Starting with Release 21.3, only users with strong authentication, such as through MFA
with Account Manager, can include objects embedded with iframe, object, applet, or embed tags
into HTML attributes. A new quota implemented in Release 21.2, api.object.EmbeddedObjectInHTMLAttributeUserWithoutStrongAuth, helps you to
prepare for the upcoming 21.3 restriction. Use the new quota to see if you have objects
embedded in HTML attributes and if so, make sure that users who embed such objects use strong
authentication.
How: Also starting with Release 21.2, changes to HTML attributes that include embedding objects are recorded in the security logs.
The restrictions on embedded objects in HTML attributes are similar to restrictions previously implemented for JavaScript in HTML attributes.