Block subresource requests whose URLs include credentials.

third_party/WebKit/Source/platform/RuntimeEnabledFeatures.json5

 {
   // http://dev.chromium.org/blink/runtime-enabled-features
   //
   // This list is used to generate RuntimeEnabledFeatures.h/cpp which contains
   // a class that stores static enablers for all experimental features.
 
   parameters: {
     // Each feature can be assigned a "status":
     // status=stable -> Enable this in all Blink configurations.  We are committed to these APIs indefinitely.
     // status=experimental -> In-progress features, Web Developers might play with, but are not on by default in stable.
@@ skipping 989 matching lines @@
     },
     {
       name: "PerformancePaintTiming",
       status: "test",
     },
     {
       name: "HideNonceContentAttribute",
       status: "experimental",
     },
     {
+      name: "BlockCredentialedSubresources",
+      status: "experimental",
+    },
+    {
       name: "UnclosedFormControlIsInvalid",
       status: "experimental",
     },
     {
       name: "RestrictCompleteURLCharacterSet",
       status: "experimental",
     },
     {
       name: "BlockLegacySubresources",
       status: "experimental",
     },
     {
       name: "MediaControlsOverlayPlayButton",
       settable_from_internals: true,
     },
     {
       name: "VideoFullscreenDetection",
     }
   ],
 }