caption: Enable Site Isolation for specified origins on resource-constrained devices
desc: |-
  Specify a list of origins that run in a dedicated process on resource-constrained platforms.

  This policy only works on devices with limited memory (between 1GB and 3.2GB RAM), as isolating too many sites on resource-constrained devices may cause performance problems. For high-performance environments (including high-end <ph name="ANDROID_NAME">Android</ph> devices), please use <ph name="ISOLATE_ORIGINS_POLICY_NAME">IsolateOrigins</ph> instead.

  Devices with less than 1GB memory are not recommended to configure any process isolation specifically.

  Each named origin's process will only be allowed to contain documents from that origin and its subdomains. For example, specifying https://a1.example.com/ allows https://a2.a1.example.com/ in the same process, but not https://example.com or https://b.example.com.

  You can also specify a range of origins to isolate using a wildcard. For example, specifying https://[*.]corp.example.com will give every origin underneath https://corp.example.com its own dedicated process, including https://corp.example.com itself, https://a1.corp.example.com, and https://a2.a1.corp.example.com.

  Note that <ph name="ANDROID_NAME">Android</ph> isolates certain sensitive sites by default starting in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 77, and this policy extends that mode to isolate specific additional origins.

  Note that origins isolated by this policy will be unable to script other origins in the same site, which is otherwise possible if two same-site documents modify their document.domain values to match. Administrators should confirm this uncommon behavior is not used on an origin before isolating it.

  Setting the policy to an empty string or leaving it unset means site isolation won't be required for any specific origins. Users can still turn on process isolation manually, through the command line flag.
example_value: https://a.example.com/,https://othersite.org/,https://[*.]corp.example.com
features:
  dynamic_refresh: false
  per_profile: false
future_on:
- android
- chrome.*
owners:
- alexmos@chromium.org
- creis@chromium.org
- morez@google.com
schema:
  type: string
tags:
- system-security
type: string
