Briefing

Cross‑Origin Storage API in Transformers.js: Reducing Duplicate Downloads

security

Enable Cross‑Origin Storage in your Transformers.js app to share the 4.7 MB WASM runtime across origins and cut duplicate downloads.

What to do now

Install the COS polyfill extension, request the ort‑wasm‑simd‑threaded.asyncify.wasm file by its SHA‑256 hash, and store it with origins: '*'.

Summary

On June 23 2026, Thomas Steiner from Google’s Chrome team explained how Transformers.js’ default caching mechanism duplicates model and WASM resources across origins, leading to 177 MB of redundant downloads when the same Whisper‑tiny.en or distilbert‑base‑uncased‑finetuned‑sst‑2‑english models are loaded from different sites. The issue arises because browsers isolate Cache API entries by Network Isolation Key, which includes the top‑level site and current‑frame site, preventing cache hits even when the resource URL is identical. Transformers.js automatically downloads and caches the ort‑wasm‑simd‑threaded.asyncify.wasm runtime from jsDelivr, causing further duplication. The Cross‑Origin Storage (COS) proposal introduces navigator.crossOriginStorage, allowing web apps to store large files by cryptographic hash rather than URL, enabling shared WASM and model binaries across origins. COS supports a create flag and origins option to control visibility, and can be used to cache the 4.7 MB WASM runtime and model files for future reuse. The article demonstrates a code snippet that requests a file handle by hash, reads it if present, or fetches and writes it to COS if missing. COS is an early‑stage proposal; a browser extension can inject the polyfill for testing. COS can reduce bandwidth and storage for AI‑heavy web apps by sharing model binaries across origins. The article also notes that COS is modeled after the File System Standard’s FileSystemDirectoryHandle, providing a familiar API for developers.

Key changes

  • Transformers.js caching duplicates model and WASM resources across origins, causing 177 MB redundant downloads.
  • Browser Cache isolation uses Network Isolation Key (top‑level site + current‑frame site), preventing cache hits for identical URLs.
  • ort‑wasm‑simd‑threaded.asyncify.wasm runtime is 4.7 MB and is downloaded per origin.
  • Cross‑Origin Storage (COS) proposal introduces navigator.crossOriginStorage for hash‑based shared storage.
  • COS supports create flag and origins option to control visibility across sites.
  • Example code shows requesting a file handle by SHA‑256 hash, reading if present, otherwise fetching and storing.
  • COS is an early‑stage proposal; a browser extension can inject the polyfill for testing.
  • COS can reduce bandwidth and storage for AI‑heavy web apps by sharing model binaries across origins.

Affects

none

Customer impact

Analyzing matches…

Ask about this story

Impact on an agency? Which customers? Compare historically Risks of waiting