Allow embedded scripts without granting same-origin access.
HTML: Grant only allow-scripts so the sandboxed document retains an opaque origin.
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Example</title>
</head>
<body>
<iframe title="Isolated script" sandbox="allow-scripts" srcdoc="<p id="result"></p><script>try { parent.document.body; document.querySelector("#result").textContent="Accessible"; } catch { document.querySelector("#result").textContent="Isolated"; }</script>"></iframe>
</body>
</html>Expected output EXAMPLE
The “#result” element displays “Isolated”.
Details
Save as example.html and open in a modern browser. The output describes browser behavior verified with DOM and interaction assertions. Grant only allow-scripts so the sandboxed document retains an opaque origin.
Do not add allow-same-origin casually to same-origin untrusted embeds; sandbox policy must match the content being isolated.
Tested on Ubuntu 24.04.5 LTS · · Chromium 141.0.7390.37 · libc6 2.39-0ubuntu8.9; Playwright 1.56.0
Test inputs, results and environment
The exact published code ran in a dedicated Linux test container with prepared inputs. Unprivileged snippet process, external networking disabled, read-only root filesystem, and a fresh temporary working directory. Fixtures and output records are isolated from the application database. Testing covers this example and its stated checks, not every input, operating system, or runtime version. The Linux container shares its host's kernel; this is not a native Windows test.
- Architecture / host kernel
- x86_64 / 6.18.54.1-microsoft-standard-WSL2
- Snippet identity / locale
- uid=65534, gid=65534 (unprivileged) / C.UTF-8
- Interpreter invocation
Chromium: open example.html; execute the published browser assertions- Container image ID
sha256:32dc2d998158b6554c99b73b533f423696a0f3e31e8cbea9db10b5eee9a2fadd- Code SHA-256
49c79399890900acafea3f44114cf58149a4d14b2c2ae82e1be1910e5fedc3c9- Dependencies
- libc6 2.39-0ubuntu8.9; Playwright 1.56.0
Test input setup
These are the prepared inputs used by the test harness. See Details above for the prerequisites and how to run this example.
# No input files required.
Observed standard output
Expected output describes the rendered page. The standard-output record below is the browser test harness receipt; the additional assertions check the result and interactions.
Allow embedded scripts without granting same-origin access: browser checks passed.
Exit code: 0. Standard error: empty. Validation: Shape/content assertions. System-dependent values above are one recorded run.
Additional assertions that passed
Checks recorded by the test harness. Where Python assertions are shown, browser cases use Playwright and simulator cases may inspect pin transitions: result.stdout is captured output, work is the temporary directory, and Path is pathlib.Path. The harness also imports json and csv.
assert await page.frame_locator('iframe').locator('#result').inner_text()=='Isolated'