Should focus-without-user-activation be able to allow cross-origin autofocus? #13105

What is the issue with the HTML Standard?

Summary

Should an allowed focus-without-user-activation policy lift the cross-origin
restriction on declarative autofocus, or should that restriction remain
independent of the policy?

Current specification and test

The autofocus insertion algorithm invokes the allow focus steps.
In #11277, I removed the additional unconditional cross-origin check so
that a policy-authorized cross-origin document could autofocus.

The following WPT explicitly allows the policy in a cross-origin iframe and
expects autofocus to succeed: focus-without-user-activation-enabled.sub.html

That autofocus assertion currently fails in the browsers shown in the linked WPT
results because their implementations retain the older cross-origin veto. But
the test's expectation is consistent with the current specification.

Why revisit autofocus's inclusion?

Unlike explicit focus APIs, declarative autofocus does not require execution of
author script. The argument that an iframe "could already call focus()"
does not cover every case.

For example, a cross-origin document served with
Content-Security-Policy: script-src 'none' could contain <input autofocus>.

That document cannot make an author-script focus() call, but a policy grant
that enables cross-origin autofocus gives it a way to take focus where the
cross-origin restriction previously prevented it. A similar case arises with
sanitized content if scripts and event handlers are removed but autofocus
is retained.

This is not a CSP bypass (script-src does not prohibit declarative focus)
nor does it mean that explicitly granting this capability is inherently wrong.
This raises the question of whether embedders should be able to permit scripted
focus while keeping cross-origin declarative autofocus blocked.

Questions for discussion

1. Should allowing focus-without-user-activation authorize cross-origin
   autofocus, as currently specified?
2. Alternatively, should autofocus retain the cross-origin restriction while
   remaining subject to policy denial, or should it be handled entirely
   separately from this policy?