<script> document.addEventListener("DOMContentLoaded", () => { let o = document.getElementById('a') o.setAttribute('id', '') o.setAttribute('sandbox', '') }) </script> <iframe id='a' sandbox='s' src='http://%CF'></iframe>