From 63bde3c6c16e65873e2426467b0a2b9325feea21 Mon Sep 17 00:00:00 2001
From: Brian Clifton <brian@clifton.me>
Date: Tue, 4 Feb 2025 21:38:00 -0700
Subject: [PATCH] Allow popups from inside brave://getting-started iframe
 (#27497)

* Allow popups from inside brave://getting-started iframe

Fixes https://github.com/brave/brave-browser/issues/43719

* Added attribute per discussion in security review
---
 browser/resources/brave_education/brave_education_app.html.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/browser/resources/brave_education/brave_education_app.html.ts b/browser/resources/brave_education/brave_education_app.html.ts
index 525b3e925ec7..b0ee767668b7 100644
--- a/browser/resources/brave_education/brave_education_app.html.ts
+++ b/browser/resources/brave_education/brave_education_app.html.ts
@@ -10,6 +10,7 @@ import type {BraveEducationAppElement} from './brave_education_app.js';
 export function getHtml(this: BraveEducationAppElement) {
   return this.url_ ?
       html`<iframe id="content" src="${
-          this.url_}" sandbox="allow-scripts allow-same-origin"></iframe>` :
+          this.url_}" sandbox="allow-scripts allow-same-origin allow-popups
+          allow-popups-to-escape-sandbox"></iframe>` :
       '';
 }