Cross-Origin Isolation is a security feature that allows web applications to safely use powerful features like SharedArrayBuffer and performance.measureMemory(). To enable cross-origin isolation, we need to ensure that our web application meets certain requirements, including setting specific HTTP headers. All resources (scripts, images, iframes, etc.) must be served with the Cross-Origin-Resource-Policy header or be same-origin. Specifically, the Cross-Origin-Embedder-Policy: require-corp header must be supplied in the response header from the iframe source.

Currently, the iframes loaded by the Google DV360 floodlight activities script do not include the necessary headers, resulting in errors. (See image attached)

However since clients cannot edit Google Tag headers, this is something that Google Tag does not currently support. Is there any solution or workaround?

Haven’t tried anything because I do not know a workaround.