cascadeRestrictions: misunderstood or not working?

[guest]

Hi! I set cascadeRestrictions to true and visit a website. All 1st and 3rd parties are using the default preset. Now I change 3rd party gstatic.com to trusted and it actually loads the fonts. Shouldn't it be blocked from doing so as the 1st party has fonts blocked, too?

[Giorgio Maone]

cascadeRestrictions applies to subframes: "Any capability blocked in the top document must be blocked in its subdocuments too".
So if you enable the font capability for an origin that is loaded in in the top document (vs in a frame), it won't be affected.

[guest]

Thanks. What's the benefit of having it turned off by default?

[Giorgio Maone]

Thanks. What's the benefit of having it turned off by default?

Making "trusted" embeddings (e.g. Youtube videos, which are implemented as iframes now for security reasons) work even if embedded on less trusted pages.