User-initiated shell ran via HTTPS CAPTCHA at 2:14 p.m. Tuesday, exposing browser blind spot and breaking session attribution ...
I found this tucked away and turned it on immediately.