Same-origin iframe: sandbox / sandbox=allow-scripts / unsandboxed
cross-origin iframe: sandbox / sandbox=allow-scripts / unsandboxed
srcdoc iframe: sandbox / sandbox=allow-scripts / unsandboxed
data:-URL iframe: sandbox / sandbox=allow-scripts / unsandboxed
blob:-URL iframe: sandbox / sandbox=allow-scripts / unsandboxed