1
HTML/CSSIntermediate#html#performance
The sandbox attribute restricts an embedded iframe's capabilities by default (no scripts, forms, popups); adding tokens like allow-scripts or allow-same-origin selectively re-enables specific permissions, improving security when embedding third-party content.
<iframe src="widget.html" sandbox="allow-scripts allow-forms"></iframe>