Open the link.
Risk stays contained.
Utilvo Sandbox opens any suspicious link inside a fully isolated, monitored preview — no cookies, no popups, no exfiltration. Whatever the page tries to do, it never reaches your real browser.
Works in Chrome, Edge & Brave · Not yet on the Web Store — see why below
Open a Link
ActivePaste a suspicious URL — it opens in an isolated preview with 30+ protection layers.
Faithful recreation of Sandbox's real popup — click the icons on the left to explore.
What containment actually looks like
Watch the page get contained, live
Every preview opens inside a dedicated tab showing exactly how many protections are active, and a running count of everything they've stopped.
- Nothing loads on your real device until you open it here
- A live threat level, from Safe to Critical
- One click to the full Control Panel, mid-preview
Basic isolation. Best compatibility with modern web apps.
Blocks tracking & hardware access. Recommended.
Total lockdown. Guarantees maximum containment.
One preset for compatibility, one for lockdown
Switch levels right from the popup — no need to open settings. Or drop into the full Control Panel and toggle any of the 30+ individual protections yourself.
- Low — best compatibility with modern web apps
- Medium (recommended) — blocks tracking & hardware access
- Strict — total lockdown, maximum containment
Every blocked attempt, logged live
A DevTools-style panel streams every intercepted call in real time — so you see exactly what the link tried to do, not just that it was "risky."
- Exfiltration attempts — third-party fetch/XHR/beacon calls, with the destination domain.
- Cryptojacking — WebAssembly compiled before it can mine.
- Clipboard hijacking — a silent read/write on what you copied.
- Threat scoring — an automatic classification the moment a pattern emerges.
Faithful recreations of Sandbox's real UI — not placeholder mockups.
Everything running underneath
No feature here is aspirational — each one maps to actual code.
Locked Sandbox Frame
A hardened iframe with no top-level navigation and no popups — the page inside can never redirect your real tab or spawn real windows.
Cookie & Storage Isolation
Cookies, localStorage, sessionStorage, and IndexedDB stay scoped to the preview — never your real browser profile.
Exfiltration Blocking
Fetch, XHR, WebSocket, and beacon requests to any domain other than the one you're previewing are blocked at the network level.
Fingerprinting Protection
Canvas and audio fingerprinting return neutral output, and the user agent is spoofed so trackers can't build a profile.
Hardware Lockdown
Camera, microphone, geolocation, Bluetooth, USB, and serial access are all denied before the page can even ask.
Cryptojacking & WebAssembly Block
WebAssembly compilation is stopped cold — the exact mechanism silent, in-browser crypto miners depend on.
Clipboard-Hijack Protection
Stops scripts that silently swap what you just copied — a crypto address, a password — before you paste it somewhere real.
Auto-Wipe on Close
Closing the containment tab wipes that origin's cookies, storage, and cache completely — nothing lingers in your real profile.
Live Threat Log
Every blocked attempt streams into a DevTools-style panel in real time, with an automatic risk score and threat classification.
Three Protection Presets
Low, Medium, or Strict — or fine-tune all 30+ individual protections yourself from the full control panel.
Popup & Redirect Blocking
window.open, target="_blank" popups, meta-refresh redirects, and forced downloads are all cancelled before they fire.
WebRTC IP-Leak Protection
WebRTC is disabled so a malicious page can't discover your real IP address, even behind a VPN or proxy.
Not on the Web Store yet — here's why that's fine
Sandbox ships straight to you instead of waiting on store review — four clicks, no restart.
Download the extension
Grab the .zip package below — no Chrome Web Store account or install fee.
Unzip it locally
Extract the archive to any folder and keep it there — Chrome loads the extension from this folder.
Open chrome://extensions
Enable "Developer mode" using the toggle in the top-right corner.
Load unpacked
Click "Load unpacked," select the folder. Sandbox is ready immediately — no restart needed.
Sandbox vs. just opening the link
The real comparison isn't against other tools — it's against clicking it in a normal tab.
Privacy, in two sentences
Sandbox contacts no Utilvo server at all. The isolated tab talks directly to whatever site you're previewing — same as any browser tab — while the extension's own code strips headers and intercepts APIs entirely on your device.
With Clear Storage on Close enabled, every trace the preview left — cookies, storage, cache — is wiped from your real profile the instant you close the tab.
Frequently asked questions
Is it 100% safe to open any malicious link in the sandbox?
The preview runs inside a locked-down frame with no top-level navigation or popups allowed, so the page can never take over your real tab or spawn real windows. Nothing is ever 100% risk-free, so avoid entering real credentials or personal data into a page you're only previewing.
Why does a site look broken or unstyled inside the sandbox?
Some protections — especially Strict mode, or Block Third-Party Requests — intentionally stop a page from loading parts of itself to prevent tracking and exfiltration. Switch to Medium or Low protection for better compatibility.
What's the difference between Low, Medium, and Strict?
Low favors compatibility with modern web apps. Medium (recommended) blocks tracking, fingerprinting, and hardware access while keeping most sites usable. Strict is total lockdown — maximum containment, but many sites will only partially render.
Can I use it to browse my own logged-in accounts, like Twitter or Facebook?
No — and this is by design, not a bug. Major platforms deliberately refuse to render inside any iframe when they detect a real, authenticated session, specifically to protect your account from clickjacking attacks. Utilvo Sandbox is built for previewing untrusted, unfamiliar links — not for browsing accounts you're already logged into.
Does closing the tab delete everything it did?
Yes, if Clear Storage on Close is enabled — it is by default in Medium and Strict. Cookies, localStorage, IndexedDB, and cache created by the previewed origin are wiped the moment its tab closes.
Does it need an account or subscription?
No — every feature described on this page is free, runs entirely on your device, and needs no account, subscription, or upsell.
Stop guessing if a link is safe. Just open it contained.
Free, local-first, and ready in under a minute — no Chrome Web Store account, no signup.