In iframe mode the widget renders in a sandboxed iframe. The postMessage protocol handles communication between the parent page and the iframe.