Skip to content
install

TWO BUILDS9 browsers

Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build

diagnostic · one of 29free, no counter

Iframes

What is inside the frames on this page, and what can they do?

A frame with no `sandbox` attribute has full access; a frame with an empty one has the tightest sandbox there is. Those two states look almost identical in the markup and are opposites, which is the single most common misreading of this attribute - so they are drawn as opposites here, along with which capabilities an `allow` list hands over.

Reach itPress ⌘+K on any tab and type iframes.Ctrl+Kon Windows and Linux

Every frame on the page, who owns it and what it is allowed to do
readsframe elements and their attributes
writesnothing
sendsnothing
no sandboxfull access - drawn as the opposite of an empty one
alloweach capability named, never summarised
partya filter, never a grouping
planfree
Add LoupeKit- opens the list of browsers it can be installed in

TWO BUILDS9 browsers

Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build

in the panel · free, no counter

section#about

What this actually is

On any page with a third-party embed, before adding one, and as a security reading: an embed with `allow-scripts allow-same-origin` can remove its own sandbox, which is worth knowing before it ships.

section#asked

Asked about this diagnostic

Why is "no sandbox attribute" worse than an empty one?

Because the attribute’s absence means no restrictions at all, and an empty attribute means every restriction. They are opposite ends, and treating a missing attribute as "nothing set" is how a full-access frame reads as harmless.

What does allow-scripts with allow-same-origin do?

Together they let the framed document reach into its own sandbox and remove it. Each token is safe on its own and the pair is not, which is why the tokens are listed rather than counted.

Can it see inside a cross-origin frame?

No, and neither can the page. What it loaded is read from the resource timing entries on this side; the document inside belongs to another origin.

Why is first-party or third-party a filter rather than a heading?

Because a page usually has a few of each and grouping them separates two frames doing the same job. The filter is there when the question is specifically about third parties.

Add LoupeKit- opens the list of browsers it can be installed in

TWO BUILDS9 browsers

Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build

63 of these · no host permissions · three free audits