When an HTML file is added inline using Insert file, it is rendered inside a sandboxed iframe that does not include the allow-same-origin permission. Scripts or third-party players inside that HTML that need access to browser storage, such as localStorage or sessionStorage, fail to run correctly as a result.

Allow project owners or admins to configure the sandbox attribute applied to inline HTML file embeds, or add allow-same-origin by default, with an option to tighten it for untrusted content.

Benefit: Interactive HTML tools and third-party players that rely on browser storage would work correctly when added through the standard Insert file workflow, with its built-in Drive filtering, tagging, and dependency tracking, instead of requiring a hand-written iframe embed as a workaround.