From 984d0fbdcfe89bb11b1faebfff792dadcca147ec Mon Sep 17 00:00:00 2001
From: adamsilverstein <adamsilverstein@earthboundhosting.com>
Date: Tue, 8 Sep 2026 09:22:18 -0700
Subject: [PATCH] Media: Stop injecting crossorigin attributes under
 Document-Isolation-Policy.

`isolate-and-credentialless` loads cross-origin subresources without
credentials instead of blocking them, so scripts, styles, images, audio,
and video from other origins work without a `crossorigin` attribute.
Forcing `crossorigin="anonymous"` turns each load into a CORS request,
which fails for any host that does not send `Access-Control-Allow-Origin`,
such as media offloaded to a CDN.

The injection dates from the `require-corp` era of the Gutenberg
experiment, where it was needed for anything cross-origin to load. It was
carried over unchanged when the editor switched to DIP, and has since
caused two regressions (IMG previews, #65673) and a white screen from the
tag processor running inside an output buffer display handler (#65930).

Send the header directly, deprecate the output buffer helper and the
attribute injector, and drop the matching injection from the media
templates.

Props khokansardar, b0b3k, ianmjones, westonruter, andrewserong.
Fixes #65930. See #65673, #64766.
---
 src/wp-includes/deprecated.php                |  38 +++
 src/wp-includes/media-template.php            |  50 ----
 src/wp-includes/media.php                     | 116 ++------
 .../tests/media/wpCrossOriginIsolation.php    | 268 ++++--------------
 4 files changed, 111 insertions(+), 361 deletions(-)

diff --git a/src/wp-includes/deprecated.php b/src/wp-includes/deprecated.php
index 3b78d1610fdad..e27733a04efab 100644
--- a/src/wp-includes/deprecated.php
+++ b/src/wp-includes/deprecated.php
@@ -6532,3 +6532,41 @@ function wp_sanitize_script_attributes( $attributes ) {
 	}
 	return $attributes_string;
 }
+
+/**
+ * Starts an output buffer that sends the Document-Isolation-Policy header
+ * and adds crossorigin="anonymous" to cross-origin resources.
+ *
+ * The attribute injection was dropped because `isolate-and-credentialless`
+ * loads cross-origin resources without it, and forcing CORS mode broke
+ * resources served without `Access-Control-Allow-Origin`. Only the header
+ * is sent now.
+ *
+ * @since 7.1.0
+ * @deprecated 7.2.0 Use wp_send_document_isolation_policy_header() instead.
+ * @see wp_send_document_isolation_policy_header()
+ */
+function wp_start_cross_origin_isolation_output_buffer(): void {
+	_deprecated_function( __FUNCTION__, '7.2.0', 'wp_send_document_isolation_policy_header()' );
+
+	wp_send_document_isolation_policy_header();
+}
+
+/**
+ * Adds crossorigin="anonymous" to relevant tags in the given HTML string.
+ *
+ * No longer modifies the HTML. Under `Document-Isolation-Policy:
+ * isolate-and-credentialless` cross-origin resources load without the
+ * attribute, and adding it broke resources served without CORS headers.
+ *
+ * @since 7.1.0
+ * @deprecated 7.2.0
+ *
+ * @param string $html HTML input.
+ * @return string The unmodified HTML.
+ */
+function wp_add_crossorigin_attributes( string $html ): string {
+	_deprecated_function( __FUNCTION__, '7.2.0' );
+
+	return $html;
+}
diff --git a/src/wp-includes/media-template.php b/src/wp-includes/media-template.php
index 460cf3b3020e5..49332d326c5ce 100644
--- a/src/wp-includes/media-template.php
+++ b/src/wp-includes/media-template.php
@@ -156,12 +156,6 @@ class="wp-video-shortcode {{ classes.join( ' ' ) }}"
 function wp_print_media_templates() {
 	$class = 'media-modal wp-core-ui';
 
-	$is_cross_origin_isolation_enabled = wp_is_client_side_media_processing_enabled();
-
-	if ( $is_cross_origin_isolation_enabled ) {
-		ob_start();
-	}
-
 	$alt_text_description = sprintf(
 		/* translators: 1: Link to tutorial, 2: Additional link attributes, 3: Accessibility text. */
 		__( '<a href="%1$s" %2$s>Learn how to describe the purpose of the image%3$s</a>. Leave empty if the image is purely decorative.' ),
@@ -1596,48 +1590,4 @@ function wp_print_media_templates() {
 	 * @since 3.5.0
 	 */
 	do_action( 'print_media_templates' );
-
-	if ( $is_cross_origin_isolation_enabled ) {
-		$html = (string) ob_get_clean();
-
-		/*
-		 * The media templates are inside <script type="text/html"> tags,
-		 * whose content is treated as raw text by the HTML Tag Processor.
-		 * Extract each script block's content, process it separately,
-		 * then reassemble the full output.
-		 */
-		$script_processor = new WP_HTML_Tag_Processor( $html );
-		while ( $script_processor->next_tag( 'SCRIPT' ) ) {
-			if ( 'text/html' !== $script_processor->get_attribute( 'type' ) ) {
-				continue;
-			}
-			/*
-			 * Unlike wp_add_crossorigin_attributes(), this does not check whether
-			 * URLs are actually cross-origin. Media templates use Underscore.js
-			 * template expressions (e.g. {{ data.url }}) as placeholder URLs,
-			 * so actual URLs are not available at parse time.
-			 * The crossorigin attribute is added unconditionally to all relevant
-			 * media tags to ensure cross-origin isolation works regardless of
-			 * the final URL value at render time.
-			 *
-			 * IMG is intentionally excluded, matching wp_add_crossorigin_attributes().
-			 * Under Document-Isolation-Policy: isolate-and-credentialless the browser
-			 * loads cross-origin images in credentialless mode without CORS headers,
-			 * so adding crossorigin="anonymous" would force a CORS request and break
-			 * previews of images served without Access-Control-Allow-Origin headers.
-			 */
-			$template_processor = new WP_HTML_Tag_Processor( $script_processor->get_modifiable_text() );
-			while ( $template_processor->next_tag() ) {
-				if (
-					in_array( $template_processor->get_tag(), array( 'AUDIO', 'VIDEO' ), true )
-					&& ! is_string( $template_processor->get_attribute( 'crossorigin' ) )
-				) {
-					$template_processor->set_attribute( 'crossorigin', 'anonymous' );
-				}
-			}
-			$script_processor->set_modifiable_text( $template_processor->get_updated_html() );
-		}
-
-		echo $script_processor->get_updated_html();
-	}
 }
diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php
index be0b2fbf098cc..b8136056a9e4f 100644
--- a/src/wp-includes/media.php
+++ b/src/wp-includes/media.php
@@ -6646,20 +6646,23 @@ function wp_get_chromium_major_version(): ?int {
  * same-origin iframe access that these editors rely on.
  *
  * @since 7.1.0
+ * @since 7.2.0 Returns whether the header was sent.
+ *
+ * @return bool Whether the Document-Isolation-Policy header was sent.
  */
-function wp_set_up_cross_origin_isolation(): void {
+function wp_set_up_cross_origin_isolation(): bool {
 	if ( ! wp_is_client_side_media_processing_enabled() ) {
-		return;
+		return false;
 	}
 
 	$screen = get_current_screen();
 
 	if ( ! $screen ) {
-		return;
+		return false;
 	}
 
 	if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
-		return;
+		return false;
 	}
 
 	/*
@@ -6675,7 +6678,7 @@ function wp_set_up_cross_origin_isolation(): void {
 
 	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
 	if ( 'site-editor.php' === $pagenow && ! wp_is_block_theme() && ( ! isset( $_GET['p'] ) || '/' === $_GET['p'] ) ) {
-		return;
+		return false;
 	}
 
 	/*
@@ -6684,112 +6687,39 @@ function wp_set_up_cross_origin_isolation(): void {
 	 * which blocks same-origin iframe access that these editors rely on.
 	 */
 	if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {
-		return;
+		return false;
 	}
 
 	// Cross-origin isolation is not needed if users can't upload files anyway.
 	if ( ! current_user_can( 'upload_files' ) ) {
-		return;
+		return false;
 	}
 
-	wp_start_cross_origin_isolation_output_buffer();
+	return wp_send_document_isolation_policy_header();
 }
 
 /**
  * Sends the Document-Isolation-Policy header for cross-origin isolation.
  *
- * Uses an output buffer to add crossorigin="anonymous" where needed.
+ * `isolate-and-credentialless` loads cross-origin subresources without
+ * credentials instead of blocking them, so no `crossorigin` attribute is
+ * needed on scripts, styles, images, audio, or video for the page to work.
+ * Forcing `crossorigin="anonymous"` would turn those into CORS requests
+ * and break any resource served without `Access-Control-Allow-Origin`.
  *
- * @since 7.1.0
+ * @since 7.2.0
+ *
+ * @return bool Whether the header was sent.
  */
-function wp_start_cross_origin_isolation_output_buffer(): void {
+function wp_send_document_isolation_policy_header(): bool {
 	$chromium_version = wp_get_chromium_major_version();
 
 	if ( null === $chromium_version || $chromium_version < 137 ) {
-		return;
+		return false;
 	}
 
-	ob_start(
-		static function ( string $output ): string {
-			header( 'Document-Isolation-Policy: isolate-and-credentialless' );
-
-			return wp_add_crossorigin_attributes( $output );
-		}
-	);
-}
-
-/**
- * Adds crossorigin="anonymous" to relevant tags in the given HTML string.
- *
- * @since 7.1.0
- *
- * @param string $html HTML input.
- * @return string Modified HTML.
- */
-function wp_add_crossorigin_attributes( string $html ): string {
-	$site_url = site_url();
-
-	$processor = new WP_HTML_Tag_Processor( $html );
-
-	// See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin.
-	$cross_origin_tag_attributes = array(
-		'AUDIO'  => array( 'src' ),
-		'LINK'   => array( 'href' ),
-		'SCRIPT' => array( 'src' ),
-		'VIDEO'  => array( 'src', 'poster' ),
-		'SOURCE' => array( 'src' ),
-	);
+	header( 'Document-Isolation-Policy: isolate-and-credentialless' );
 
-	while ( $processor->next_tag() ) {
-		$tag = $processor->get_tag();
-
-		if ( ! isset( $cross_origin_tag_attributes[ $tag ] ) ) {
-			continue;
-		}
-		$crossorigin = $processor->get_attribute( 'crossorigin' );
-		if ( null !== $crossorigin ) {
-			continue;
-		}
-
-		if ( 'AUDIO' === $tag || 'VIDEO' === $tag ) {
-			$processor->set_bookmark( 'audio-video-parent' );
-		}
-
-		$processor->set_bookmark( 'resume' );
-
-		$sought = false;
-
-		$is_cross_origin = false;
-
-		foreach ( $cross_origin_tag_attributes[ $tag ] as $attr ) {
-			$url = $processor->get_attribute( $attr );
-			if ( is_string( $url ) && ! str_starts_with( $url, $site_url ) && ! str_starts_with( $url, '/' ) ) {
-				$is_cross_origin = true;
-			}
-
-			if ( $is_cross_origin ) {
-				break;
-			}
-		}
-
-		if ( $is_cross_origin ) {
-			if ( 'SOURCE' === $tag ) {
-				$sought = $processor->seek( 'audio-video-parent' );
-
-				if ( $sought ) {
-					$processor->set_attribute( 'crossorigin', 'anonymous' );
-				}
-			} else {
-				$processor->set_attribute( 'crossorigin', 'anonymous' );
-			}
-
-			if ( $sought ) {
-				$processor->seek( 'resume' );
-				$processor->release_bookmark( 'audio-video-parent' );
-			}
-		}
-	}
-
-	return $processor->get_updated_html();
+	return true;
 }
 
diff --git a/tests/phpunit/tests/media/wpCrossOriginIsolation.php b/tests/phpunit/tests/media/wpCrossOriginIsolation.php
index b1c40e8596780..049983bf5beaa 100644
--- a/tests/phpunit/tests/media/wpCrossOriginIsolation.php
+++ b/tests/phpunit/tests/media/wpCrossOriginIsolation.php
@@ -5,7 +5,7 @@
  *
  * @group media
  * @covers ::wp_set_up_cross_origin_isolation
- * @covers ::wp_start_cross_origin_isolation_output_buffer
+ * @covers ::wp_send_document_isolation_policy_header
  * @covers ::wp_is_client_side_media_processing_enabled
  */
 class Tests_Media_wpCrossOriginIsolation extends WP_UnitTestCase {
@@ -81,11 +81,6 @@ public function tear_down() {
 			$_GET['p'] = $this->original_get_p;
 		}
 
-		// Clean up any output buffers started during tests.
-		while ( ob_get_level() > 1 ) {
-			ob_end_clean();
-		}
-
 		if ( null === $this->original_pagenow ) {
 			unset( $GLOBALS['pagenow'] );
 		} else {
@@ -104,85 +99,53 @@ public function tear_down() {
 	public function test_returns_early_when_client_side_processing_disabled() {
 		add_filter( 'wp_client_side_media_processing_enabled', '__return_false' );
 
-		// Should not error or start an output buffer.
-		$level_before = ob_get_level();
-		wp_set_up_cross_origin_isolation();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before, $level_after );
+		$this->assertFalse( wp_set_up_cross_origin_isolation() );
 	}
 
 	/**
 	 * @ticket 64766
 	 */
 	public function test_returns_early_when_no_screen() {
-		// No screen is set, so it should return early.
-		$level_before = ob_get_level();
-		wp_set_up_cross_origin_isolation();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before, $level_after );
+		$this->assertFalse( wp_set_up_cross_origin_isolation() );
 	}
 
 	/**
-	 * This test must run in a separate process because the output buffer
-	 * callback sends HTTP headers via header(), which would fail in the
-	 * main PHPUnit process where output has already started.
-	 *
 	 * @ticket 64766
 	 *
 	 * @runInSeparateProcess
 	 * @preserveGlobalState disabled
 	 */
-	public function test_starts_output_buffer_for_chrome_137() {
+	public function test_sends_header_for_chrome_137() {
 		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36';
 
-		$level_before = ob_get_level();
-		wp_start_cross_origin_isolation_output_buffer();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before + 1, $level_after, 'Output buffer should be started for Chrome 137.' );
-
-		ob_end_clean();
+		$this->assertTrue( wp_send_document_isolation_policy_header(), 'The Document-Isolation-Policy header should be sent for Chrome 137.' );
 	}
 
 	/**
 	 * @ticket 64766
 	 */
-	public function test_does_not_start_output_buffer_for_chrome_136() {
+	public function test_does_not_send_header_for_chrome_136() {
 		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36';
 
-		$level_before = ob_get_level();
-		wp_start_cross_origin_isolation_output_buffer();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before, $level_after, 'Output buffer should not be started for Chrome < 137.' );
+		$this->assertFalse( wp_send_document_isolation_policy_header(), 'The Document-Isolation-Policy header should not be sent for Chrome < 137.' );
 	}
 
 	/**
 	 * @ticket 64766
 	 */
-	public function test_does_not_start_output_buffer_for_firefox() {
+	public function test_does_not_send_header_for_firefox() {
 		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; rv:128.0) Gecko/20100101 Firefox/128.0';
 
-		$level_before = ob_get_level();
-		wp_start_cross_origin_isolation_output_buffer();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before, $level_after, 'Output buffer should not be started for Firefox.' );
+		$this->assertFalse( wp_send_document_isolation_policy_header(), 'The Document-Isolation-Policy header should not be sent for Firefox.' );
 	}
 
 	/**
 	 * @ticket 64766
 	 */
-	public function test_does_not_start_output_buffer_for_safari() {
+	public function test_does_not_send_header_for_safari() {
 		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15';
 
-		$level_before = ob_get_level();
-		wp_start_cross_origin_isolation_output_buffer();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before, $level_after, 'Output buffer should not be started for Safari.' );
+		$this->assertFalse( wp_send_document_isolation_policy_header(), 'The Document-Isolation-Policy header should not be sent for Safari.' );
 	}
 
 	/**
@@ -211,11 +174,7 @@ public function test_skips_cross_origin_isolation_for_classic_theme_site_editor_
 			$_GET[ $key ] = $value;
 		}
 
-		$level_before = ob_get_level();
-		wp_set_up_cross_origin_isolation();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before, $level_after, 'DIP should be skipped on the classic-theme site editor home route.' );
+		$this->assertFalse( wp_set_up_cross_origin_isolation(), 'DIP should be skipped on the classic-theme site editor home route.' );
 	}
 
 	/**
@@ -250,13 +209,7 @@ public function test_sets_up_cross_origin_isolation_for_classic_theme_site_edito
 
 		$_GET['p'] = '/page/about';
 
-		$level_before = ob_get_level();
-		wp_set_up_cross_origin_isolation();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before + 1, $level_after, 'DIP should be set up on a non-home site editor route.' );
-
-		ob_end_clean();
+		$this->assertTrue( wp_set_up_cross_origin_isolation(), 'DIP should be set up on a non-home site editor route.' );
 	}
 
 	/**
@@ -280,13 +233,7 @@ public function test_sets_up_cross_origin_isolation_for_block_theme_site_editor_
 
 		unset( $_GET['p'] );
 
-		$level_before = ob_get_level();
-		wp_set_up_cross_origin_isolation();
-		$level_after = ob_get_level();
-
-		$this->assertSame( $level_before + 1, $level_after, 'DIP should be set up on the block-theme site editor home route.' );
-
-		ob_end_clean();
+		$this->assertTrue( wp_set_up_cross_origin_isolation(), 'DIP should be set up on the block-theme site editor home route.' );
 	}
 
 	/**
@@ -362,37 +309,50 @@ public function test_set_flag_preserves_upload_media_module_dependencies() {
 	}
 
 	/**
-	 * Verifies that cross-origin elements get crossorigin="anonymous" added.
+	 * The deprecated output buffer helper only sends the header now.
 	 *
-	 * @ticket 64766
+	 * @ticket 65930
+	 *
+	 * @expectedDeprecated wp_start_cross_origin_isolation_output_buffer
 	 *
 	 * @runInSeparateProcess
 	 * @preserveGlobalState disabled
-	 *
-	 * @dataProvider data_elements_that_should_get_crossorigin
-	 *
-	 * @param string $html HTML input to process.
 	 */
-	public function test_output_buffer_adds_crossorigin( $html ) {
+	public function test_deprecated_output_buffer_helper_does_not_buffer() {
 		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36';
 
-		ob_start();
-
+		$level_before = ob_get_level();
 		wp_start_cross_origin_isolation_output_buffer();
-		echo $html;
 
-		ob_end_flush();
-		$output = ob_get_clean();
+		$this->assertSame( $level_before, ob_get_level(), 'No output buffer should be started.' );
+	}
 
-		$this->assertStringContainsString( 'crossorigin="anonymous"', $output );
+	/**
+	 * The deprecated attribute injector leaves the HTML untouched.
+	 *
+	 * Under Document-Isolation-Policy: isolate-and-credentialless, cross-origin
+	 * scripts, styles, images, audio, and video load without a crossorigin
+	 * attribute. Adding one forces a CORS request that fails for resources
+	 * served without Access-Control-Allow-Origin headers.
+	 *
+	 * @ticket 65930
+	 *
+	 * @expectedDeprecated wp_add_crossorigin_attributes
+	 *
+	 * @dataProvider data_cross_origin_elements
+	 *
+	 * @param string $html HTML input to process.
+	 */
+	public function test_deprecated_attribute_injector_returns_html_unchanged( $html ) {
+		$this->assertSame( $html, wp_add_crossorigin_attributes( $html ) );
 	}
 
 	/**
-	 * Data provider for elements that should receive crossorigin="anonymous".
+	 * Data provider of cross-origin elements that used to receive crossorigin="anonymous".
 	 *
 	 * @return array[]
 	 */
-	public function data_elements_that_should_get_crossorigin() {
+	public function data_cross_origin_elements() {
 		return array(
 			'cross-origin script'              => array(
 				'<script src="https://external.example.com/script.js"></script>',
@@ -413,145 +373,18 @@ public function data_elements_that_should_get_crossorigin() {
 	}
 
 	/**
-	 * Verifies that certain elements do not get crossorigin="anonymous" added.
-	 *
-	 * Images are excluded because under Document-Isolation-Policy:
-	 * isolate-and-credentialless, the browser handles cross-origin images
-	 * in credentialless mode without needing explicit CORS headers.
-	 *
-	 * @ticket 64766
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
-	 *
-	 * @dataProvider data_elements_that_should_not_get_crossorigin
-	 *
-	 * @param string $html HTML input to process.
-	 */
-	public function test_output_buffer_does_not_add_crossorigin( $html ) {
-		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36';
-
-		ob_start();
-
-		wp_start_cross_origin_isolation_output_buffer();
-		echo $html;
-
-		ob_end_flush();
-		$output = ob_get_clean();
-
-		$this->assertStringNotContainsString( 'crossorigin="anonymous"', $output );
-	}
-
-	/**
-	 * Data provider for elements that should not receive crossorigin="anonymous".
-	 *
-	 * @return array[]
-	 */
-	public function data_elements_that_should_not_get_crossorigin() {
-		return array(
-			'cross-origin img'                        => array(
-				'<img src="https://external.example.com/image.jpg" />',
-			),
-			'cross-origin img with srcset'            => array(
-				'<img src="https://external.example.com/image.jpg" srcset="https://external.example.com/image-2x.jpg 2x" />',
-			),
-			'link with cross-origin imagesrcset only' => array(
-				'<link rel="preload" as="image" imagesrcset="https://external.example.com/image.jpg 1x" href="/local-fallback.jpg" />',
-			),
-			'relative URL script'                     => array(
-				'<script src="/wp-includes/js/wp-embed.min.js"></script>',
-			),
-		);
-	}
-
-	/**
-	 * Same-origin URLs should not get crossorigin="anonymous".
-	 *
-	 * Uses site_url() at runtime since the test domain varies by CI config.
-	 *
-	 * @ticket 64766
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
-	 */
-	public function test_output_buffer_does_not_add_crossorigin_to_same_origin() {
-		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36';
-
-		ob_start();
-
-		wp_start_cross_origin_isolation_output_buffer();
-		echo '<script src="' . site_url( '/wp-includes/js/wp-embed.min.js' ) . '"></script>';
-
-		ob_end_flush();
-		$output = ob_get_clean();
-
-		$this->assertStringNotContainsString( 'crossorigin="anonymous"', $output );
-	}
-
-	/**
-	 * Elements that already have a crossorigin attribute should not be modified.
-	 *
-	 * @ticket 64766
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
-	 */
-	public function test_output_buffer_does_not_override_existing_crossorigin() {
-		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36';
-
-		ob_start();
-
-		wp_start_cross_origin_isolation_output_buffer();
-		echo '<script src="https://external.example.com/script.js" crossorigin="use-credentials"></script>';
-
-		ob_end_flush();
-		$output = ob_get_clean();
-
-		$this->assertStringContainsString( 'crossorigin="use-credentials"', $output, 'Existing crossorigin attribute should not be overridden.' );
-		$this->assertStringNotContainsString( 'crossorigin="anonymous"', $output );
-	}
-
-	/**
-	 * Multiple tags in the same output should each be handled correctly.
-	 *
-	 * @ticket 64766
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
-	 */
-	public function test_output_buffer_handles_mixed_tags() {
-		$_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36';
-
-		ob_start();
-
-		wp_start_cross_origin_isolation_output_buffer();
-		echo '<img src="https://external.example.com/image.jpg" />';
-		echo '<script src="https://external.example.com/script.js"></script>';
-		echo '<audio src="https://external.example.com/audio.mp3"></audio>';
-
-		ob_end_flush();
-		$output = ob_get_clean();
-
-		// IMG should NOT have crossorigin.
-		$this->assertStringContainsString( '<img src="https://external.example.com/image.jpg" />', $output, 'IMG should not be modified.' );
-
-		// Script and audio should have crossorigin.
-		$this->assertSame( 2, substr_count( $output, 'crossorigin="anonymous"' ), 'Script and audio should both get crossorigin, but not img.' );
-	}
-
-	/**
-	 * IMG tags in the media manager templates must not receive
-	 * crossorigin="anonymous", matching wp_add_crossorigin_attributes().
+	 * The media manager templates must not carry crossorigin="anonymous".
 	 *
-	 * Adding the attribute forces a CORS request that breaks previews of
-	 * images served without Access-Control-Allow-Origin headers, such as
-	 * media offloaded to a CDN.
+	 * Adding the attribute forces a CORS request that breaks previews and
+	 * playback of media served without Access-Control-Allow-Origin headers,
+	 * such as media offloaded to a CDN.
 	 *
 	 * @ticket 65673
+	 * @ticket 65930
 	 *
 	 * @covers ::wp_print_media_templates
 	 */
-	public function test_print_media_templates_does_not_add_crossorigin_to_img() {
+	public function test_print_media_templates_does_not_add_crossorigin() {
 		require_once ABSPATH . WPINC . '/media-template.php';
 
 		add_filter( 'wp_client_side_media_processing_enabled', '__return_true' );
@@ -560,8 +393,7 @@ public function test_print_media_templates_does_not_add_crossorigin_to_img() {
 		wp_print_media_templates();
 		$output = ob_get_clean();
 
-		$this->assertMatchesRegularExpression( '/<img\b/i', $output, 'Expected the media templates to contain IMG tags.' );
-		$this->assertDoesNotMatchRegularExpression( '/<img\b[^>]*\bcrossorigin\b/i', $output, 'IMG tags in the media templates must not receive a crossorigin attribute.' );
-		$this->assertMatchesRegularExpression( '/<(?:audio|video)\b[^>]*crossorigin="anonymous"/i', $output, 'AUDIO and VIDEO tags in the media templates should still receive crossorigin="anonymous".' );
+		$this->assertMatchesRegularExpression( '/<(?:img|audio|video)\b/i', $output, 'Expected the media templates to contain media tags.' );
+		$this->assertDoesNotMatchRegularExpression( '/<(?:img|audio|video)\b[^>]*\bcrossorigin\b/i', $output, 'Media tags in the media templates must not receive a crossorigin attribute.' );
 	}
 }