I think in that case setting the CSP sandbox header to &quot;allow-scripts&quot; would have the same effect as the iframe sandbox attribute and allow script execution in the SVG but prevent same-origin access and various other things.