Free tools Windows power users keep installed
One-click scans. No signup required.
If Safari throws a SecurityError at canvas.toBlob(), the usual cause is a tainted canvas: something drawn into it came from another origin without successful CORS approval. Set the image’s CORS mode before its URL, make the image server allow your site’s origin, and draw only after the image loads successfully. This is a browser security restriction, not a Safari-only image-encoding defect.
What the SecurityError means
HTMLCanvasElement.toBlob() converts a canvas bitmap into a Blob. Browsers allow that conversion only while the canvas is origin-clean. If the canvas contains pixels from an image or video loaded from another origin without CORS approval, it becomes tainted; reading or exporting those pixels is then blocked. MDN Web Docs describes this protection and the related restrictions on getImageData() and toDataURL().
The rule applies to the canvas’s drawing history, not just the last image drawn. A single disallowed source can taint the destination. The source may be less obvious than a direct drawImage(): it can be an image nested in an SVG, a CSS background rendered by a library, a video frame, or content copied from another tainted canvas. If your code works in another browser but fails in Safari, inspect the origin and CORS response of every source rather than treating the symptom as a Safari encoding bug.
There are two distinct failure classes to separate. A tainted canvas causes a security exception when you attempt to export or read pixels. Separately, toBlob() is asynchronous: its callback receives a Blob, and a null result should be handled as an encoding failure. If you request an unsupported MIME type, the browser may fall back to PNG; that fallback is not itself a CORS SecurityError.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Fix the image load and server response
Set crossOrigin before src
Create the image and set crossOrigin before assigning src. The browser may start the request as soon as the URL is assigned, so setting CORS mode afterward is too late. For a public asset that does not require credentials, use anonymous.
Allow your site on the image server
The image response must include an Access-Control-Allow-Origin header permitting the origin of the page that is drawing it. A server can allow a specific origin, such as https://your-site.example, or use * for genuinely public, non-credentialed assets. If the response changes according to the requesting origin, the server should also send Vary: Origin so caches do not serve a response with the wrong CORS headers.
Allowing the origin in JavaScript is not enough: CORS permission comes from the server’s response. If the image is hosted by a CDN, check the response that Safari actually receives, including after redirects. The final image response must still permit your page’s origin, and CDN caching must preserve the appropriate headers.
Draw only after a successful load
Wait for the image’s load event before drawing it. A failed load can mean a CORS rejection, a network problem, or a missing resource; do not attempt to export as if a valid image had been drawn.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- BUILT FOR COLLEGE. AND BEYOND — MacBook Air with the M5 chip packs blazing speed and powerful AI capabilities into an incredibly portable design. And with up to 18 hours of battery life,* this thin and light powerhouse is ready to take on almost any major, just about anywhere.
- TEAR THROUGH TOUGH ASSIGNMENTS — With its faster CPU and unified memory, the M5 chip delivers even more performance and fluidity across apps, making multitasking and creative workflows smooth and responsive. A powerful Neural Engine and next-generation GPU with Neural Accelerators give you a powerful platform for AI.
- MAKE QUICK WORK OF YOUR TO-DO LIST — Apple Intelligence helps you write, express yourself, and get things done effortlessly — whether it’s for school or everyday life. With groundbreaking privacy protections, it gives you peace of mind that no one else can access your data — not even Apple.*
- UP TO 18 HOURS OF BATTERY LIFE — MacBook Air delivers incredible battery life with amazing performance, so you can power through a full day of classes without worrying about plugging in.
- A BRILLIANT 13.6-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Air supports 1 billion colors, making photos and videos pop with rich contrast and sharp detail, and text appears supercrisp. So everything — from class presentations to movies to games — looks truly stunning.
const image = new Image();
image.crossOrigin = "anonymous";
image.onload = () => {
const canvas = document.querySelector("canvas");
const ctx = canvas.getContext("2d");
if (!ctx) {
console.error("Could not get a 2D canvas context");
return;
}
ctx.drawImage(image, 0, 0);
canvas.toBlob((blob) => {
if (!blob) {
console.error("Image encoding failed");
return;
}
// Upload or download the Blob here.
}, "image/png");
};
image.onerror = () => {
console.error("Image failed CORS or network checks");
};
image.src = "https://cdn.example/image.jpg";Replace the example image URL with your asset. The example requests a PNG blob; if you choose another output MIME type, check whether your target browsers support it and handle the possibility of PNG fallback. Do not treat a successful load alone as proof that the server granted CORS: inspect the final response headers and confirm the canvas export succeeds.
Choose the right CORS mode for credentials
Use crossOrigin = "anonymous" when the image does not need cookies or other credentials. If the request must include credentials, select the credentialed CORS mode before setting src, and configure the server to return both an explicit allowed origin and Access-Control-Allow-Credentials: true. The wildcard origin * is not valid for a credentialed CORS response.
Credentialed CORS is a coordinated client-and-server configuration, not a way to make an arbitrary third-party image readable. If you cannot configure the remote host, changing the client’s crossOrigin value will not grant permission. Do not disable browser security or rely on a client-side proxy as a production workaround.
Diagnose the failing source in Safari
- Open Web Inspector. Check both the Console and Network panels while reproducing the export. A script often receives only a generic cross-origin failure; the console and request details provide the useful diagnostic clues.
- Find every drawn source. Review direct images, SVG contents, video frames, library-rendered CSS backgrounds, and any source canvas. A single source lacking CORS approval is enough to taint the resulting canvas.
- Inspect the final response. In Network, locate the image request and check its final URL, status, redirects, and response headers. Confirm that
Access-Control-Allow-Originallows the page’s origin. If the request is credentialed, confirm the explicit origin and credential permission rather than a wildcard. - Test from the real page origin. A
file://page, sandboxed iframe, or opaque origin can behave differently from the deployed HTTP(S) page and may not match the server’s allowlist. Reproduce from an HTTP(S) origin that the image server is configured to permit. - Separate loading, security, and encoding errors. Handle the image’s
errorevent, the canvas export exception, and a null blob result as separate paths. This helps identify whether the problem is a failed request, a tainted bitmap, or an encoding issue.
Fixes by situation
| Situation | What to change | What to verify |
|---|---|---|
| You control the image server | Return an Access-Control-Allow-Origin value that permits the page; include Vary: Origin if the response varies by requesting origin. |
The final response in Safari’s Network panel has the expected CORS headers. |
| The asset is public and does not use credentials | Set crossOrigin = "anonymous" before src, and configure the host to allow the origin or use * for the public asset. |
The request loads and the canvas can be exported. |
| The request needs cookies or other credentials | Use credentialed CORS with an explicit allowed origin and Access-Control-Allow-Credentials: true. |
Do not use * for the allowed origin; check the final response. |
| You do not control the remote image host | Serve the asset from an origin you control, or fetch and serve it through a server-side relay that you control and configure correctly. | The browser loads the image from an origin with valid CORS permission. |
| The page is opened from a local file or sandbox | Reproduce from an HTTP(S) page whose origin matches the server configuration. | Confirm whether the same request succeeds under the intended deployed origin. |
Common errors and how to correct them
Setting crossOrigin after src
Symptom: The image request occurs, but the canvas remains tainted or the image fails to load with a CORS error. Cause: The request began before the CORS mode was configured. Fix: Create a fresh image, attach handlers, set crossOrigin, and then assign src.
Recommended Free Tools
Rank #3
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
The server does not allow the page origin
Symptom: The image request appears in Network, but exporting the canvas triggers a security failure. Cause: The image response lacks an allowed origin or allows a different origin. Fix: Change the image server or CDN response configuration and verify the headers on the final response, not only on an earlier redirect.
Wildcard used with credentials
Symptom: A credentialed image request is rejected despite an Access-Control-Allow-Origin: * response. Cause: Credentialed CORS requires an explicit origin. Fix: Return the requesting site’s explicit origin and Access-Control-Allow-Credentials: true.
A hidden canvas source is tainting the output
Symptom: The image you recently added looks same-origin, but exporting still fails. Cause: Earlier content or an indirect source—such as an SVG image, video frame, CSS-rendered asset, or tainted input canvas—has already tainted the destination. Fix: Trace all inputs and test them individually in a fresh canvas after confirming their responses have CORS approval.
The image fails before drawing
Symptom: The image’s error handler runs and no usable canvas output is produced. Cause: The request may be blocked by CORS or may have a network or resource error. Fix: Use Web Inspector’s Console and Network panels to identify the request outcome; do not call this an encoding failure unless a loaded source reaches the export step.
Rank #4
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
The callback has no blob
Symptom: The callback runs with a null value rather than a blob. Cause: The export did not produce an encoded blob; this is distinct from the origin-clean security exception. Fix: Handle the null result explicitly, check the requested MIME type, and verify that the canvas has valid dimensions and content.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
If your goal is to capture a web page as an image or PDF rather than export pixels from your own application’s canvas, a screenshot API can avoid setting up a browser canvas pipeline. ScreenshotNeo is a website screenshot API and MCP server by Yorker Media. Its one-request API returns PNG, JPEG, WebP, or PDF output. This does not repair a tainted canvas inside your app; it is an alternative when the desired result is a screenshot of a page.
See the ScreenshotNeo API documentation. For example, this cURL request saves a WebP screenshot of Stripe:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpScreenshotNeo accepts cookie and consent banners, removes more than 60 known consent platforms along with newsletter popups and chat widgets before capture, and lets you turn each step off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed; response headers identify the page verdict and billing status. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients. The Free plan includes 1,000 shots per month without a card; paid plans start at $5 for 3,000 shots, and every feature is available on every plan. See ScreenshotNeo for service details. Sign up for 1,000 free screenshots a month with no card.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When a server relay is the appropriate fix
A relay is useful when the third-party image host will not grant browser CORS access but your application is permitted to retrieve and serve the asset. The relay must be operated on a server you control and must return the image along with CORS headers appropriate to your own page. Keep the change server-side: a browser-side proxy does not remove the same-origin protection, and disabling browser security exposes users rather than fixing the application.
Best Value
- FAST RUNS IN THE FAMILY — The 16-inch MacBook Pro with the M5 Pro or M5 Max chip brings next-generation speed and powerful on-device AI to personal, professional, and creative tasks. With all-day battery life, double the starting storage,* and a breathtaking Liquid Retina XDR display, it’s pro in every way.*
- BUCKLE UP — Along with a next-generation CPU, faster unified memory, and up to 2x faster SSD storage,* M5 Pro and M5 Max feature a more powerful GPU with a Neural Accelerator built into each core, delivering faster AI performance and on-device training capabilities. So you can blaze through demanding workloads at mind-bending speeds.
- BUILT FOR AI — Apple silicon, and every major component that powers it, is designed to run demanding on-device AI workloads like LLM inference and training. And Apple Intelligence helps you write, express yourself, and get things done effortlessly with groundbreaking privacy protections at every step.*
- ALL-DAY BATTERY LIFE — MacBook Pro delivers the same exceptional performance whether it’s running on battery or plugged in.*
- MACOS RUNS APPS FAST — All your go-to apps run lightning fast in macOS, including built-in apps like FaceTime and Messages. Plus, built-in virus protection and free software updates help keep your Mac running smoothly and securely.
Whether a relay is acceptable depends on access rights, authentication, and how the asset is delivered. Do not forward private cookies or authorization data to a third-party host unless that is intentional and permitted. If the source is dynamic or served through a CDN, test the final response path and caching behavior, including any redirects.
FAQ
Why does toBlob work in Chrome but fail in Safari?
The symptom can expose a cross-origin source that was not successfully CORS-approved, even if the other browser appeared to export it. Treat the Safari failure as a signal to inspect the source requests and final headers, rather than assuming the browser has a different image encoder defect.
Does switching from toBlob to toDataURL fix a tainted canvas?
No. The same origin-clean restriction applies to toDataURL() and pixel reads through getImageData().
Does a successful image load prove that canvas export is allowed?
No. Confirm the CORS response and test the export; loading and permission to read canvas pixels are separate checks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
