What Cross-Origin-Opener-Policy does
Cross-Origin-Opener-Policy, or COOP, controls whether your page shares a browsing context group with the windows it opens and the windows that open it. A browsing context group is a set of tabs, popups, and frames that can hold live references to each other through properties like window.opener. When pages from different origins sit in the same group, one can reach into the other and probe or manipulate it. COOP lets you break that link by placing your page in a group of its own.
Setting Cross-Origin-Opener-Policy to same-origin tells the browser to give your page a fresh browsing context group whenever the document on the other side does not match your origin. Other origins that open your page lose their window reference, and a page you open in a popup is severed too unless it shares your origin. That isolation shuts down cross window attacks. Tabnabbing, where a page you opened silently rewrites your original tab through window.opener, stops working. It also removes a path that Spectre style side channel attacks use to read memory across origins inside a shared process.
COOP and cross origin isolation
COOP is also one half of cross origin isolation, the state a page needs before the browser will hand it powerful features such as SharedArrayBuffer and high precision timers. A page becomes cross origin isolated only when it sends Cross-Origin-Opener-Policy: same-origin together with Cross-Origin-Embedder-Policy: require-corp. Send COOP on your top level HTML responses, and if popups or OAuth flows break, try same-origin-allow-popups, which keeps the protection while letting your own popups stay connected. When you are ready to confirm both headers line up, the cross-origin isolation checker tells you whether your page qualifies.