Skip to content We're live on Product Hunt today Upvote
install

TWO BUILDS 9 browsers

Chrome from the Chrome Web Store Firefox from addons.mozilla.org Edge from Microsoft Edge Add-ons Brave takes the Chrome build Opera takes the Chrome build 4 more Chromium browsers: Arc, Vivaldi, Chromium, Opera GX the Chrome build

diagnostic · one of 36 free, no counter

Iframes

What is inside the frames on this page, and what can they do?

A frame with no sandbox attribute has full access; a frame with an empty one has the tightest sandbox there is. Those two states look almost identical in the markup and are opposites, which is the single most common misreading of this attribute - so they are drawn as opposites here, along with which capabilities an allow list hands over.

Reach it Press ⌘ + K on any tab and type iframes. Ctrl + K on Windows and Linux

Every frame on the page, who owns it and what it is allowed to do
reads frame elements and their attributes
writes nothing
sends nothing
no sandbox full access - drawn as the opposite of an empty one
allow each capability named, never summarised
party a filter, never a grouping
plan free
Add   LoupeKit - opens the list of browsers it can be installed in

TWO BUILDS 9 browsers

Chrome from the Chrome Web Store Firefox from addons.mozilla.org Edge from Microsoft Edge Add-ons Brave takes the Chrome build Opera takes the Chrome build 4 more Chromium browsers: Arc, Vivaldi, Chromium, Opera GX the Chrome build

in the panel · free, no counter

section#about

What this actually is

On any page with a third-party embed, before adding one, and as a security reading: an embed with allow-scripts allow-same-origin can remove its own sandbox, which is worth knowing before it ships.

section#asked

Asked about this diagnostic

Why is "no sandbox attribute" worse than an empty one?

Because the attribute’s absence means no restrictions at all, and an empty attribute means every restriction. They are opposite ends, and treating a missing attribute as "nothing set" is how a full-access frame reads as harmless.

What does allow-scripts with allow-same-origin do?

Together they let the framed document reach into its own sandbox and remove it. Each token is safe on its own and the pair is not, which is why the tokens are listed rather than counted.

Can it see inside a cross-origin frame?

No, and neither can the page. What it loaded is read from the resource timing entries on this side; the document inside belongs to another origin.

Why is first-party or third-party a filter rather than a heading?

Because a page usually has a few of each and grouping them separates two frames doing the same job. The filter is there when the question is specifically about third parties.

how to use iframes

  1. Open Iframes to list every frame the page carries.
  2. Read the sandbox value: absent means full access, empty means the tightest sandbox there is.
  3. Read each allow capability by name rather than as a summary.
  4. Treat allow-scripts allow-same-origin as a finding - a frame with both can remove its own sandbox.
Add   LoupeKit - opens the list of browsers it can be installed in

TWO BUILDS 9 browsers

Chrome from the Chrome Web Store Firefox from addons.mozilla.org Edge from Microsoft Edge Add-ons Brave takes the Chrome build Opera takes the Chrome build 4 more Chromium browsers: Arc, Vivaldi, Chromium, Opera GX the Chrome build

70 of these · no host permissions · three free audits