Don't allow opening popups (and other sensitive operations) on touch events which don't correspond to a tap from inside of cross-origin iframes (Chrome 52).
Docs: https://github.com/WICG/interventions/issues/13 https://developers.google.com/web/updates/2016/06/chrome-52-deprecations#block-pop-ups-from-cross-origin-iframes-during-touch-events-except-during-a-tap-gesture