https://w3c.github.io/webauthn/#dom-webauthentication-makecredential step 3 is using "current settings object's origin" in an algorithm step that is running async and hence no concept of "current settings object". Note that async steps may also be running on separate execution threads, where settings objects, and origins, aren't even accessible. Whatever work is done with settings objects and origins needs to be done before going async.