[Question] 3rd party iframe without a CORP header?

[peiche-jessica]

Just clarifying, does Document-Isolation-Policy: isolated-and-require-corp require a cross-origin iframe to have a CORP header to be loaded?

Exactly like in the app with cross-origin popup case, the app can deploy a Document-Isolation-Policy of isolated-and-credentialless or isolated-and-require-corp on its documents. If the platform can support the isolation, it will get access to COI gated APIs. In any case, there are no particular restrictions on embedding cross-origin iframes.