Camera and Microphone Delegation in Iframes

Checks that a camera or microphone request from a cross-origin iframe follows the iframe allow attribute. A frame the page delegated the feature to should get the browser's permission prompt; a frame without delegation should be denied without any prompt. The nested panels copy embedded ID-verification flows, where the camera runs two frames down: top page → provider frame (allow="camera *") → vendor frame (allow="camera").

The frames load this same page from other origins: and, for nested panels, . Override them with ?frame=<origin>&inner=<origin>.

Panels

Test steps

In each panel, tap Camera, Microphone and Camera + Microphone.
Compare the prompt and the result shown in the frame with the table below.
Before each panel, reset the site's camera and microphone permissions so a saved decision doesn't hide the prompt.

Expected outcomes

Panel	Prompt	Result after allowing
1. Delegated cross-origin frame	Yes, naming the top-level site	`success` with the requested tracks
2. Cross-origin frame without `allow`	No	`NotAllowedError`
3. Nested, delegated at both levels	Yes, naming the top-level site	`success` with the requested tracks
4. Nested, inner frame without `allow`	No	`NotAllowedError`
5. Cross-origin frame without `allow` that replaces `Promise[Symbol.species]` before each request	No	`NotAllowedError`. Checks that a browser's own pre-prompt checks can't be faked by page scripts.