Detailed answer
Srcdoc supplies the embedded document directly in an attribute.
Escape it correctly for that context and apply suitable sandbox restrictions. Relative resource URLs can use the embedding document's context, so test paths explicitly. Treat user-provided markup as untrusted even when it has been escaped to fit the attribute.
Example
<iframe title="Example preview" sandbox srcdoc="<h1>Hello</h1><p>An HTML example.</p>"></iframe>
Understanding the behavior
Srcdoc embeds an HTML document supplied as an attribute value. That string still needs correct escaping in its containing HTML and an appropriate sandbox policy. Relative URLs can resolve against the embedding page, which may surprise a self-contained demo.
Practical implementation notes
Never treat arbitrary user HTML as safe simply because it appears in an iframe. Test the intended restrictions and avoid allowing scripts or origin access unless the application deliberately needs them.
How to check it
Escape the attribute context and inspect the embedded content with suitable sandbox restrictions.
Expected result
The intended embedded document is shown without breaking the outer attribute.
Watch out: Attribute escaping alone does not make arbitrary embedded scripts safe.
Read the reference ↗