The key is running the untrusted code in a cross-origin iframe so you can rely on the same-origin policies and `sandbox`[1]. You can control the code in a numb

The key is running the untrusted code in a cross-origin iframe so you can rely on the same-origin policies and `sandbox`[1]. You can control the code in a number of ways - loading a trusted shim that sets up a postMessage handler is pretty common. You can be careful and do that in a way that untructed code can't forge messages to look like their from the trusted code. Another way is to use two iframes to the untrusted origin. One only loads untrusted code, the other loads a control API that talks to the trusted code. You can then to the loading into the iframe with a service worker. This is how the Playground Elements work (they're a set of web components that let you safely embed a mini IDE for code samples) https://github.com/google/playground-elements https://github.com/google/playground-elements [1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...