25586 2014-05-06 22:10:35 +0000 In this example, a gadget from another site is embedded. The gadget has scripting and forms enabled, [...] 2014-07-29 20:40:53 +0000 1 1 1 Unclassified WHATWG HTML unspecified Other other RESOLVED NEEDSINFO http://www.whatwg.org/specs/web-apps/current-work/#the-iframe-element P3 normal Unsorted 1 contributor ian ian mike contributor oldest_to_newest 105249 0 contributor 2014-05-06 22:10:35 +0000 Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/the-iframe-element.html Multipage: http://www.whatwg.org/C#the-iframe-element Complete: http://www.whatwg.org/c#the-iframe-element Referrer: https://www.google.ca/ Comment: In this example, a gadget from another site is embedded. The gadget has scripting and forms enabled, and the origin sandbox restrictions are lifted, allowing the gadget to communicate with its originating server. The sandbox is still useful, however, as it disables plugins and popups, thus reducing the risk of the user being exposed to malware and other annoyances. Posted from: 192.156.112.151 User agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36 105330 1 ian 2014-05-07 18:35:48 +0000 If both allow-same-origin and allow-script are enabled, the iframe can just reach out and remove the sandbox attribute altogether. So it's not useful. 109528 2 ian 2014-07-29 20:40:53 +0000 Not sure what to do here.