Allow popups from inside brave://getting-started iframe (#27497)

* Allow popups from inside brave://getting-started iframe Fixes brave/brave-browser#43719 * Added attribute per discussion in security review
brave · Feb 5, 2025 · 63bde3c · 63bde3c
1 parent 864519d
commit 63bde3c
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/browser/resources/brave_education/brave_education_app.html.ts b/browser/resources/brave_education/brave_education_app.html.ts
@@ -10,6 +10,7 @@ import type {BraveEducationAppElement} from './brave_education_app.js';
 export function getHtml(this: BraveEducationAppElement) {
   return this.url_ ?
       html`<iframe id="content" src="${
-          this.url_}" sandbox="allow-scripts allow-same-origin"></iframe>` :
+          this.url_}" sandbox="allow-scripts allow-same-origin allow-popups
+          allow-popups-to-escape-sandbox"></iframe>` :
       '';
 }