What's the point of forbidding a sandboxed iframe with allow-scripts and allow-same-origin?

As discussed in the previously mentioned thread, this applies only to the cases when the iframe and the parent page shares the same origin.

Only then you can access parent window from the iframe (but since you are loading your own origin page, it’s considered safe, unless you are hacking yourself :slight_smile:).

If you load any other origin page in the iframe, you can’t access the parent anymore.

The documentation may have been written long ago, when such restrictions didn’t existed. We should update it.