WPT details: This is at the boundary of the web platform (external apps). This is not observable from within a document. So it is not possible to have WPT. There are browser_tests instead.
Block sandboxed iframe from opening external application. To enable it again, apply at least one of following values to the <iframe> element's sandbox property: - allow-popups - allow-top-navigation - allow-top-navigation-with-user-activation Or use the new dedicated one: - allow-top-navigation-to-custom-protocols
If --as a site author-- developers sandbox untrusted content and don't give it the permission to navigate users away via normal navigations, they also don't want it to navigate away toward external app or the play store on top of their web page. This problem was reported multiple time, by security researcher and companies wanting to get rid of malvertisers (malicious ads) - https://github.com/whatwg/html/issues/2191 - https://crbug.com/1148777
Docs: https://docs.google.com/document/d/1hHjxQk1yLoC0ioBBYpIq4JJYAwj9sJfR5b62QcLt1eM/edit https://github.com/whatwg/html/pull/7124 https://github.com/whatwg/html/pull/7654
Explainers: https://github.com/whatwg/html/issues/2191