Is the offered workaround from this known issue universally safe?
- Google and Microsoft made the vulnerability-correction over-broad and Firefox has found a narrower fix; or
- Firefox hasn't been "fixed" and we are being asked to have our users/admins workaround the fix and be exposed to a known vulnerability should they open another tab or site (assuming Salesforce is safe with the workaround).
Google states in the M92 Release Notes that:
Chrome 92 prevents iframes from triggering prompts (window.alert, window.confirm, window.prompt) if the iframe is a different origin from the top-level page. This change is intended to prevent embedded content from spoofing the user into believing a message is coming from the website they're visiting, or from Chrome itself. If you have any web apps affected by this change, you can use the temporary enterprise policy SuppressDifferentOriginSubframeDialogs to revert to the previous behavior. This policy will be removed in Chrome 95.", page 3
So, we are leery of switching to a browser that isn't normally used by our organization in order to accommodate what is either a bad dev practice or deprecated technique.