Are browser games safe? What a game in an iframe can and cannot do

The game runs in a box called an iframe

When you press Play on this site, the game is loaded into an iframe: a rectangle on our page that displays a completely separate web page from the distributor's domain. Your browser treats that rectangle as a different website, because it is one. The game's code cannot read our page, and our page cannot read the game's; the two only share the screen.

The rule that enforces this is the same-origin policy, which every modern browser applies without exception. Code from one origin (a scheme, domain and port) cannot read data belonging to another. It is the reason a shopping site's tab cannot read your email in the next tab, and it applies just as firmly to a game frame embedded in a review.

What a game can do

Inside its own frame a game has the normal powers of a web page from its own domain. It can:

• Draw to the screen, play sound, and read your keyboard, mouse and touch input while the frame has focus.
• Store data under its own domain using cookies, localStorage or IndexedDB. This is where saved progress lives; the guide on how browser games save progress covers it.
• Make network requests to its own servers and to the advertising and analytics services its distributor uses.
• Ask for fullscreen, which the browser grants only in response to a click and always shows an exit hint for.
• Request access to a gamepad if the page has allowed it, which this site does through the frame's allow attribute.

What a game cannot do

The list of things a web page is forbidden from doing is longer than the list it is allowed, and a game is a web page. Without you granting a specific permission through a browser prompt, a game cannot:

• Read files on your computer or phone, or write files anywhere except its own sandboxed storage.
• See other tabs, your history, your bookmarks or your passwords.
• Read anything typed into our page, including nothing, since we have no forms.
• Access your camera, microphone or location. Those trigger a browser permission dialog, and a game has no reason to ask.
• Install software. A web page cannot start an installer; anything that claims otherwise is a link to a download you would have to run yourself.
• Run after you close the tab. When the frame is gone, its code stops.

The sandbox and allow attributes

Sites that embed frames can tighten the rules further with two attributes. The sandbox attribute strips powers from the frame, such as running scripts, opening pop-ups or submitting forms, and then adds back only the ones the embedder names. The allow attribute lists the browser features the frame may request, such as fullscreen or gamepad access.

This site uses allow to grant fullscreen, gamepad and autoplay, and nothing else. We do not apply sandbox to game frames, and it is worth being straight about why: distributor-served games depend on scripts, storage and pop-ups for their advertising to function, and a sandboxed frame would break most of them. That is a trade-off, not a loophole; the same-origin policy is still fully in force and is what does the real work.

Adverts inside the game are not ours

Most browser games are free because they show adverts inside their own frame, usually before the game starts and sometimes between levels. Those adverts are placed by the game's distributor and shared with the developer. We do not choose them, see them in advance or earn from them; our own advertising is on the page around the frame and is clearly separate. The parent's guide explains what that means for children, and our privacy policy sets out what each party can store.

Warning signs that mean close the tab

The browser model keeps a game from doing harm on its own. The remaining risk is a game that tries to talk you into doing something outside the browser. Treat any of the following as a reason to stop:

• A message inside the game saying your browser, Flash, a codec or a driver is out of date and offering a download. Browsers update themselves; games never need to update them.
• A prompt to install an app, extension or "player" to continue.
• The whole page changing to a different website without you clicking a link, or a new window opening that you did not ask for.
• A request for an email address, phone number or payment details to keep playing a game that was presented as free.
• A browser permission dialog for camera, microphone or location. No game on this site needs any of them.

What we check before listing

Every game here was opened and played before it was listed, and part of that check is behavioural: does it push installs, does it redirect, does it ask for anything it should not. Games that do are not listed, and a game that starts doing so after publication is removed; the editorial policy describes the process. That does not make the site a guarantee, because games can change between our checks, but it does mean the obvious problems have been filtered out.