The only really safe way to approach this would be to give the 3rd party code an off-domain iframe with the sandbox attributes configured. You can still measure

The only really safe way to approach this would be to give the 3rd party code an off-domain iframe with the sandbox attributes configured. You can still measure the DOM content size from the parent page to resuze the iframe to certain limits to integrate it more seamlessly into your app UI. Depending on the level of exposure and trust between your users, you’ll need to watch out for impersonation/phishing and clickjacking attempts in the iframe. Ideally you can lock down the frame so it can’t make any web requests at all (which implies no image loading), which means there’s no way to exfiltrate data from the frame if, for example, they convinced the user to enter their password into a fake password form. The main way to restrict what kinds of resources an iframe can request is via content-security-policy, which you can use to turn off all 3rd party images, scripts, etc. https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/csp https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameE... https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP You should also enable these other sandbox attributes and disable access to privacy sensitive DOM APIs like the webcam etc: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if... https://developer.mozilla.org/en-US/docs/Web/Security/IFrame_credentialless https://developer.mozilla.org/en-US/docs/Web/Security/IFrame... https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy#iframes https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Pe...