What's the point of forbidding a sandboxed iframe with allow-scripts and allow-same-origin?

[juraj.masiar]

Actually, this should be no longer an issue in the review process.

The sandbox attribute cannot be removed from the nested page inside iframe if the loaded page comes from a different host.
More info here:

Can someone explain the issue behind the rule: "Sandboxed iframes with attributes ‘allow-scripts’ and ‘allow-same-origin’ are not allowed for security reasons."

If I’m reading the docs right, the issue would be only if the host page and iframe page were coming from the same origin: [image] So why loading iframe inside addon page with a sandbox attribute is a problem? Can someone help me build a proof of concept that would allow code inside the iframe remove its “sandbox” attribute? Because as far as I know, the CORS will prevent it: (async () => { /** * Proof of concept - removing "sandbox" attribute using javascript running INSIDE the iframe…