diff --git a/src/sandbox.html b/src/sandbox.html
index fdf0113..bbc10d0 100644
--- a/src/sandbox.html
+++ b/src/sandbox.html
@@ -2,9 +2,11 @@
 <html style="overflow: auto">
 
 <head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<script src="sandbox.js"></script>
+  <!-- CSP for sandbox is set in chrome manifest. This is a fallback in non chrome app runtimes. -->
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; img-src *">
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <script src="sandbox.js"></script>
 </head>
 
 <body></body>
