Cross-Origin-Opener-Policy
Isolates your page's browsing context from cross-origin popups, so they can no longer reach back into your window.
What it does
Normally, when your page opens a popup or is opened by another site, the two windows can share a browsing context group and reference each other via window.opener. Cross-Origin-Opener-Policy (COOP), set to same-origin, severs that link for any cross-origin window.
Why it matters
Without COOP, a malicious page that opens your site in a popup, or that your site opens as a popup, such as an OAuth login flow, can potentially manipulate or read state through the retained window.opener reference. COOP closes that channel, and together with Cross-Origin-Embedder-Policy it enables full cross-origin isolation.
Recommended value
If your application relies on OAuth popups or other cross-origin window messaging, test this carefully: same-origin can break window.postMessage-based integrations that expect a live opener reference. same-origin-allow-popups is a looser middle ground worth considering in that case.