Use collision-checked random UUIDs for object URL identifiers instead of a process-local counter. Reuse the existing UUID generation for Blob identity and cover URL format plus independent lifetime for multiple URLs referencing one Blob.
Store the URL creator’s browser partition and storage key separately from its backing Blob, and check authorization atomically with URL removal. Use the Worker environment storage key and a shared opaque-origin nonce allocator for Windows and Workers.
Source: e090f2b070
ldm0