We might be able to do something like this by setting the domain property of the document to something opaque (and, I presume, not allowing it to be further modified by the document).

By "same-origin with each other but cross-origin with the parent page": is the sibling relationship, with a cross-origin parent, relevant to this, or is this something that should be possible with any frame? Should the parent page be able to include a same-origin iframe, but isolate it in this way so that it is effectively treated as cross-origin?

It would be helpful to better understand in what sense folks would like the two pages to act as cross-origin with each other. You note that XHR to the server should still work, for example.

We've done some work in this space for Suborigins (https://w3c.github.io/webappsec-suborigins/) that seems relevant, creating a number of axes along which a page can segregate itself from its origin. Are some/all of those what you're hearing about here? Or is the request more narrow: would blocking DOM access be "enough"?

Here's the use case: top-level page at toppage.com. Subframes at ads.com. The ads contain arbitrary HTML provided by advertisers, so ads.com doesn't trust them. They'd like the two ads.com subframes to only be able to talk to each other via postMessage and the other limited set of methods available if you have a handle on a cross-origin frame so that one ad can't read the contents of another ad.

Does suborigins address that? It seems like it might, but I had trouble wrapping my head around it. Is there an explainer that has examples without all the surrounding specese and TODOs? Also, what's the status of suborigins work?

This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot