WPT
wpt / preload / subresource-integrity.html
Spec: https://w3c.github.io/preload/ ↗
Runs: Chrome 155.0.8039.0 (wpt@6ec9fd59f, 2026-09-03) | Firefox 157.0a1 (wpt@6ec9fd59f, 2026-09-03) | Safari 251 preview (wpt@5ce815a83, 2026-08-27) | Ladybird 1.0-795e1 (wpt@7e3d005d7, 2026-09-03) | Servo Servo 0.6 (wpt@09159dcb3, 2026-09-02) | Blitz 188486089 (wpt@a95401e4e, 2026-09-02)
View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi
| Chrome | Firefox | Safari | Ladybird | Servo | Blitz | |
|---|---|---|---|---|---|---|
| Total | 71/77 | 56/77 | 40/77 | 42/77 | 67/77 | NOT RUN |
| Subtest | Chrome | Firefox | Safari | Ladybird | Servo | Blitz |
|---|---|---|---|---|---|---|
| Same-origin script with correct sha256 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with correct sha384 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with correct sha512 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with empty integrity. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with incorrect hash. | PASS | FAIL | FAIL | PASS | PASS | — |
| Same-origin script with multiple sha256 hashes, including correct. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with multiple sha256 hashes, including unknown algorithm. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with sha256 mismatch, sha512 match | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with sha256 match, sha512 mismatch | PASS | FAIL | FAIL | PASS | PASS | — |
| <crossorigin='anonymous'> script with correct hash, ACAO: * | PASS | PASS | PASS | PASS | PASS | — |
| <crossorigin='anonymous'> script with incorrect hash, ACAO: * | PASS | FAIL | FAIL | PASS | PASS | — |
| <crossorigin='use-credentials'> script with correct hash, CORS-eligible | PASS | PASS | PASS | PASS | PASS | — |
| <crossorigin='use-credentials'> script with incorrect hash CORS-eligible | PASS | FAIL | FAIL | PASS | PASS | — |
| <crossorigin='anonymous'> script with CORS-ineligible resource | PASS | FAIL | FAIL | PASS | PASS | — |
| Cross-origin script, not CORS request, with correct hash | PASS | FAIL | FAIL | PASS | PASS | — |
| Cross-origin script, not CORS request, with hash mismatch | PASS | FAIL | FAIL | PASS | PASS | — |
| Cross-origin script, empty integrity | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with correct hash, options. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with unknown algorithm only. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with matching digest re-uses preload with matching digest. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with matching digest re-uses preload with matching digest and options. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin script with non-matching digest does not re-use preload with matching digest. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin script with matching digest does not re-use preload with non-matching digest. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin script with non-matching digest does not re-use preload with non-matching digest. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin script with matching digest does not reuse preload without digest. | PASS | PASS | FAIL | FAIL | PASS | — |
| Same-origin script with matching digest does not reuse preload with matching but stronger digest. | PASS | PASS | FAIL | FAIL | PASS | — |
| Same-origin script with wrong digest does not reuse preload with correct and stronger digest. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin script with matching digest does not reuse preload with matching but weaker digest. | PASS | PASS | FAIL | FAIL | PASS | — |
| Same-origin script with non-matching digest reuses preload with no digest but fails. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin style with correct sha256 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with correct sha384 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with correct sha512 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with empty integrity. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with incorrect hash. | PASS | FAIL | FAIL | PASS | PASS | — |
| Same-origin style with multiple sha256 hashes, including correct. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with multiple sha256 hashes, including unknown algorithm. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with sha256 mismatch, sha512 match | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with sha256 match, sha512 mismatch | PASS | FAIL | FAIL | PASS | PASS | — |
| <crossorigin='anonymous'> style with correct hash, ACAO: * | PASS | PASS | PASS | PASS | PASS | — |
| <crossorigin='anonymous'> style with incorrect hash, ACAO: * | PASS | FAIL | FAIL | PASS | PASS | — |
| <crossorigin='use-credentials'> style with correct hash, CORS-eligible | PASS | PASS | PASS | PASS | PASS | — |
| <crossorigin='use-credentials'> style with incorrect hash CORS-eligible | PASS | FAIL | FAIL | PASS | PASS | — |
| <crossorigin='anonymous'> style with CORS-ineligible resource | PASS | FAIL | FAIL | PASS | PASS | — |
| Cross-origin style, not CORS request, with correct hash | PASS | FAIL | FAIL | PASS | PASS | — |
| Cross-origin style, not CORS request, with hash mismatch | PASS | FAIL | FAIL | PASS | PASS | — |
| Cross-origin style, empty integrity | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with correct hash, options. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with unknown algorithm only. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with matching digest re-uses preload with matching digest. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with matching digest re-uses preload with matching digest and options. | PASS | PASS | PASS | PASS | PASS | — |
| Same-origin style with non-matching digest does not re-use preload with matching digest. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin style with matching digest does not re-use preload with non-matching digest. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin style with non-matching digest does not re-use preload with non-matching digest. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin style with matching digest does not reuse preload without digest. | PASS | PASS | FAIL | FAIL | PASS | — |
| Same-origin style with matching digest does not reuse preload with matching but stronger digest. | PASS | PASS | FAIL | FAIL | PASS | — |
| Same-origin style with wrong digest does not reuse preload with correct and stronger digest. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin style with matching digest does not reuse preload with matching but weaker digest. | PASS | PASS | FAIL | FAIL | PASS | — |
| Same-origin style with non-matching digest reuses preload with no digest but fails. | PASS | PASS | FAIL | FAIL | FAIL | — |
| Same-origin image with correct sha256 hash. | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with correct sha384 hash. | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with correct sha512 hash. | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with empty integrity. | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with incorrect hash. | FAIL | FAIL | FAIL | FAIL | PASS | — |
| Same-origin image with multiple sha256 hashes, including correct. | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with multiple sha256 hashes, including unknown algorithm. | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with sha256 mismatch, sha512 match | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with sha256 match, sha512 mismatch | FAIL | FAIL | FAIL | FAIL | PASS | — |
| <crossorigin='anonymous'> image with correct hash, ACAO: * | PASS | PASS | PASS | FAIL | PASS | — |
| <crossorigin='anonymous'> image with incorrect hash, ACAO: * | FAIL | FAIL | FAIL | FAIL | PASS | — |
| <crossorigin='use-credentials'> image with correct hash, CORS-eligible | PASS | PASS | PASS | FAIL | PASS | — |
| <crossorigin='use-credentials'> image with incorrect hash CORS-eligible | FAIL | FAIL | FAIL | FAIL | PASS | — |
| <crossorigin='anonymous'> image with CORS-ineligible resource | PASS | FAIL | FAIL | FAIL | PASS | — |
| Cross-origin image, not CORS request, with correct hash | FAIL | FAIL | FAIL | FAIL | PASS | — |
| Cross-origin image, not CORS request, with hash mismatch | FAIL | FAIL | FAIL | FAIL | PASS | — |
| Cross-origin image, empty integrity | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with correct hash, options. | PASS | PASS | PASS | FAIL | PASS | — |
| Same-origin image with unknown algorithm only. | PASS | PASS | PASS | FAIL | PASS | — |