SkyZeroZx b32ee7ceb3 fix(core): treat iframe credentialless as security-sensitive ...

Mark the iframe `credentialless` attribute as security-sensitive so dynamic
bindings are handled consistently with other iframe attributes that affect the
initial navigation, such as `sandbox`, `allow`, `referrerPolicy`, `csp`, and
`fetchPriority`.

Because `credentialless` must be present before the iframe starts loading to
affect the navigation’s credential mode, late dynamic updates can leave the final
DOM looking correct while the initial request was not loaded credentiallessly.

(cherry picked from commit 0152e3cbdf)

2026-06-16 16:05:57 +00:00

..

dom_element_schema_registry_spec.ts

fix(core): treat iframe credentialless as security-sensitive

2026-06-16 16:05:57 +00:00

trusted_types_sinks_spec.ts

fix(compiler): disallow translations of iframe src

2026-03-12 11:01:26 -06:00