Window.open and <webview> popups are now intercepted and routed into new tabs, except for OAuth/SSO flows (Google, Microsoft, etc.) which are allowed to open real popups to preserve authentication semantics. Renderer logic is updated to handle 'open-url-new-tab' IPC events and consistently open external http(s) links in tabs, improving user experience and security.
andrew
3bf0458ede