Configure exactly what a previewed page is allowed to do.
Basic isolation. Allows storage and interactive APIs to run modern web apps.
Blocks tracking and hardware access. Prevents most common threats.
Total lockdown. Breaks most sites but guarantees maximum containment.
Enforces strict isolation. Sites cannot track you or access your logged-in accounts.
Prevents persistent storage abuse across sessions.
Prevents sites from running background scripts that survive page closes.
Automatically wipes all sandbox storage when tab closes.
Prevents malicious sites from opening unexpected windows or spamming tabs.
Ensures the site cannot escape the sandbox and redirect your browser.
Prevents automatic page reloads that could bypass sandbox restrictions.
Prevents automatic file downloads that could install malware.
Actively strips anti-framing headers (X-Frame-Options, CSP, and Cross-Origin-*-Policy) so sites are forced to load inside the sandbox. Always on — without this, essentially nothing renders in the preview at all, so this toggle is currently informational rather than optional.
Prevents sites from detecting they're sandboxed and breaking out.
Disables postMessage between frames to prevent data leakage.
Prevents persistent two-way channels that could exfiltrate data in real-time.
Prevents IP address leaks that bypass VPNs and proxies.
Prevents hidden crypto mining and complex exploits that bypass JavaScript sandboxes.
Workers run in their own background thread with no DOM access — network and mining protections above can't reach code running inside one, so this blocks their creation outright.
Blocks AJAX/beacon-style requests (fetch, XHR, WebSocket, pings) to any domain other than the one you're testing. Images, scripts, and stylesheets from the page's own CDN still load normally — otherwise most real sites, YouTube included, would render as a blank page.
Prevents loading insecure HTTP resources on HTTPS pages.
Prevents unauthorized recording through your devices.
Prevents sites from accessing your real physical location.
Prevents sites from communicating with connected hardware devices.
Prevents motion tracking that could identify you or infer keystrokes.
Prevents push notification spam and phishing attempts via fake alerts.
Prevents malicious scripts from replacing copied crypto addresses or passwords.
Prevents sending your credentials to the sandboxed site.
Prevents sites from taking over your entire screen for phishing purposes.
Prevents sites from creating a unique identifier based on your GPU rendering.
Prevents identification through your sound card's unique processing signature.
Prevents fingerprinting via your battery level and charging status.
Masks your browser, OS, and version from the sandboxed site.
Prevents sites from initiating unauthorized payment flows.
Prevents sites from accessing your saved passwords via the browser's password manager.
Prevents sites from knowing when you're away from your computer.
Prevents sites from keeping your screen on to drain battery or hide activity.
Re-applies iframe sandbox attribute every 500ms to prevent removal via JavaScript.
A completely isolated, virtualized environment inside your browser to safely analyze and interact with potentially malicious websites, phishing links, and suspicious documents without risking your real system.