What does COEP do that CSP doesn't already do?

Question

Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). Why is COEP necessary when we already had CSP?

Answer 1

CSP lets a document restrict, from where resources are included on the page and what they can do. The loaded external resources themselves have no control if and how they are used.

COEP instead let a document define, that only resources can be loaded which have explicitly granted permissions to be used, using CORP or CORS. It thus puts more control into these external resources.

COEP needs to be understood in the context of side channel attacks like Spectre or Meltdown, which made cross-origin information leaks possible as long as both origins were used in the same browser context (same browser process). Using COEP adds more isolation by using different browsing contexts (different processes which have isolated memory from each other). Thus some features like SharedArrayBuffer which might be used to exploit side channel leaks can only be used if COEP is active.

See also What is the difference between Cross Origin Opener Policy and SOP? for a related header.