Limited Availability

cross-origin() for url()

The url() CSS function accepts a cross-origin() modifier to control cross-origin resource sharing (CORS) when requesting the URL. For example, url("https://example.com" cross-origin(anonymous))) does not send credentials to the URL.

Baseline Status: This feature is currently Limited (not yet Baseline). Latest engine implementation shipped on Jul 2, 2026.

Desktop Browser Engine Support

Google Chrome

150

Supported

Mozilla Firefox

—

Unsupported

Apple Safari

26.2

Supported

Microsoft Edge

150

Supported

Mobile Browser Engine Support

Chrome Android

150

Firefox Android

—

Safari iOS

26.2

Specifications and References

Specification ↗ Feature XML ↗

MDN Browser Compat Data Keys:

css.types.url.cross-origin ↗