Someone types a lookalike address such as app.powerbi.com.example.net and the macro appears to accep

What you are seeing

Someone types a lookalike address such as app.powerbi.com.example.net and the macro appears to accept it.

#Why it happens

After the strict checks fail, there is a final loose fallback that tests whether the hostname merely contains an allowed host name rather than exactly matching it, so a lookalike hostname can pass that last check.

#What to do

In practice the browser refuses to load it, because the app only permits frames from app.powerbi.com and app.fabric.microsoft.com. The reader sees an empty frame rather than the lookalike site. Still, only paste addresses copied from Power BI itself, and treat an empty frame on an odd-looking address as a rejected URL.

#Related

Found it? Good.