Unable to run Embedded Project with StackBlitzSDK.embedProject despite crossOriginIsolated headers

[MominRazaexp]

Describe the bug

When embedding a StackBlitz project using StackBlitzSDK.embedProject, the preview fails to render.
The error shown is "Unable to run Embedded Project. Looks like this project is being embedded without proper isolation headers."
I have enabled crossOriginIsolated on the hosting page, but the issue persists.

Link to the blitz that caused the error

https://stackblitz.com/edit/sdk-open-embed-sb-projects-js

Steps to reproduce

1. Open the sandbox: https://stackblitz.com/edit/sdk-open-embed-sb-projects-js
2. Embed the project using StackBlitzSDK.embedProject in a div.
3. Wait for the preview area to load.
4. Observe the error: "Unable to run Embedded Project. Looks like this project is being embedded without proper isolation headers."

Expected behavior

The embedded project preview should render correctly inside the div, without showing the isolation header error.

Parity with Local

• I have run the same project on my local machine and it works as expected. The issue only occurs when embedding the project using the SDK.

Screenshots

Platform

• OS: Windows
• Browser: Chrome
• Version: 144.0.7559.97

Additional context

• The hosting page has headers:
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Embedder-Policy: credentialless
• The issue occurs even with these headers set.
• The error is reproducible with StackBlitz's official demo sandbox.
• Seems related to cross-origin isolation in embedded projects.

[w-a-t-s-o-n]

I also had this issue come up, starting yesterday, on iframe embeds that use the GitHub URL structure. They were working fine on our website for weeks until yesterday.

Example: https://anvil.servicetitan.com/docs/web/components/avatar/code

This is a pretty substantial problem for us, since we have a design system library that uses Stackblitz for every component's example/playground.

We have also tested with different headers (credentialless included), and still see the issue. Nothing in that area had changed yesterday which leads me to believe it could be a Stackblitz issue.

[w-a-t-s-o-n]

I also get this error message when I try to open the iframe URL directly in the browser (Chrome, Version 144.0.7559.98 (Official Build) (arm64)), which doesn't seem right since I'm in Chrome

URL: https://stackblitz.com/github/servicetitan/anvil2-docs-live-code/tree/main/examples/avatar-playground?embed=1&hideNavigation=1&hideExplorer=1&terminalHeight=0&file=src/App.tsx

[dacay]

This is very critical for us as well.

[GzdeGrlr]

We encountered this issue starting around 2 days ago. This is also critical blocker for us.

[anilgulecha]

I'm blocked on this issue as well. Subscribing.

[brrkrmn]

Same issue on our side. Pretty big blocker for us at the moment

[anilgulecha]

BTW, for individuals where you can control the browser (developers who can use a flag, or Google workspace accounts where policies can be enforced), you can get sharedarraybuffer enabled (via flag in browser, or device settings in workspace), and this can temporarily fix the issue for you.

[miguelCT]

Just fyi, this is also affecting all "Tanstack Table "embedded sandboxes in their examples guide: https://tanstack.com/table/latest/docs/framework/react/examples/column-ordering

[SamVerschueren]

Sorry, this was an issue on our end. This should be fixed now.