This would require adding "allow-same-domain" to iframe sandbox. I somewhat understand the security implications, and this would allow other sites access to each others' localresources, but I wanted to open this ticket to track this request. Ultimately, in an effort to provide a rich user experience, this same domain issue will need to be conquered.

Short term, I'd like to see localresources opened up, maybe with an explicit user permission per site, and an explanation of the risks?