I recently noticed that a sandboxed iframe without the 'allow downloads' flags set still automatically downloads files when the src of the iframe is set to an url that triggers a download (e.g. https://download.mozilla.org/?product=firefox-stub&os=win&lang=en-US). This is not the behaviour I would expect but I can't find any information about this specific case in the documentation. Can someone tell me if this is intended behaviour, a bug or a grey zone in the HTML specification.