Add clarifying note to using sandbox with iframe tag

files/en-us/web/html/element/iframe/index.md

@@ -125,6 +125,10 @@ This element includes the [global attributes](/en-US/docs/Web/HTML/Global_attrib
     > - When the embedded document has the same origin as the embedding page, it is **strongly discouraged** to use both `allow-scripts` and `allow-same-origin`, as that lets the embedded document remove the `sandbox` attribute — making it no more secure than not using the `sandbox` attribute at all.
     > - Sandboxing is useless if the attacker can display content outside a sandboxed `iframe` — such as if the viewer opens the frame in a new tab. Such content should be also served from a _separate origin_ to limit potential damage.
 
+    > **Note:**
+    >
+    > - When opening a link from an embedded page with the `sandbox` attribute, the Auxiliary Window is restricted to the same `sandbox` values unless `allow-popups-to-escape-sandbox` is included.
+
 - `src`
   - : The URL of the page to embed. Use a value of `about:blank` to embed an empty page that conforms to the [same-origin policy](/en-US/docs/Web/Security/Same-origin_policy#inherited_origins). Also note that programmatically removing an `<iframe>`'s src attribute (e.g. via {{domxref("Element.removeAttribute()")}}) causes `about:blank` to be loaded in the frame in Firefox (from version 65), Chromium-based browsers, and Safari/iOS.
 - `srcdoc`