What cross-origin isolation means
Cross-origin isolation is a browser state that places a document in its own process and walls it off from other origins unless they explicitly opt in. When a page is isolated the browser unlocks features that were switched off across the web after the Spectre attacks, including SharedArrayBuffer and high resolution timers. Without isolation those features stay disabled, because a shared memory buffer paired with a precise clock is exactly what a Spectre style side channel needs to read memory it should never see.
Spectre made this necessary. The vulnerability let code measure tiny timing differences to infer data from other contexts in the same process, so browsers removed the precise timing primitives from ordinary pages. To earn them back a page has to prove it is sealed off from cross-origin content, and that proof is the exact combination of two response headers this checker tests.
The exact COOP and COEP combination
A page becomes isolated when it returns Cross-Origin-Opener-Policy set to same-origin and Cross-Origin-Embedder-Policy set to require-corp, or the newer credentialless value. COOP cuts the link to any window that opened the page or that the page opened, so other documents cannot reach into it. COEP forces every subresource to opt in, either with its own Cross-Origin-Resource-Policy header or through a successful CORS check. Either header on its own does nothing for isolation. The browser only flips the switch when both arrive together.
How to verify crossOriginIsolated
You can confirm the result yourself in seconds. Load the page, open the developer console, and type crossOriginIsolated. A value of true means the page is isolated and the gated features are available, while false means a header is missing or a subresource is blocking the state. For the full background on each header, the trade offs, and how to roll isolation out without breaking embedded content, read the cross-origin isolation guide.