A Safari SecurityError from canvas.toBlob() means the canvas is tainted. At least one image, video frame, SVG resource, or other drawn source came from another origin without successful CORS permission. Set crossOrigin before assigning src, configure the asset server to allow your origin, wait for the source to load, and only then draw and call toBlob(). If you cannot change that server, use same-origin hosting or a server-side relay.
This is an origin-protection failure, not a Safari-only image-encoding defect. The same origin-clean rule also blocks getImageData() and toDataURL().
What Safari’s SecurityError actually means
A canvas starts as origin-clean. When you draw pixels fetched from another origin, the browser checks whether that response granted your page access through CORS. If the check fails, the canvas becomes tainted. Once tainted, script cannot read or serialize its pixels because a canvas could otherwise become a cross-origin data-extraction channel.
MDN Web Docs describes the rule this way: as soon as data loaded from another origin is drawn without CORS approval, the canvas is tainted. Safari therefore rejects toBlob() with SecurityError. Chrome may appear to work when its request path, cache, redirect chain, or test asset happens to provide the required headers; that difference does not make the canvas safe in Safari.
Recommended Free Tools
#1 Best Overall
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Only one disallowed source is needed. A canvas can be tainted by an image, a frame from a video, an SVG that references an external image or stylesheet, a CSS background rendered by a library, or another canvas that was already tainted.
Fix checklist
- Create the image or video element and set its CORS mode before setting
src. - Make the final server response include an
Access-Control-Allow-Originvalue that matches the page making the request. - If the request uses cookies or other credentials, use an explicit origin and
Access-Control-Allow-Credentials: true; a wildcard is not valid for credentialed access. - Wait for a successful
loadevent before drawing. - Inspect every resource that reaches the canvas, including redirects and nested SVG resources.
- If the remote owner cannot provide CORS, move the asset to your origin or fetch it through a relay you control.
Load the image in the correct order
The order of two lines matters. Assigning src can start the network request immediately; changing crossOrigin afterward is too late. The following is a complete minimal pattern for a non-credentialed public image:
const image = new Image();
image.crossOrigin = 'anonymous';
image.onload = () => {
const canvas = document.querySelector('canvas');
const ctx = canvas.getContext('2d');
canvas.width = image.naturalWidth;
canvas.height = image.naturalHeight;
ctx.drawImage(image, 0, 0);
canvas.toBlob((blob) => {
if (!blob) {
throw new Error('Image encoding failed');
}
// Upload or download blob here.
}, 'image/png');
};
image.onerror = () => {
console.error('Image failed CORS or network checks');
};
image.src = 'https://cdn.example/image.jpg';Replace the example URL with the real asset. Keep the crossOrigin assignment before src, and do not call drawImage from code that can run before load. For a video, wait until the media element has loaded enough data for the frame you intend to draw and set its CORS mode before assigning its source.
Send the right CORS headers from the asset server
Public, non-credentialed assets
For a genuinely public image that does not need cookies or HTTP authentication, the response can use:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- BUILT FOR COLLEGE. AND BEYOND — MacBook Air with the M5 chip packs blazing speed and powerful AI capabilities into an incredibly portable design. And with up to 18 hours of battery life,* this thin and light powerhouse is ready to take on almost any major, just about anywhere.
- TEAR THROUGH TOUGH ASSIGNMENTS — With its faster CPU and unified memory, the M5 chip delivers even more performance and fluidity across apps, making multitasking and creative workflows smooth and responsive. A powerful Neural Engine and next-generation GPU with Neural Accelerators give you a powerful platform for AI.
- MAKE QUICK WORK OF YOUR TO-DO LIST — Apple Intelligence helps you write, express yourself, and get things done effortlessly — whether it’s for school or everyday life. With groundbreaking privacy protections, it gives you peace of mind that no one else can access your data — not even Apple.*
- UP TO 18 HOURS OF BATTERY LIFE — MacBook Air delivers incredible battery life with amazing performance, so you can power through a full day of classes without worrying about plugging in.
- A BRILLIANT 13.6-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Air supports 1 billion colors, making photos and videos pop with rich contrast and sharp detail, and text appears supercrisp. So everything — from class presentations to movies to games — looks truly stunning.
Access-Control-Allow-Origin: *A tighter policy is usually preferable when you know the application origin:
Access-Control-Allow-Origin: https://your-site.exampleThe header must be on the response that actually delivered the bytes. If the request follows a redirect, inspect the final response, not only the first URL. A CDN, image optimizer, or object-storage layer can remove headers even when the application server sends them.
Credentialed requests
If the browser sends cookies or other credentials, return the exact requesting origin and explicitly allow credentials:
Access-Control-Allow-Origin: https://your-site.example
Access-Control-Allow-Credentials: trueDo not combine Access-Control-Allow-Credentials: true with Access-Control-Allow-Origin: *; browsers reject that combination. If the response varies by requesting origin, also send:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Vary: OriginWithout Vary: Origin, an intermediary cache can serve a response generated for one origin to another origin with the wrong CORS policy.
Draw only after a successful load
Attach both success and failure handlers before starting the request. A failed CORS check is exposed to page script as a generic load error; Safari’s Web Inspector contains the useful detail. Never treat the presence of an HTMLImageElement as proof that its pixels are readable. The request must complete with a permitted CORS response, and the draw must occur afterward.
If you compose several layers, audit every layer. One clean background does not make a dirty foreground safe. The same applies when a library draws an SVG or CSS background on your behalf: inspect the resources referenced inside that content, not just the top-level URL.
Use Safari Web Inspector to find the offending response
- Open the page in Safari, choose Develop > Show Web Inspector, and select the Console tab. Reproduce the error and read the CORS message; JavaScript normally receives only a generic failure.
- Open the Network tab, reload the page, and filter for the image, video, SVG, or font-like resource involved in rendering.
- Inspect the response headers for
Access-Control-Allow-Origin,Access-Control-Allow-Credentials, and, where relevant,Vary: Origin. - Follow redirects and inspect the final response. A permitted header on an intermediate redirect does not authorize the final bytes.
- Repeat the check for every source drawn into the canvas, including nested SVG references and resources loaded by a rendering library.
Test from an HTTP(S) development origin rather than opening the page as file://. A file:// page, a sandboxed iframe, or another opaque origin can produce confusing CORS behavior that does not match production.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #4
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Choose the fix that fits your architecture
| Situation | Recommended fix | Important detail |
|---|---|---|
| You control the image server | Enable CORS and use crossOrigin = 'anonymous' before src |
Verify the final response and cache behavior |
| The image is public and has no credentials | Allow your origin, or use * for a truly public asset |
Do not use a wildcard for credentialed requests |
| The request needs cookies or authentication | Return the exact origin plus Access-Control-Allow-Credentials: true |
Add Vary: Origin when responses differ by origin |
| You cannot change the remote server | Host a permitted copy on your origin or use a server-side relay | The relay must fetch the asset and emit CORS headers you control |
| You are considering a browser extension or disabled security | Do not use it as a production solution | It changes the test environment, not the deployed security model |
Server-side relay pattern
A relay is appropriate when licensing and privacy rules allow you to retrieve the asset on the server. Your browser requests the relay from the same origin as the application; the relay fetches the remote file, validates the response, and returns it with a controlled content type and CORS policy. Keep the relay restricted to approved hosts, impose size and timeout limits, and avoid turning it into an open proxy. If the remote service requires credentials, keep those credentials on the server rather than exposing them to browser JavaScript.
Alternatively, copy the asset into storage served from your own origin and version it there. This is often simpler for logos, product images, and other stable files. Whichever architecture you choose, the browser still needs to receive a response that is valid for the origin of the page doing the draw.
Understand toBlob() behavior separately from CORS
toBlob() is asynchronous: it supplies a Blob to its callback rather than returning one directly. Check for a null blob and handle encoding failures in your callback. A requested MIME type such as image/webp may not be supported by the user agent; in that case the browser falls back to image/png. That MIME fallback is different from a SecurityError: a fallback indicates an encoding choice, while SecurityError indicates that the bitmap is not origin-clean.
The same taint check applies if you switch to canvas.toDataURL() or ctx.getImageData(); changing the serialization API does not bypass the protection. If a canvas has already been tainted, drawing a clean image on top will not make its existing pixels readable. Start with a new canvas and redraw only sources that have passed CORS.
Best Value
- FAST RUNS IN THE FAMILY — The 16-inch MacBook Pro with the M5 Pro or M5 Max chip brings next-generation speed and powerful on-device AI to personal, professional, and creative tasks. With all-day battery life, double the starting storage,* and a breathtaking Liquid Retina XDR display, it’s pro in every way.*
- BUCKLE UP — Along with a next-generation CPU, faster unified memory, and up to 2x faster SSD storage,* M5 Pro and M5 Max feature a more powerful GPU with a Neural Accelerator built into each core, delivering faster AI performance and on-device training capabilities. So you can blaze through demanding workloads at mind-bending speeds.
- BUILT FOR AI — Apple silicon, and every major component that powers it, is designed to run demanding on-device AI workloads like LLM inference and training. And Apple Intelligence helps you write, express yourself, and get things done effortlessly with groundbreaking privacy protections at every step.*
- ALL-DAY BATTERY LIFE — MacBook Pro delivers the same exceptional performance whether it’s running on battery or plugged in.*
- MACOS RUNS APPS FAST — All your go-to apps run lightning fast in macOS, including built-in apps like FaceTime and Messages. Plus, built-in virus protection and free software updates help keep your Mac running smoothly and securely.
Common errors and precise fixes
| Symptom | Likely cause | Fix |
|---|---|---|
SecurityError appears only at toBlob() |
A source was drawn without CORS approval | Set crossOrigin before src, enable server CORS, then redraw on a fresh canvas |
| Chrome succeeds but Safari fails | The browsers received different responses, or Safari exposed a stricter redirect/cache path | Compare the final response headers in Web Inspector; do not infer permission from another browser |
Changing crossOrigin has no effect |
It was assigned after src, so the request already started |
Create a new element, set the property first, then assign src |
| Console says CORS failed but the image is visible | Displaying pixels is allowed even when reading or serializing them is not | Fix the response headers; visual display alone does not make the canvas origin-clean |
| Credentialed request is rejected | Wildcard origin or missing credentials header | Use the exact origin and Access-Control-Allow-Credentials: true |
| Headers look correct on the source URL | A redirect, CDN, or cache changed the final response | Inspect the final network response and add Vary: Origin when needed |
| Error appears after drawing an SVG or library-generated background | A nested resource is cross-origin and lacks CORS | Audit every referenced image, stylesheet, and other drawn source |
| Local test behaves unpredictably | file://, sandboxed iframe, or opaque origin |
Serve the test page from an HTTP(S) origin that matches the allowlist |
| Callback receives no usable blob | Encoding failed, or the requested MIME type is unsupported | Check for null, try a supported type such as image/png, and distinguish this from CORS errors |
Performance and reliability considerations
Set the canvas dimensions before drawing so the bitmap is allocated at the intended size; changing width or height later clears the canvas. Avoid drawing a source until it has loaded, because retrying a failed request in a tight loop can create unnecessary traffic without fixing headers. For large images, budget memory for the decoded bitmap and the encoded blob, and release object URLs after downloads or previews are complete.
Cache configuration matters. If a CDN caches a response for one origin and reuses it for another, the browser can report an apparently random CORS failure. Make origin variance explicit with Vary: Origin, purge incorrect cached objects, and test a cold request as well as a cached request. Redirects should terminate at a resource whose CORS policy is intentional, not merely inherited from an earlier URL.
Or skip the browser setup
If your actual goal is a clean screenshot of a web page rather than reading pixels from your own canvas, ScreenshotNeo provides a server-side alternative. It is a website screenshot API and MCP server, not a replacement for a canvas that your application must manipulate. The request below captures a page without requiring you to configure a browser’s image CORS path. Full parameter documentation is at ScreenshotNeo’s API docs.
curl -G 'https://api.screenshotneo.com/v1/shot'
-d access_key=YOUR_API_KEY
--data-urlencode url=https://stripe.com
-o shot.webpimport requests
r = requests.get('https://api.screenshotneo.com/v1/shot', params={'access_key': 'YOUR_API_KEY', 'url': 'https://stripe.com'}, timeout=90)
r.raise_for_status()
open('shot.webp', 'wb').write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
if (!res.ok) throw new Error(`Screenshot failed: ${res.status}`);
const bytes = new Uint8Array(await res.arrayBuffer());Before capture, ScreenshotNeo can accept cookie and consent banners and remove more than 60 known consent platforms, newsletter popups, and chat widgets; each cleanup step can be disabled. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed as clean shots, and response headers identify the page verdict and billing status. Its MCP server exposes take_screenshot, get_page_info, and capture_pdf for Claude, Cursor, and other MCP clients.
Free tools Windows power users keep installed
One-click scans. No signup required.
Every plan includes the full feature set, including full-page captures with lazy images loaded, CSS-selector element shots, dark mode, device presets and custom viewports, retina scale, PDF controls, custom CSS and JavaScript, click-before-capture actions, selector hiding, waits, request and resource blocking, custom headers and cookies, user-agent, authorization, timezone and geolocation, transparent backgrounds, resizing, chosen cache TTLs, signed links, asynchronous jobs with signed webhooks, bulk capture for up to 100 URLs per call, a usage API, and an OpenAPI specification. Parameter names used by other screenshot APIs are accepted to ease migration.
There are 1,000 free shots each month with no card. Paid plans start at $5 for 3,000 shots; yearly billing gives two months free. When you want to avoid browser CORS setup for page captures, create a free ScreenshotNeo account.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
