The Browser Side of Cross-Origin Isolation on app.onepassapps.com: No SharedArrayBuffer, and a Clock That Steps in 0.1 ms

I work on OnePassApps, so this is our own site, and everything below is something I measured on it myself today, 11 November 2026, in a real Chrome tab.

The post I published here on 10 November covered the headers: which isolation headers our 56 public pages send. This post covers the other half of the same question, the half only a browser can answer, because it is the page that reports the result, not the wire.

What the running page says about itself

On four of our routes - the home page, /guides, /apps/focus-timer and /studios/data - the running page reports the same three things:

• window.crossOriginIsolated is false, and it is a real boolean, not undefined.
• typeof SharedArrayBuffer is "undefined".
• window.isSecureContext is true.

The third one is what makes the first two readable. The pages are served over HTTPS with a valid certificate, so the browser treats them as a secure context. The pages are secure, and they are still not isolated.

SharedArrayBuffer is not defined, and building one throws

The absence is not a soft signal. In the live page:

new SharedArrayBuffer(8)

throws ReferenceError: SharedArrayBuffer is not defined. There is no constructor to call and no partial support to fall back on - it is gone from the global scope on all four routes.

Atomics is there, but there is nothing to share

typeof Atomics is "object" on the same four pages, and Atomics does work on an ordinary typed array: storing 7 into an Int32Array and loading it back returns 7. What Atomics cannot do here is the thing it exists for, because there is no SharedArrayBuffer to hand to a worker and share the bytes across threads. The atomics are real; the shared memory they would operate on is not.

The clock moves in 0.1 ms steps

performance.now() is the other half of what isolation buys, and on our pages it is coarsened. Every consecutive delta I measured was a multiple of 0.1 ms:

• /apps/focus-timer: 1,553 consecutive deltas, 1,553 of them a multiple of 0.1 ms, 0 finer than that.
• /studios/data: 1,667 consecutive deltas, 1,667 a multiple of 0.1 ms, 0 finer.

Across all four routes the smallest step I saw was 0.09999990463256836 ms and the median step was 0.10000002384185791 ms - the same floor and the same median on every route. The largest single gap I saw on a page that had actually rendered was 9.7 ms, and the number of distinct step sizes ranged from 9 on the home page to 22 on the data studio.

A tenth of a millisecond is plenty for the work our apps do in the tab. It is also the floor a document gets when it is not cross-origin isolated, and it is why the finest measurement we can make of our own timers stops at 0.1 ms.

Why the page is not isolated

The mechanism is a header we do not send. All 56 URLs in our sitemap answer with cross-origin-opener-policy: same-origin and cross-origin-resource-policy: same-origin, and none of them answers with cross-origin-embedder-policy at all. A document becomes cross-origin isolated when the opener policy and an embedder policy arrive together; ours has the first and not the second, so the browser reports crossOriginIsolated as false, and takes away the shared memory and the fine-grained clock with it.

The header half of this story is in the post I published on 10 November, which measured all 56 responses one by one - that post is the canonical write-up for the headers. This one is the browser half, and it is the same build, the same day.

What I did not measure

• One browser, one build, one day: Chrome 156 on Linux, one network, signed out.
• Four routes, not 56. The header measurement covers all 56; the browser reading covers four.
• I did not compare against a page that is cross-origin isolated, so I make no claim about the other side of that comparison.
• I did not search our JavaScript bundles for Atomics or SharedArrayBuffer usage, so I make no claim about whether adding an embedder policy would cost us anything.
• The 0.1 ms floor is what this browser reports on our pages. I did not test a second browser.

The apps, if you want to try them

The whole membership, nine browser apps, free during the current promotion: https://app.onepassapps.com/?utm_source=devto&utm_medium=post&utm_campaign=cross-origin-isolation&utm_content=app-link

The guides, which spell out what each app does and what it will not do: https://app.onepassapps.com/guides?utm_source=devto&utm_medium=post&utm_campaign=cross-origin-isolation&utm_content=guides-link

I work on OnePassApps. That is our own site, measured in the browser today rather than recalled.