The YouTube-only field becomes a general embed address, made natively only for the frame hosts
X's chat CSP allows (www.youtube.com, player.vimeo.com, w.soundcloud.com) and re-checked in the
page. A link to an image previews the image itself. YouTube's thumbnail comes as data.
X's web chat shows a link as a bare card. An X tab on a chat page may now ask native code
(link_preview, x-capture only, chat pages only) for one link's preview. Native code fetches it:
https and public hosts only (addresses checked and pinned), never X's hosts, no cookies or
referrer, redirects re-checked, page head <= 512 KB, images <= 1.5 MB by magic bytes as data:,
30 fetches a minute, memory-only cache. Only the link leaves the page. On by default (owner,
2026-10-10).
