Electron Releases

Description of Change

Per the HTML spec, a popup opened from a sandboxed frame must inherit the opener's sandbox flags unless allow-popups-to-escape-sandbox is set. Windows opened through the OpenURLFromTab path (e.g. modifier-clicked links, routed through the internal -new-window event) didn't do this, unlike window.open popups and unlike the same flow in Chrome.

• Resolve the initiating frame from the OpenURLParams source frame; frame_tree_node_id identifies the target frame and is unset for these dispositions, so the existing check from #51401 never ran on this path.
• When allow-popups-to-escape-sandbox is absent, pass the initiator's active sandbox flags through -new-window and apply them as starting_sandbox_flags when the new window's WebContents is created, mirroring what WebContentsImpl::CreateWithOpener does for renderer-created popups.

When setWindowOpenHandler returns a custom createWindow, the inherited flags apply when the provided webPreferences are forwarded to the created window.

Checklist

• PR description included and stakeholders cc'd
• npm test passes
• tests are changed or added
• PR title follows semantic commit guidelines

Release Notes

Notes: Windows opened from links inside a sandboxed iframe now inherit the iframe's sandbox restrictions unless allow-popups-to-escape-sandbox is set.