"same-origin-allow-popups" This forces the creation of a new top-level browsing context for the document — unless its predecessor specified the same cross-origin opener policy and they are same origin. Outcome: So I suspect that the any adversarial site loading the site in a popup won't have access.

0298c380-226e-44ff-91cc-7461cf13c954