securityspectresharedarraybuffer

`Uncaught ReferenceError: SharedArrayBuffer is not defined` since Chrome 92


The usage of SharedArrayBuffer causes an error: Uncaught ReferenceError: SharedArrayBuffer is not defined on Chrome 92. Why is this? How can I solve?


Solution

  • SharedArrayBuffer on Chrome desktop has been available for free until Chrome 91, but after 92, it requires a special state called "cross-origin isolation" aligned with Firefox and Android Chrome. To enable the state, you must send two security headers Cross-Origin-Embedder-Policy: require-corp and Cross-Origin-Opener-Policy: same-origin.

    The discovery of Spectre caused all browsers to disable SharedArrayBuffer but Chrome desktop could enable it again using the proprietary Site Isolation. Chrome 92 is the version it shifted to the standardized approach.

    As mentioned above, applying the two headers and enable "cross-origin isolation" is the way to go, but it may take you a while to set it up. As an escape-hatch, you can request an origin trial to allowlist your site to continue using SharedArrayBuffer without cross-origin isolation at least until Chrome 96.

    To learn more about cross-origin isolation, read: