cookiestatus.com

Other browser storage in third-party context

Can embedded content use localStorage, IndexedDB and similar storage?

last_modified: suggest_edit

Cookies aren’t the only way to store an identifier. Embedded content can also use localStorage, sessionStorage, IndexedDB, the Cache API, service workers and more. If any of these were shared across sites, a third party could use them in place of cookies.

All five browsers now partition this storage by top-level site by default: an iframe from b.example on a.example gets different storage from the same iframe on c.example. Some browsers also block it entirely for known trackers, or clear it when the user leaves the site.

By browser

Brave

Partitioned
  • Partitioned access in frame.
  • Partitioned storage is cleared shortly after the user leaves the site (closes all its tabs), or when the browser is closed.
Sources (2) · 2026-10-31

Chrome

Partitioned
  • Chrome partitions third-party storage.
  • The HTTP cache is partitioned by top-level site, so cached files can’t be used to track across sites. Chrome 86+ New
Sources (2) · 2026-10-31

Edge

Partitioned
  • Access blocked for known trackers, with the same mitigations as cookies.
  • Storage of other domains is partitioned. New
Sources (2) · 2026-10-30

Firefox

Partitioned
  • localStorage and IndexedDB restricted for known trackers.
  • sessionStorage is not restricted.
  • Storage is partitioned between the site and the third-party. Storage is not shared across sites.
  • Network state, including the HTTP cache, is partitioned by top-level site. Firefox 85+ New
Sources (2) · 2026-10-31

Safari

Partitioned
  • localStorage is partitioned and reset between application launches.
  • IndexedDB is partitioned and cleared when Safari quits. New
  • sessionStorage is partitioned.
  • The HTTP cache for third-party content is partitioned by top-level site. New
Sources (2) · 2026-10-30

History

  1. ChromeEdge

    Chromium partitions third-party storage

    From Chrome 115, storage, service workers and communication APIs in third-party frames are partitioned by top-level site, rolled out gradually. Edge has the same behavior.

    affects: 3rd-party storage · source: Storage partitioning deprecation trial (Chrome for Developers)

  2. Brave

    Brave announces ephemeral third-party storage announced

    Instead of blocking storage in third-party frames, Brave gives each one a temporary partition that is cleared when the user leaves the site. It was turned on by default later in 2021.

    affects: 3rd-party cookies, 3rd-party storage · source: Ephemeral third-party site storage (Brave privacy updates)

  3. Firefox

    Firefox 85 partitions network state

    The HTTP cache and other network state are kept separate for each top-level site, so “supercookies” stored there can’t track users across sites.

    affects: 3rd-party storage · source: Firefox 85 release notes

  4. ChromeEdge

    Chrome 86 partitions the HTTP cache

    Cached files are stored separately for each top-level site, so a third party can’t use the cache to recognize the same browser on different sites.

    affects: 3rd-party storage · source: Gaining security and privacy by partitioning the cache (Chrome for Developers)

All changes →