Frontend & browser·Browser security
you embedded untrusted content and stripped its ability to run scripts, submit forms or navigate the top window.
iframe sandbox
Also calledsandbox attribute
An attribute that removes capabilities from framed content and puts it in an opaque origin, with permissions added back one token at a time. It is the standard containment for user-supplied HTML, previews and third-party widgets. Granting both `allow-scripts` and `allow-same-origin` to content from your own origin hands back the ability to remove the sandbox, which defeats the point.