Serializing and transferring non-origin-clean ImageBitmap are now disallowed


Categories: DOM

Releases: Firefox 74, Firefox 78 ESR


An ImageBitmap could contain data from a cross-origin image that is not verified by the Cross-Origin Resource Sharing (CORS) mechanism. Starting with Firefox 74 and Chrome 80, for security reasons, such an ImageBitmap can no longer be serialized or transferred. Since this is a rarely used feature, according to a developer, the compatibility risk should be minimum.