To support usage of SharedArrayBuffer in our web app we had to add the response headers:
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
We have also tried:
Cross-Origin-Embedder-Policy: credentialless
Cross-Origin-Opener-Policy: same-origin
The problem with either of these sets of values is that the google drive picker integrated in our application quits working and the google picker panel displays:
docs.google.com refused to connect
If we don't provide a Cross-Origin-Embedder-Policy then the google drive picker works as expected.