dropped is re-fetchable — but a build in between would have stranded those bytes on disk instead: unreachable through any hash, counted in no total, and evictable by nothing. That leak is fixed here, and is the reason this build reclaims rather than skips.

Public Hash List relicensed from MPL-2.0 to Apache-2.0 upstream. The list data is unchanged (sha256 1bc0a5fa5ea0e8e5f7e847f26e2c198641f0fb711e49ed60e4dddc44b0bb5132).

What works

The imperative navigator.crossOriginStorage API — all three disclosure scopes, Public Hash List availability gating, GREASE'ing, visibility upgrades, per-origin quota and eviction, rate limiting, Permissions Policy integration, and handle transfer. Available in windows, dedicated workers, shared workers and service workers.

Not implemented: the declarative HTML crossoriginstorage attribute, the CSS cross-origin-storage() modifier, and the JavaScript crossOriginStorage import attribute — each defined in its own host-language specification.

sha256 (archive): 8ebd5c09d1cd8cdcff1d121db1231a47d783264527826322588c13d4a00183f7
Only the en-US locale is bundled.

Chromium with Cross-Origin Storage enabled (Linux x64, 2026-08-15)

Unofficial Linux x86_64 developer build of Chromium with the Cross-Origin Storage API enabled by default — no command-line flags needed.

Not an official Google Chrome release: unsigned, no auto-update, no security review, built from a development branch rather than trunk.

tar -xzf chromium-cos-linux-x64.tar.gz
cd chromium-cos
./chrome

navigator.crossOriginStorage is a secure-context API, so test over https:// or on http://localhost. See README.txt in the archive for a copy-paste smoke test.

Keep the files together. cross_origin_storage_public_hash_list.bin must stay beside the chrome binary — it is the Public Hash List (311,494 digests) that gates whether a '*'-scoped entry may be disclosed to an origin that did not store it. Without it nothing is ever shared cross-origin, because the gate fails closed.

Implemented: the imperative navigator.crossOriginStorage API — all three disclosure scopes, Public Hash List availability gating, GREASE'ing, visibility upgrades, per-origin quota and eviction, rate limiting, and Permissions Policy integration. Available in windows, dedicated workers, shared workers and service workers.

Not implemented: the declarative HTML crossoriginstorage attribute, the CSS cross-origin-storage() modifier, and the JavaScript crossOriginStorage import attribute — each defined in its own host-language specification.

sha256 (archive): 30e9d57fcf1cb2c8df965a196b25d5de29bca8cfbb461e74b7365c31bc90ad5d
Only the en-US locale is bundled.