A “script” element with a “type” attribute whose value is neither a JavaScript MIME type, “module”, “importmap”, nor “speculationrules” (i.e., a data block) must not have a “crossorigin” attribute.

The crossorigin attribute is invalid on a <script> element whose type marks it as a data block, because browsers never fetch a data block over the network.

When the type attribute is anything other than a JavaScript MIME type, module, importmap, or speculationrules, the browser treats the element as a data block: inline content that other scripts on the page can read, but that never runs. The most common example is application/ld+json structured data. A data block can't have a src attribute either, so the browser makes no request for it.

crossorigin sets the CORS mode the browser uses when it downloads an external script, and for classic scripts it also decides whether error details from another origin reach window.onerror. With no download and no execution, the attribute has nothing to apply to.

This usually happens when a build step or plugin adds crossorigin to every <script> tag on the page, including the data blocks.

Invalid example

<script type="application/ld+json" crossorigin="anonymous">
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "name": "Example"
  }
</script>

Valid example

<script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "name": "Example"
  }
</script>
<script src="https://cdn.example.com/app.js" crossorigin="anonymous"></script>

Remove crossorigin from the data block and keep it on the scripts the browser actually downloads. If the element was meant to run, fix the type instead: use module, a JavaScript MIME type such as text/javascript, or leave type out.

Learn more:

MDN Reference

HTML script element - MDN

→

MDN Reference

HTML attribute: crossorigin - MDN

→

WHATWG Spec

Scripting - WHATWG HTML Standard

→