iframe cannot replace sanitization completely, but is a great feature to use as security in-depth. Unfortunately, it does get in the way of some user-friendliness features.
I would be interesting in hearing a more informed answer, but I'm going to post some points I'm aware of.
Same Origin Policy works both ways. It's great that it keeps the
iframe from seeing the outer document content. Unfortunately, if you select text, the outer document cannot tell what text was selected in the
iframe. (thanks @paj28) Once could use postMessage feature by adding script to the inner page to work around this, but it is inconvenient. Furthermore, this will not work if you use
sandbox as a way to disable
scripts. (which I would highly recommend)
You will want to use Content Security Policy (again, thanks @paj28) to disable beacons within the
iframed content; and also to disable scripts and other potential issues.
I'd like to point out that
iframe as originally designed is not complete. The
sandbox attribute would be must if you have any doubt in your sanitization. Unfortunately, the
sandbox feature was only recently implemented. This is of diminishing significance as older browsers start to drop off the charts.
Disabling scripts would get in the way of user-friendliness features anyway such as detecting selected text. (It is possible you could get away with 'disable scripts and treat as same origin' rule of sandbox, but that seems risky.)
Any time you add your own scripts or interactive functionality to the
iframe'd document, you will be much safer if you still sanitize that document. While
sandbox combined with CSP may cover you completely, there might be something missing from that formula.
So in summary
For browsers that don't support
iframe mitigates significant security risks, but is unable to protect against many issues. Content Security Policy might be able to isolate the content, to a great extent. But you still need to sanitize to prevent things like
For browsers that do support
sandbox, combined with a good Content Security Policy, you might be able to replace sanitization, but it is not advisable because it is hard to know for sure whether you are 100% secure. (sanitization routines on the other hand are older and better vetted)
If you have sanitization (which you probably should), and the sanitation is well vetted, then
iframes only get in the way of user-friendliness. On the other hand, if a flaw is discovered in your sanitization, then you will be glad you
iframed the content, using the
sandbox attribute and CSP to reduce the scope of the attack.
Side note: desktop applications have more liberty in sandboxing their webviews, even better than the
iframe sandbox attribute. So, for example, the Android apps could benefit.