Iframe sandboxing is a browser containment feature that limits what embedded content can do inside an <iframe>. By default, a sandboxed iframe is treated as more restricted than normal page content: it may be blocked from running scripts, submitting forms, opening pop-ups, navigating the top page, or reading the parent page’s data unless specific permissions are added.
In cyber security, sandboxing is used to reduce the risk of loading untrusted or semi-trusted content such as third-party widgets, advertisements, previews, or user-generated HTML. If an embedded component is compromised, the sandbox can help prevent it from stealing page data, redirecting visitors, or reaching other browser features. It is not a full defense on its own, but it is a valuable layer alongside Content Security Policy, origin isolation, and strict allowlists for external resources.