'HTTPS security is compromised by res://ieframe.dll' error in IE

Question

I've noticed that I get this string of errors in IE in my SharePoint Online sites.

SEC7111: HTTPS security is compromised by res://ieframe.dll/forbidframing.htm
SEC7111: HTTPS security is compromised by res://ieframe.dll/ErrorPageTemplate.css
SEC7111: HTTPS security is compromised by res://ieframe.dll/errorPageStrings.js
SEC7111: HTTPS security is compromised by res://ieframe.dll/httpErrorPagesScripts.js
SEC7111: HTTPS security is compromised by res://ieframe.dll/red_x.png
SEC7111: HTTPS security is compromised by res://ieframe.dll/bullet.png
SEC7111: HTTPS security is compromised by res://ieframe.dll/background_gradient.jpg

Anyone know what causes this and/or how to fix?

I've seen similar posts in SO not related to SharePoint, but always get the same ones in my SP sites (compared to other files in other sites) so thought it might be worth a post here.

I have tried some of the solutions I have found, but haven't had any luck. I thought the most likely case would be something to do with Internet Security Options like this post mentions: https://stackoverflow.com/questions/11430904/ie9-res-ieframe-dll-error. I didn't have any luck with the answer there though.

Answer 1

My 100% uncustomized OOB Team Site shows all those too.

I've opened /_layouts/15/viewlsts.aspx page, set up Fiddler and it seems this one response from login.live.com is causing the described error being logged:

Response has X-Frame-Options: deny header. Citing a post at IEInternals:

If the X-FRAME-OPTIONS value contains the token DENY, browsers will prevent the page from rendering if it will be contained within a frame. For instance, if http://shop.example.com/confirm.asp contains a DENY directive, that page will not render in a subframe, no matter where the parent frame is located.

If the value contains the token SAMEORIGIN, the browser will block rendering only if the origin of the top-level browsing-context is different than the origin of the content containing the X-FRAME-OPTIONS directive. For instance, if http://shop.example.com/confirm.asp contains the X-FRAME-OPTIONS directive with the SAMEORIGIN token, the page may be framed by any page from the exact http://shop.example.com origin.

That header forces Internet Explorer to show this if login.live.com/login... is requested in subframe (and that makes sense, actually):

It seems all we can do is ignore those errors. I have no idea why login.live.com / outlook.com is even involved in O365.

---

UPDATE: I don't see this requests to live.com under other account in other organization. My first account email address has also a Microsoft Account associated with it, and I'm logged in Windows 10 under that Microsoft Account. That could be related. Could someone test this hypothesis?