Is it a bug? How to prevent that window?

Please observe the browser console log when this occurs and report back.

@cilefen, please open any of the above links to see the issue. The browser console shows the

404
Not Found

for favicon.ico file.

SA-CORE-2018-003 was entirely inside CKEditor. What is the markup around that window?

Again, please open any of the links listed above.

@AltaGrade,

The page you're seeing is an ajax response, if you visit any controller that returns an AjaxResponse object, I expect this is exactly what you'd encounter (as is the case for the links you've sent).
The goal of this response is to add a 'status message' with a given error/notice/.. notification.

Why you're seeing that window instead of the ajax response "doing its thing" is unclear, the error message in that response however states:
An unrecoverable error occurred. The uploaded file likely exceeded the maximum file size (2 MB) that this server supports.\n

Is javascript turned off in your browser? That might be one explanation as to why you would see this page instead of the HTML content being prepended.

Or perhaps because there's no selector to prepend the HTML content to:
"selector":null

Again, please open any of the links listed above.

I’m sorry if this sounds odd but I don’t visit or log into sites if suggested in this issue queue for security reasons.

I am closing this issue due to inactivity. Reopen it as necessary.