Issue
When a Merge button is clicked from a Lightning record detail page, an error occurs if Clickjack Protection is enabled.
Disabling Clickjack Protection resolves the issue, but this is not recommended by Salesforce.
Root Cause
The Trusted Domain configuration includes only the vf.force.com domain, which applies only to Visualforce pages.
However, the Merge button is executed from a Lightning record page, which requires the parent Lightning domain to be allow-listed instead.
Resolution
Add the Lightning domain (not the VF domain) to Trusted Domains.
Why This Works
*.vf.force.com → Used only for Visualforce pages
*.lightning.force.com (or instance-specific Lightning URL) → Used for record pages and custom buttons
Salesforce enforces Clickjack protection based on the page where the action is invoked, not where the Visualforce code runs.