Sandboxed iFrame with `target=“_blank”` doesn't open new tab or window

Question

I just created an iFrame with the sandbox attribute. Whenever I try to open a link with target="_blank" or target="_top" or when I try to use window.open() nothing happens.

Here's my code:

<iframe src="http://www.google.com/"
  sandbox="allow-top-navigation allow-same-origin allow-forms allow-scripts">

    Apparently your browser doesn't support iFrames!

</iframe>

Answer 1

Apparently Chrome allows an undocumented sandbox property called allow-popups to be set. The property is also supported in Firefox and is a Candidate Recommendation on W3C .

allow-popups lets the sandboxed frame open links in new windows or tabs and, it appears, when the frame tries to open a link with target="_top" the browser will open the URL in a new tab or window.