Every page renders in a sandboxed iframe with a strict CSP — it can never read your browser context, cookies, or storage.