The current spec language for context isolation (https://immersive-web.github.io/webxr/#contextisolation-security) is phrased in terms of "page", for example:
Also, to prevent CORS-related vulnerabilities each page will see a new instance of objects returned by the API, such as XRSession.
it is not obvious how to map this to HTML security policy (https://html.spec.whatwg.org/multipage/webappapis.html#realms-settings-objects-global-objects), which is phrased in terms of "realm"s or "global"s. In particular, the spec should make clear which global is being referred to by "page", does this mean incumbent global?
The current spec language for context isolation (https://immersive-web.github.io/webxr/#contextisolation-security) is phrased in terms of "page", for example:
it is not obvious how to map this to HTML security policy (https://html.spec.whatwg.org/multipage/webappapis.html#realms-settings-objects-global-objects), which is phrased in terms of "realm"s or "global"s. In particular, the spec should make clear which global is being referred to by "page", does this mean incumbent global?