diff --git a/plugs/query/assets/common.js b/plugs/query/assets/common.js
index 28743db2..ad71706b 100644
--- a/plugs/query/assets/common.js
+++ b/plugs/query/assets/common.js
@@ -23,8 +23,10 @@ async function init() {
     try {
       const result = await syscall("widget.render", lang, body);
       const iframe = document.createElement("iframe");
-      iframe.srcdoc = panelHtml; // set as a global
+      iframe.src = "about:blank";
+
       iframe.onload = () => {
+        iframe.contentDocument.write(panelHtml);
         iframe.contentWindow.postMessage({
           type: "html",
           theme: document.getElementsByTagName("html")[0].getAttribute(
diff --git a/web/components/widget_sandbox_iframe.ts b/web/components/widget_sandbox_iframe.ts
index 048d6a38..08077f57 100644
--- a/web/components/widget_sandbox_iframe.ts
+++ b/web/components/widget_sandbox_iframe.ts
@@ -9,7 +9,7 @@ export function createWidgetSandboxIFrame(
   onMessage?: (message: any) => void,
 ) {
   const iframe = document.createElement("iframe");
-  iframe.srcdoc = panelHtml;
+  iframe.src = "about:blank";
 
   const messageListener = (evt: any) => {
     (async () => {
@@ -67,6 +67,9 @@ export function createWidgetSandboxIFrame(
   };
 
   iframe.onload = () => {
+    iframe.contentDocument!.write(panelHtml);
+    // return;
+
     // Subscribe to message event on global object (to receive messages from iframe)
     globalThis.addEventListener("message", messageListener);
     // Only run this code once