Greasy Fork

Great start! You can fix the issue with certain sites (like StackExchange) escaping the iframe pretty easily. Just add the sandbox attribute to the iframe element--this will disable "top navigation" (i.e., the contents of the iframe changing the actual page you're on).

By default, the iframe sandbox attribute also disables some other features, like javascript, popups, forms, and access to same-origin data, though these can be selectively re-enabled as needed (except for plugins, which are always disabled with the sandbox attribute).

Here's the code that I added to my instance of the script. I left the sandbox attribute mostly vanilla, to cut down on the bulk of previewed pages and to improve security. This will inevitably cause problems on some sites, but I'm happy with the tradeoff.

Add this to line 103, after src='about: blank';:

sandbox='allow-same-origin allow-scripts allow-popups allow-forms allow-pointer-lock'

Remove any of the features ('allow...') that you'd like to leave disabled.

Note that certain sites simply can't be loaded into iframes (iframe only works with HTTPS, not with HTTP, and sites can opt to block loading on other-domain iframes), so an iframe popup is never going to be a perfect solution when it comes to previewing hyperlinked content.

For an iframe-based preview, this script is pretty good, and if you're comfortable with CSS, it's not hard to tweak how it displays. (Though a simple UI for dimensions and color would be a welcome addition.)

I agree with another reviewer that a hotkey trigger would be great. Also, the ability to resize the window (I added this with basic CSS, and it works fairly well, though a more user-friendly JavaScript-based resize function would be ideal).