From 780443b280b8bd3629c71ac63a1ccc913d2a429d Mon Sep 17 00:00:00 2001
From: varjolintu <sami.vanttinen@protonmail.com>
Date: Sat, 23 Aug 2025 08:59:29 +0300
Subject: [PATCH] Do not allow sandboxed iframes

---
 keepassxc-browser/content/keepassxc-browser.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/keepassxc-browser/content/keepassxc-browser.js b/keepassxc-browser/content/keepassxc-browser.js
index 881c113..b021893 100755
--- a/keepassxc-browser/content/keepassxc-browser.js
+++ b/keepassxc-browser/content/keepassxc-browser.js
@@ -1028,6 +1028,13 @@ kpxc.reconnect = async function() {
 
 const isIframeAllowed = async function() {
     sendMessage('iframe_detected', false);
+
+    // Don't allow sandboxed iframes
+    if (self.origin === null || self.origin === 'null') {
+        logDebug('Error: Sandboxed iframes are not allowed');
+        return false;
+    }
+
     try {
         // Check for Cross-domain security error when inspecting window.top.location.href
         const currentLocation = window.top.location.href;