caption: Block Controlled Frame API on these sites
desc: |-
  The Controlled Frame API, available to certain isolated contexts such as Isolated Web Apps (IWAs), allows an app to embed and manipulate arbitrary content.
  Please see https://github.com/WICG/controlled-frame for details.

  Setting the policy lets you list the URL patterns that specify which sites are not allowed to use the Controlled Frame API.
  Valid patterns are limited to Isolated Web Apps.

  Leaving the policy unset means <ph name="DEFAULT_CONTROLLED_FRAME_SETTING_POLICY_NAME">DefaultControlledFrameSetting</ph> applies for all sites, if it's set.

  URL patterns must not conflict with <ph name="CONTROLLED_FRAME_ALLOWED_FOR_URLS_POLICY_NAME">ControlledFrameAllowedForUrls</ph>. Neither policy takes precedence if a URL matches with both.

  For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. <ph name="WILDCARD_VALUE">*</ph> is not an accepted value for this policy.
example_value:
- isolated-app://aerugqztij5biqquuk3mfwpsaibuegaqcitgfchwuosuofdjabzqaaic
features:
  dynamic_refresh: true
  per_profile: true
supported_on:
- chrome_os:134-
future_on:
- chrome.*
owners:
- file://chrome/browser/controlled_frame/OWNERS
schema:
  items:
    type: string
  type: array
tags: []
type: list
