| A more permissive child-src should not relax restrictions from a less- permissive frame-src. Directives still combine for least privilege, even when one obsoletes another. | |
| PASS Expecting logs: ["PASS IFrame #1 generated a load event.", "violated-directive=frame-src"] | |