Relaxing The Same Origin

Two pages from different subdomains could agree to drop their guard and script each other by both setting document.domain.

In 2026: Dead by default. For 27 years, shop.example.com and www.example.com could both set document.domain to example.com and reach into each other's frames. Chrome 115 in 2023 made the setter a silent no-op under origin-keyed agent clustering, so the assignment below runs, changes nothing, and the old cross-subdomain trick is over. postMessage is the sanctioned replacement.

Where it came from: Netscape JavaScript document.domain, 1996. Neutralised by Chrome 115's origin-keyed agent clusters, 2023. MDN ↗

<script language="JavaScript">
var before = document.domain;
// The 1996 handshake: both pages set this to the shared parent domain,
// and the same-origin wall between subdomains came down.
try { document.domain = document.domain.split(".").slice(-2).join("."); }
catch (e) {}
document.write("<p>document.domain before: " + before + "</p>");
document.write("<p>after the assignment:  " + document.domain + "</p>");
document.write("<p>In 2026 the setter is a silent no-op. The wall stays up.</p>");
</script>