Embedder (origin A) — http://localhost:18080

Cross-origin iframe below is explicitly denied focus-without-user-activation via permissions-policy. With BlockingFocusWithoutUserActivation enabled, it should be unable to pull focus without a user gesture.