demo · v135
Cross-origin iframe envelope
The compatibility issue is narrow: payment WebAuthn credential creation in an iframe without transient user activation used to surface SecurityError. Chrome 135 aligns it with WebAuthn so the activation failure reports NotAllowedError.
legacy payment path
SecurityError for activationless payment create in an iframe.
Chrome 135+
NotAllowedError for the same missing-activation failure.
other failures
SecurityError can still mean origin, RP ID, or permission-policy failure; it is not the expected activation error.
what to look for
A production reproduction needs a real secondary origin with the right Permissions-Policy. This local harness still exposes the important diagnostics: whether the call ran in a sandboxed iframe, whether transient user activation was present, whether the payment policy appears allowed, and which error.name the browser actually threw. If the iframe reports SecurityError, check the policy/origin diagnostics before treating it as the legacy activation bug.