Iframes use sandbox attribute

An iframe without a sandbox attribute inherits the full capabilities of the embedding page: it can run scripts, submit forms, navigate the top frame, and access storage. A compromised or malicious embedded resource (ads, widgets, user-generated embeds) can exploit unrestricted iframes to navigate your page to a phishing URL, submit forms on the user's behalf, or read cross-origin storage if the embed is same-site. CWE-1021 (Improper Restriction of Rendered UI Layers) applies directly. OWASP A05 identifies unsandboxed iframes as a configuration gap that gives embedded third-party content unwarranted trust.

Add the sandbox attribute to every <iframe> element. Start with no permissions and add only those the embed actually requires.

{/* Video embed — needs scripts only */}
<iframe src="https://player.example.com/embed/123" sandbox="allow-scripts" />

{/* Interactive widget needing forms */}
<iframe src="https://widget.example.com" sandbox="allow-scripts allow-forms" />

{/* Same-origin embed needing full interaction */}
<iframe src="/embed/preview" sandbox="allow-scripts allow-same-origin allow-forms" />

Avoid allow-same-origin combined with allow-scripts for cross-origin iframes — that combination effectively defeats sandboxing by letting the embed escape via same-origin DOM access.

• ID: iframe-sandbox

• Severity: low

• What to look for: Search all components and page files for <iframe> elements. For each, check whether the sandbox attribute is present with appropriate restrictions. The sandbox attribute restricts what the iframe can do — forms, scripts, popups, navigation, etc. Count all iframes found.

• Pass criteria: 100% of iframes have the sandbox attribute. Report: "X of Y iframes have sandbox attribute." Acceptable sandbox values allow only the minimum required permissions (e.g., sandbox="allow-scripts allow-same-origin" for interactive embeds).

• Fail criteria: Any iframe element lacks the sandbox attribute.

• Skip (N/A) when: No iframes found in any component.

• Detail on fail: "X of Y iframes lack sandbox attribute — embedded content has full page capabilities" or "Iframe in EmbedPlayer component has no sandbox restrictions"

• Remediation: The sandbox attribute restricts what embedded content can do. Start with no permissions and add only what is needed:

  {/* Restrictive: only allow scripts */}
  <iframe src="..." sandbox="allow-scripts" />
  
  {/* For interactive embeds that need forms */}
  <iframe src="..." sandbox="allow-scripts allow-forms" />
  
  {/* For same-origin embeds needing full interaction */}
  <iframe src="..." sandbox="allow-scripts allow-same-origin allow-forms" />
  

  Never use an empty sandbox="" if the embed needs any functionality — it blocks everything including scripts.