After reading https://developer.mozilla.org/en-US/docs/Web/API/Screen_Capture_API/Using_Screen_Capture I came across this statement

In order to function when Feature Policy is enabled, you will need the display-capture permission. This can be done using the Feature-Policy HTTP header or—if you're using the Screen Capture API in an , the element's allow attribute.

For example, this line in the HTTP headers will enable Screen Capture API for the document and any embedded elements that are loaded from the same origin:

Feature-Policy: display-capture 'self' If you're performing screen capture within an , you can request permission just for that frame, which is clearly more secure than requesting a more general permission:

<iframe src="https://google.net" allow="display-capture">
</iframe>

Does this mean that we can capture a video/audio stream of a given iframe on a page if we are able to modify the allow attribute? will it work for even cross origin?