popups triggered directly by a click are allowed, because otherwise you'd break e.g. Facebook login, to pick a major example. Basically every browser does this

popups triggered directly by a click are allowed, because otherwise you'd break e.g. Facebook login, to pick a major example. Basically every browser does this. Quite a few are probably undesirable still, but otherwise people simply claim the browser is broken for their normal site X and abandon it entirely for a browser that doesn't break site X.