mirror of
https://github.com/saphid/frame-control.git
synced 2026-10-14 18:02:42 +02:00
Meta's login can embed captcha and CDN frames from other sites (Arkose Labs, hCaptcha, reCAPTCHA, fbcdn), so frames inside the sign-in window may now go to any https: address (or about:blank/about:srcdoc); other schemes (http:, data:, blob:, javascript:, file:...) are still stopped. The window itself stays on the Meta/Oculus/Facebook allow-list. Frames can't reach the cookie read or IPC. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>