unsafe-none

Allows the document to load cross-origin resources without giving explicit permission through the CORS protocol or the Cross-Origin-Resource-Policy header. This is the default value.

require-corp

A document can only load resources from the same origin, or resources explicitly marked as loadable from another origin.

Cross-origin resource loading will be blocked by COEP unless:

• The resource is requested in no-cors mode and the response includes a Cross-Origin-Resource-Policy header that allows it to be loaded into the document origin.
• The resource is requested in cors mode and the resource supports and is permitted by CORS. This can be done, for example, in HTML using the {mode="cors"}.

credentialless

A document can load cross-origin resources that are requested in Cross-Origin-Resource-Policy header. In this case requests are sent without credentials: cookies are omitted in the request, and ignored in the response.

The cross-origin loading behaviour for other request modes is the same as for require-corp. For example, a cross-origin resource requested in cors mode must support (and be permitted by) CORS.

Certain features, such as access to cross-origin isolated.

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

const myWorker = new Worker("worker.js");

if (crossOriginIsolated) {
  const buffer = new SharedArrayBuffer(16);
  myWorker.postMessage(buffer);
} else {
  const buffer = new ArrayBuffer(16);
  myWorker.postMessage(buffer);
}

If you enable COEP using require-corp and want to embed a cross origin resource that supports CORS, you will need to explicitly specify that it is requested in cors mode.

<img src="/cats-d8c4vu/thirdparty.com/img.png" crossorigin />

• Cross-Origin-Opener-Policy
• WorkerGlobalScope.crossOriginIsolated
• Cross Origin Opener Policy in Why you need "cross-origin isolated" for powerful features on web.dev (2020)
• COOP and COEP explained: Artur Janc, Charlie Reis, Anne van Kesteren (2020)