Links that open in new browser tabs don't work on sites embedded within Intranet Zone sites in IE when the sandbox attribute is set on the iframe.
I have an Internet Zone site embedded (with an Iframe) inside of an Intranet Zone site. The Iframe uses the sandbox attribute. The embedded content has <a target="_blank"> links which should open in a new browser tab, but they do not open at all. If I
remove the parent site from the Intranet Zone (thus bumping it down to the Internet Zone), the links work fine.
To reproduce this, check out <https://jsbin.com/jikunakiki/1/edit?html,output> and add https://*.jsbin.com to your local intranet zone in Internet Options.
I just embedded Wikipedia inside JS Bin with this bit of HTML:
<iframe src="https://www.wikipedia.org/" style="height: 350px; width: 100%;" sandbox="allow-forms allow-popups allow-scripts"></iframe>
Then, I added https://*.jsbin.com to my Local intranet zone in Internet Options. After doing so, clicking on the links "Download for iOS on the App Store" or "Download for Android on Google Play" do nothing.
In addition, the links still don't work if I add https://www.wikipedia.org to my Intranet Zone, so it appears that target="_blank" links just never work in sandboxed Iframes embedded in Intranet Zone sites.
What security settings or sandboxing flags do I need to change to make this work?
This thread is locked. You can follow the question or vote as helpful, but you cannot reply to this thread.