diff --git a/src/js/dao/email-dao.js b/src/js/dao/email-dao.js
index c924838..5689664 100644
--- a/src/js/dao/email-dao.js
+++ b/src/js/dao/email-dao.js
@@ -188,10 +188,6 @@ define(function(require) {
         }
 
         function attachmentReady(err, gottenAttachment) {
-            // parse uint8array to base to make it serializable for postMessage
-            gottenAttachment.base64 = btoa(gottenAttachment.uint8Array);
-            delete gottenAttachment.uint8Array;
-
             attachments.push(gottenAttachment);
             itemCounter++;
             check();
diff --git a/src/js/view/read-view.js b/src/js/view/read-view.js
index d85df98..228141c 100644
--- a/src/js/view/read-view.js
+++ b/src/js/view/read-view.js
@@ -34,9 +34,33 @@ define(['jquery', 'underscore', 'backbone', 'js/app-config'], function($, _, Bac
 			$(this.el).html(this.template(params));
 			this.renderBody();
 
+			// set download link for attachment button
+			this.parseAttachments();
+
 			return this;
 		},
 
+		parseAttachments: function() {
+			var attachments = this.model.attachments;
+			if (!attachments) {
+				// remove link if no attachments are present
+				$(this.el).find('#attachmentItem').remove();
+				return;
+			}
+
+			var attmt = attachments[0];
+			var blob = new Blob([attmt.uint8Array], {
+				type: attmt.contentType
+			});
+			var url = window.URL.createObjectURL(blob);
+
+			// set download link
+			$(this.el).find('#attachmentBtn').attr({
+				href: url,
+				download: attmt.fileName
+			}).text(attmt.fileName);
+		},
+
 		renderBody: function(tryHtml) {
 			var page = $(this.el),
 				emailBody = this.model.body;
diff --git a/src/manifest.json b/src/manifest.json
index 0480c0c..83fcf08 100644
--- a/src/manifest.json
+++ b/src/manifest.json
@@ -28,6 +28,6 @@
   },
   "sandbox": {
     "pages": ["sandbox.html", "mail-content.html"],
-    "content_security_policy": "sandbox allow-scripts; default-src 'self'; object-src 'none'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src *"
+    "content_security_policy": "sandbox allow-scripts; default-src 'self'; object-src 'none'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src *; frame-src *"
   }
 }
\ No newline at end of file
diff --git a/src/tpl/read.html b/src/tpl/read.html
index ca31bd2..b0c4a01 100644
--- a/src/tpl/read.html
+++ b/src/tpl/read.html
@@ -26,6 +26,10 @@
         <iframe src="mail-content.html" sandbox="allow-scripts" id="mailContentFrame" frameborder="0"></iframe>
       </div>
     </li>
+
+    <li id="attachmentItem">
+      <a id="attachmentBtn" data-role="button">Download Attachment</a>
+    </li>
     
   </ul>  
 </div><!-- /content -->
\ No newline at end of file