Sandboxing untrusted code offline is currently impossible

[BlobTheKat]

The normal approach to sandboxing untrusted HTML/JS is to use an iframe with a sandbox attribute.

This is not possible offline as a service worker cannot control a sandboxed iframe

Consider adding an inherit-controller value to the sandbox attribute, allowing the parent's service worker to intercept requests from a sandboxed iframe. This attribute would work recursively, allowing an iframe to delegate the same service worker more levels down, for as long as those iframes are sandboxed