Bisected to 5d8010e1fc081481d0646618e700b51a4699ab4c
"Reenable feature policy control over fullscreen"
Landed in 62.0.3189.0

   Same origin iframes by default have the same ability to use 
   fullscreen as their parent frame.

Apparently the spec itself is in the process of being updated and Chrome implements the new behavior:
https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use

Thanks for the speedy reply :)

We noticed that using the "sandbox" attribute will disable the iframe from going full screen. But this also disable the use of Window.postMessage()

Is there a way to disable an iframe from going full screen, while still being able to use Window.postMessage()?

Able to reproduce this issue on Windows 10, Mac OS 10.12.6 and Ubuntu 14.04 on the latest Canary 68.0.3400.0 and latest Stable 66.0.3359.117 as per the original comment.

Bisect Information:
===================
Good Build: 62.0.3188.0
Bad Build : 62.0.3189.0

As per comment #1, the CL which caused this issue is 
Reviewed-on:  https://codereview.chromium.org/2898503002

iclelland@ Please check and confirm if this issue is related to your change, else help us in assigning to the right owner.

Thanks.

(Marking WAI as this is the intended behaviour as of M62)

Re: #2 -- yes, you can disable fullscreen specifically with feature policy. Adding the attribute 

    allow="fullscreen 'none'"

to the iframe should cause fullscreen to be blocked in that frame.

<iframe src="http://some.example.com" allow="fullscreen 'none'"></iframe>

You can still postMessage, and do everything else that would otherwise be allowed in that frame. Only the one feature will be blocked.

Of course, if you don't trust the frame not to abuse fullscreen, it should really be sandboxed, or hosted on a different origin than the main page at least: A same-origin frame can do things like changing the markup in the parent page, or abusing the parent's ability to use fullscreen in order to fullscreen its own <iframe> element.