SecurityError: Failed to read the 'localStorage' property Browser Origin: On your device Last updated 15 Oct 2026

Console: SecurityError: Failed to read the 'localStorage' property from 'Window': Access is denied for this document

The page cannot use localStorage because cookies/site data are blocked, it runs in a sandboxed iframe, or the browser is in a restricted mode.

Exact message you may see Failed to read the 'localStorage' property from 'Window'Access is denied for this documentSecurityError: The operation is insecureFailed to read the 'sessionStorage' propertyDOMException: Failed to execute 'getItem' on 'Storage'
Seen on: Chrome Firefox Safari JavaScript

Meaning

Browsers deny web storage when "Block all cookies" is set, for third-party iframes with blocked storage, for sandboxed iframes without allow-same-origin, in some private modes, and for file:// or opaque origins (data: URLs). Wrap storage access in try/catch and fall back to memory.

Common causes

  • "Block third-party cookies" or all site data enabled
  • Embedded in a cross-site iframe (storage partitioned/blocked)
  • Sandboxed iframe lacking allow-same-origin
  • Privacy mode/extension blocking storage
  • Opaque origin (about:blank in a sandbox, data: URL)

⚡ Quick fix

  1. Guard storage access with try/catch and provide a fallback
  2. For iframes add allow-same-origin (only if safe) or use the Storage Access API
  3. Ask users to allow site data for your domain

Detailed fix by platform

JavaScript

  1. function store() { try { localStorage.setItem('k','v'); return localStorage; } catch (e) { return new Map(); } }
  2. document.requestStorageAccess() in third-party iframes after a user gesture

Code examples

Safe storage wrapper

javascript
const safeStorage = (() => {
  try {
    const k = '__t'; localStorage.setItem(k, '1'); localStorage.removeItem(k);
    return localStorage;
  } catch (e) {
    const mem = new Map();
    return { getItem: k => mem.get(k) ?? null, setItem: (k, v) => mem.set(k, String(v)), removeItem: k => mem.delete(k) };
  }
})();

How to diagnose

  1. Context — Top-level page or iframe?
  2. Settings — Cookies/site data blocked?
  3. Sandbox — iframe sandbox attribute?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: On your device. Errors that are often confused with or caused by this one (click to open):

431 — HTTP 431 Request Header Fields Too Large (HTTP)431Aw, Snap! — Chrome: Aw, Snap! Something went wrong while displaying this webpage. Error code: STATUS_ACCESS_VIOLATION / SIGILL / Out of Memory (Browser)Aw, Snap!blocked a frame — SecurityError: Blocked a frame with origin "x" from accessing a cross-origin frame. (JavaScript)blocked a frameQuotaExceededError — QuotaExceededError: Failed to execute 'setItem' on 'Storage': Setting the value exceeded the quota (JavaScript)QuotaExceededErrorSameSite cookie blocked — This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure (Authentication)SameSite cookie block…The canvas has been tainted by cross-origin data — Console: SecurityError: Failed to execute 'toDataURL' / 'getImageData' on 'HTMLCanvasElement': Tainted canvases may not be exported (Browser)The canvas has been t…VersionError — Console: VersionError: The requested version (1) is less than the existing version (2) — IndexedDB open() failed (Browser)VersionErrorSecurityE…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.