From 5fa7b95e19384743a1db636c8f140a469d6c2b54 Mon Sep 17 00:00:00 2001
From: ReinaSweet <reinaraneko@gmail.com>
Date: Sat, 18 Jul 2026 03:02:41 -0700
Subject: [PATCH] Add a sandbox property to the renderer iframe to prevent any
 script execution

But still allow for print (via allow-modals), same-origin downloads, and top navigation (so that links work).
---
 client/homebrew/brewRenderer/brewRenderer.jsx | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/homebrew/brewRenderer/brewRenderer.jsx b/client/homebrew/brewRenderer/brewRenderer.jsx
index 976f8c9c1..bc66fa9b5 100644
--- a/client/homebrew/brewRenderer/brewRenderer.jsx
+++ b/client/homebrew/brewRenderer/brewRenderer.jsx
@@ -352,6 +352,7 @@ const BrewRenderer = (props)=>{
 				style={{ width: '100%', height: '100%', visibility: state.visibility }}
 				contentDidMount={frameDidMount}
 				onClick={()=>{emitClick();}}
+				sandbox="allow-same-origin allow-modals allow-top-navigation"
 			>
 				<div className='brewRenderer'
 					onKeyDown={handleControlKeys}