HTML 5 enhances iFrame security through the sandbox attribute

Currently, the Web Hypertext Application Technology Working Group (WHATWG) is Working with W3C to establish the HTML 5 standard. In the past three months, this task has entered the "Last Call" phase of WHATWG. One of the biggest changes during this period is the sandbox attribute of the iframe element. The sandbox attribute prevents untrusted Web pages from performing certain operations.

Ian Hickson, editor of the HTML 5 specification, talked about the benefits of sandbox, which can prevent the following operations:
Access the DOM of the parent page (technically, this is because iframe has become a different source than iframe of the parent page)
Execute scripts
Embed your own forms or manipulate forms through scripts
Read/write of cookies, local storage, or local SQL database
The revision history page of HTML 5 also mentions other features of sandbox:
Disable plug-ins
Forbid navigation of other browsing contexts
Disable the pop-up window and mode dialog box
IFrames is notorious for security issues, mainly because iFrames is often used to embed third-party content, while the latter may perform some malicious operations. Sandbox enhances the security of iFrames by limiting the operations permitted by the embedded content. This method separates the sandbox content from the parent page, thus limiting the permission of the content to be embedded.

The MIME type of sandbox is text/html-sandboxed. Hickson said:
Text/html-sandboxed MIME type ensures that the user does not access Untrusted content. It contains two parts: First, if the user accesses the page directly, the browser cannot render those pages with the text/html-sandboxed MIME type. Currently, all browsers support this feature. These browsers will download the page tag but will not render the page. Secondly, browsers that support the sandbox attribute need to render iframes with the text/html-sandboxed MIME type (but restricted by the permissions set in the sandbox attribute). So far, no browser has implemented this, this is also true for Google Chrome (it renders the parent page, but downloads the iframe content instead of rendering it in iframe ). Therefore, this technology cannot be used yet, unless Google updates Chrome to support this technology (theoretically, other browser vendors will implement this technology after implementing support for the sandbox attribute, let's wait and see ).
Currently, only Google Chrome 4.0 uses sandbox, and Firefox, IE8, and Safari have not yet implemented this, but I believe these browsers will be implemented soon. There are many things around the HTML 5 <video> element. Google implements it through the H.264 standard, while other browsers use different standards or are not implemented yet. But this does not happen here, because every browser can freely decide how to implement sandbox internally. But even if all mainstream browsers adopt sandbox tomorrow, many developers and content managers cannot use it immediately, because there are so many legacy browsers that will ignore this attribute, therefore, the safe solution is to adopt conventional security measures to protect iFrame.