diff --git a/src/plugins/webPage/components/WebPage.vue b/src/plugins/webPage/components/WebPage.vue
index 5ce567a72a..15cf1f7cf9 100644
--- a/src/plugins/webPage/components/WebPage.vue
+++ b/src/plugins/webPage/components/WebPage.vue
@@ -21,13 +21,15 @@
 -->
 <template>
   <div class="l-iframe abs">
-    <iframe :src="url"></iframe>
+    <iframe :src="url" sandbox="allow-scripts allow-forms" referrerpolicy="no-referrer"></iframe>
   </div>
 </template>
 
 <script>
 import { sanitizeUrl } from '@braintree/sanitize-url';
 
+const BLOCKED_URL = 'about:blank';
+
 export default {
   inject: ['openmct', 'domainObject'],
   data: function () {
@@ -37,7 +39,18 @@ export default {
   },
   computed: {
     url() {
-      return sanitizeUrl(this.currentDomainObject.url);
+      const url = sanitizeUrl(this.currentDomainObject.url);
+
+      // Only allow http/https absolute urls and same-origin relative urls
+      const isSafeAbsoluteUrl = /^https?:\/\//i.test(url);
+      const isSafeRelativeUrl = /^\/(?!\/)/.test(url);
+      if (!isSafeAbsoluteUrl && !isSafeRelativeUrl) {
+        console.warn('Blocked unsafe URL:', url);
+
+        return BLOCKED_URL;
+      }
+
+      return url;
     }
   }
 };