HTML Code
<!DOCTYPE html>
<html lang=en>
<head>
  <meta charset=UTF-8>
  <meta name=viewport content="width=device-width,initial-scale=1">
  <title>sandbox — JavaScript</title>
  <style>body{font-family:system-ui,sans-serif;margin:0;padding:1.5rem;background:#f8fafc;color:#334155;line-height:1.7}h1{margin:0 0 .75rem;font-size:1.25rem;color:#0f172a}iframe{width:100%;max-width:320px;height:100px;border:1px solid #cbd5e1;border-radius:6px;background:#fff}button{margin-top:.75rem;padding:.5rem 1rem;font:inherit;cursor:pointer;border-radius:6px;border:none;background:#2563eb;color:#fff}#status{margin-top:.75rem;font-size:.875rem;color:#475569}</style>
</head>
<body>
  <h1>Dynamic sandbox tokens</h1>
  <p>Iframe starts fully locked. Click to grant <code>allow-scripts</code>:</p>

  <iframe id=dynamicIframe sandbox title="Dynamic sandbox demo" srcdoc="<!DOCTYPE html><html><body style='font-family:system-ui;margin:0.5rem;'><p id='msg'>Waiting for allow-scripts…</p><script>document.getElementById('msg').textContent='Scripts enabled!';</script></body></html>"></iframe>

  <button type=button id=enableBtn>Allow scripts</button>
  <p id=status aria-live=polite>sandbox tokens: (empty — max restrictions)</p>

  <script>
    const iframe = document.getElementById("dynamicIframe");
    const status = document.getElementById("status");

    document.getElementById("enableBtn").addEventListener("click", () => {
      iframe.sandbox.add("allow-scripts");
      status.textContent = "sandbox tokens: allow-scripts";
      iframe.srcdoc = "<!DOCTYPE html><html><body style='font-family:system-ui;margin:0.5rem;'><p>Scripts enabled after sandbox.add()!</p><script>document.querySelector('p').style.color='#166534';</script></body></html>";
    });
HTML sandbox Attribute — dynamic sandbox.add()
