Skip to main content

Messenger SDK iframe sandbox triggers Chromium warning

The hosted Messenger SDK creates the "Featurebase live chat" iframe with src="about:blank" and a sandbox containing both allow-scripts and allow-same-origin, which makes Chromium log a sandbox-escape warning on every authenticated application page.

Reproduced with featurebase-js@1.0.3 using the documented React provider; the Messenger works but the warning appears consistently, and the package exposes no supported sandbox override.

Move the iframe document to a dedicated cross-origin URL or revise the sandbox configuration at the SDK level rather than requiring DOM mutation of the generated iframe.

Post type
✨ Other
What part of Help Desk?

Log in to comment and vote

No comments yet

Be the first to share your thoughts.