you can see the localhost!!

idk, i found this https://html.cafe/x2ed1c601 . also, you can't run scripts in the thumbnail
theres a lot of people trying to hac html.cafe

         
         Note:

The sandbox attribute can block the browser's built-in PDF viewer. See Embedding PDFs.
When the embedded document has the same origin as the embedding page, it is strongly discouraged to use both allow-scripts and allow-same-origin, as that lets the embedded document remove the sandbox attribute — making it no more secure than not using the sandbox attribute at all.
Sandboxing is useless if the attacker can display content outside a sandboxed iframe — such as if the viewer opens the frame in a new tab. Such content should be also served from a separate origin to limit potential damage.