The Cross-Origin Rendering Architecture
Historically, web browsers rendered an entire web page—including any embedded widgets or advertisements inside `<iframe>` tags—within a single operating system process. This meant if a poorly coded iframe crashed, it could take the whole tab down with it. To combat this and improve security against attacks like Spectre, Google Chrome introduced “Site Isolation.” A key component of this architecture is the “Out-of-Process Iframes” (OOPIF) system. When enabled, Chrome attempts to render cross-origin iframes (like a YouTube video embedded on a news site) in their own, completely separate, sandboxed memory processes.
While OOPIFs dramatically improve security by preventing malicious embedded content from reading the memory of the parent website, they come with a significant cost: RAM. Spawning a new, dedicated OS process for every single cross-origin iframe on a heavy, ad-laden website can rapidly consume all available memory on lower-end hardware, causing the browser to stutter or freeze. The “Allow out of process iframes” flag gave developers and power users the ability to test disabling this architecture, forcing the browser to render iframes back inside the parent process to save RAM.
How to Turn Off Out-of-Process Iframes
You can attempt to disable this specific process isolation feature via the experimental flags menu.
- Open Google Chrome.
- Click inside the main address bar at the top.
- Type
chrome://flagsand press Enter. - On the “Experiments” page, use the search bar to look for Allow out of process iframes.
- If the flag is available, click the dropdown menu next to it and change it from “Default” to Disabled.
- Click the blue Relaunch button at the bottom of the screen.
Note: Because Site Isolation is now considered a fundamental security requirement for Chromium, Google has aggressively removed the ability to disable OOPIFs via flags in modern stable builds. If you cannot find the flag, the behavior is hardcoded into the browser.