A user can embed remote html in an iframe.