Browser Isolation Verification: Sandbox allow-scripts (Omitting allow-same-origin). Strict postMessage origin segregation.
allow-scripts
allow-same-origin
postMessage