Bug: `react-dom-client.development.js` tries to read `$$typeof` on iframe object

[jzhan-canva]

In ReactFiberPerformanceTrack it tries to deep read the props in DEV mode, props may deeply contains cross-origin frame
which will cause SecurityError: Failed to read a named property '$$typeof' from 'Window': Blocked a frame with origin "http://localhost:8080/" from accessing a cross-origin frame.

React version: 19.2.0 (I believe the change is introduced in #30967)

Steps To Reproduce

there are three factors caused this problem

1. deep in props there is a reference to host window or document object
2. google reCAPTCHA is in use. it mounts a iframe and inject the iframe reference to document

3. react 19.2.0 tries to recursively read props object and access `.$$typeof`

The current behavior

Throwing error

The expected behavior

Not to throw error

[github-actions]

This issue has been automatically marked as stale. If this issue is still affecting you, please leave any comment (for example, "bump"), and we'll keep it open. We are sorry that we haven't been able to prioritize it yet. If you have any new additional information, please include it with your comment!

[ericj-canva]

bump

[knownotunknown]

bump

[nhristova]

I seem to be getting the same error in development mode.
I open a new tab with const extWindow = window.open() and then pass this extWindow as a prop to child components.

It started when the app was upgraded from React 17 to 19.2.4. I tried 19.3.0-canary-46103596-20260305 but despite the #35679 fix, I still get the error. Looks like calling $$typeof in value when the value is an opaque window still throws.

It does not happen when third-party cookies are disabled and in an incognito window on Chrome (Version 144.0.7559.236).

[LordDashMe]

Encountered the issue with React 19.1.2