An <iframe sandbox> is declared with an empty value (just the bare attribute). The framed page is same-origin with the parent. Which statement is true?