Electron Releases

WebContents::OpenURLFromTab only propagated the initiating frame's sandbox flags to the window it opened when that frame had a parent, so windows opened by a sandboxed top-level frame were created without them.

• Resolve and apply the initiator's active sandbox flags regardless of its position in the frame tree — a top-level frame can be sandboxed too (a sandboxed iframe's popup, or a Content-Security-Policy: sandbox header).
• Add a regression test for a window opened by a CSP-sandboxed top-level document.

Notes: Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions.