COOP

Cross-Origin-Opener-Policy: same-origin severs the window.opener link between your page and any cross-origin page that opened it or that it opens. same-origin-allow-popups keeps references to popups you open, which OAuth and payment flows often need.

It defends against cross-window attacks and XS-Leaks that count frames or probe a window reference, and it is one half of cross-origin isolation: COOP same-origin plus COEP makes crossOriginIsolated true, unlocking SharedArrayBuffer and precise timers.

The usual breakage is login popups and payment widgets that relied on window.opener messaging.