Block framebusts without a user gesture

content/public/common/content_features.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "build/build_config.h"
 #include "content/public/common/content_features.h"
 
 namespace features {
 
 // All features in alphabetical order.
@@ skipping 27 matching lines @@
 // Enables the Feature Policy framework for granting and removing access to
 // other features through HTTP headers.
 const base::Feature kFeaturePolicy{"FeaturePolicy",
                                    base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Enables a blink::FontCache optimization that reuses a font to serve different
 // size of font.
 const base::Feature kFontCacheScaling{"FontCacheScaling",
                                       base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Enables a security restriction on iframes navigating their top frame.
+// When enabled, the navigation will only be permitted if the iframe is
+// same-origin to the top frame, or if a user gesture is being processed.
+const base::Feature kFramebustingNeedsSameOriginOrUserGesture{
+    "FramebustingNeedsSameOriginOrUserGesture",
+    base::FEATURE_ENABLED_BY_DEFAULT};
+
 // Enables extended Gamepad API features like motion tracking and haptics.
 const base::Feature kGamepadExtensions{"GamepadExtensions",
                                        base::FEATURE_DISABLED_BY_DEFAULT};
 
 // FeatureList definition for trials to enable the download button on
 // MediaDocument.
 const base::Feature kMediaDocumentDownloadButton{
     "MediaDocumentDownloadButton",
     base::FEATURE_DISABLED_BY_DEFAULT
 };
@@ skipping 126 matching lines @@
 #endif
 
 #if defined(OS_WIN)
 // Emergency "off switch" for new Windows sandbox security mitigation,
 // sandbox::MITIGATION_EXTENSION_POINT_DISABLE.
 const base::Feature kWinSboxDisableExtensionPoints{
     "WinSboxDisableExtensionPoint", base::FEATURE_ENABLED_BY_DEFAULT};
 #endif
 
 }  // namespace features