diff --git a/testing/web-platform/tests/credential-management/credentialscontainer-frame-basics.https.html b/testing/web-platform/tests/credential-management/credentialscontainer-frame-basics.https.html
new file mode 100644
index 0000000000000..89f9bb6920859
--- /dev/null
+++ b/testing/web-platform/tests/credential-management/credentialscontainer-frame-basics.https.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>navigator.credentials frame tests</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<body></body>
+<script>
+  promise_test(async t => {
+    let PROBE_CREDENTIALS = "<script>window.parent.postMessage(String(navigator.credentials), '*');<\/script>";
+
+    let frame = document.createElement("iframe");
+    const loadPromise = new EventWatcher(t, frame, "load").wait_for("load");
+    frame.src = "data:text/html," + PROBE_CREDENTIALS;
+    document.body.append(frame);
+    await loadPromise;
+
+    let eventWatcher = new EventWatcher(t, window, "message");
+    const { data } = await eventWatcher.wait_for("message");
+    assert_equals(data, "undefined");
+  }, "navigator.credentials should be undefined in documents generated from `data:` URLs.");
+</script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/webauthn/createcredential-nested-frame.https.html b/testing/web-platform/tests/webauthn/createcredential-nested-frame.https.html
new file mode 100644
index 0000000000000..ca5fdb8aa9ca8
--- /dev/null
+++ b/testing/web-platform/tests/webauthn/createcredential-nested-frame.https.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>WebAuthn credential.create() in a nested frame</title>
+<link rel="help" href="https://w3c.github.io/webauthn/#publickey-credentials-create-feature">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/resources/common-inputs.js"></script>
+<script src=helpers.js></script>
+
+<body></body>
+<script>
+
+  standardSetup(function () {
+    "use strict";
+
+    const CREATE_CREDENTIALS = `
+      navigator.credentials.create({
+        publicKey: {
+          challenge: Uint8Array.from([]),
+          rp: { name: "rp" },
+          user: { id: Uint8Array.from([]), name: "marisa", displayName: "Marisa" },
+          pubKeyCredParams: [{type: "public-key", alg: -7}],
+        }
+      }).then(c => window.parent.postMessage("OK", "*"))
+        .catch(e => window.parent.postMessage("Error: " + e.toString(), "*"));
+      `;
+
+    promise_test(async t => {
+      const frame = document.createElement("iframe");
+      const loadPromise = new EventWatcher(t, frame, "load").wait_for("load");
+      document.body.append(frame);
+      await loadPromise;
+      frame.contentWindow.location = "javascript:" + CREATE_CREDENTIALS;
+
+      const messageWatcher = new EventWatcher(t, window, "message");
+      const { data } = await messageWatcher.wait_for("message");
+      assert_equals(data, "OK");
+    }, "navigator.credentials.create({publicKey}) in a javascript url should should succeed.");
+
+    promise_test(async t => {
+      let frame = document.createElement("iframe");
+      const loadPromise = new EventWatcher(t, frame, "load").wait_for("load");
+      frame.srcdoc = "";
+      document.body.append(frame);
+      await loadPromise;
+      frame.contentWindow.eval(CREATE_CREDENTIALS);
+
+      let eventWatcher = new EventWatcher(t, window, "message");
+      const { data } = await eventWatcher.wait_for("message");
+      assert_equals(data, "OK");
+    }, "navigator.credentials.create({publicKey}) in srcdoc should succeed.");
+
+    promise_test(async t => {
+      let frame = document.createElement("iframe");
+      const loadPromise = new EventWatcher(t, frame, "load").wait_for("load");
+      frame.src = "about:blank";
+      document.body.append(frame);
+      await loadPromise;
+      frame.contentDocument.write("<script>" + CREATE_CREDENTIALS + "<\/script>");
+
+      let eventWatcher = new EventWatcher(t, window, "message");
+      const { data } = await eventWatcher.wait_for("message");
+      assert_equals(data, "OK");
+    }, "navigator.credentials.create({publicKey}) in about:blank embedded in a secure context should succeed.");
+  }, {
+    protocol: "ctap2_1",
+    hasUserVerification: true,
+    isUserVerified: true,
+  });
+
+</script>
\ No newline at end of file
