Under the hood
Useful2 Signal2
Requests to the frame host no longer follow redirects, so credentials can't be passed onward.
What's wrong with this entry?
Anonymous. No account, no email.
What
Calls to the "frame" API host now set maxRedirects: 0, and the shared request helper defaults to 0 for that host. Redirects used to be followed, which could pass credentials on to whatever the redirect pointed at.
Evidence
maxRedirects
Strings lifted out of the shipped bundle, so the claim above can be checked against them.