It is using iframes, that can be sanboxed in many ways. The security policy apply for external domains, if declared in header. It is a way to create a whole val

It is using iframes, that can be sanboxed in many ways. The security policy apply for external domains, if declared in header. It is a way to create a whole valid DOM quickly, it is identical as creating it by hand. Then we can use window postMessage, or simply from the main document retrieve stuffs in the children DOM with like `frame007.contentDocument.documentElement...`