[hackerone] iframe download popup origin confusion

[diracdeltas]

Reported on https://hackerone.com/bugs?organization_inbox_handle=brave_inbox&view=new&end_date=&report_id=2888770&reported_to_team=&sort_direction=descending&sort_type=latest_activity&start_date=&subject=user&substates%5B%5D=new&text_query=&limit=25&page=1 by syarif07

STR and test plan: https://bravesoftware.slack.com/archives/C7VLGSR55/p1733780897619429

[diracdeltas]

the cause of this issue (which doesn't affect chrome) is https://github.com/brave/brave-core/pull/24620/files#diff-ce0ceeb7d6797674939d53ab00b8100058ccce6f2374d584c39105983187b876R26

[LaurenWags]

@brave/qa-team should put verification notes under https://github.com/brave/internal/issues/1238.

[LaurenWags]

Requires 1.74.30 or higher for verification 👍🏻

Can use something like https://bravesoftware.slack.com/archives/CHGKGMHDJ/p1734455218877249?thread_ts=1734418637.386749&cid=CHGKGMHDJ for release notes.

[kjozwiak]

As discussed with @diracdeltas, the above needs a follow up which will be fixed/completed via #42939. We'll want to uplift #42939 into 1.74.x as well so labelling #42939 as release/blocking so it doesn't fall through the cracks. Labelling the following issue as QA/No and release-notes/exclude as we'll verify the fix via #42939.