I want to allow a sandboxed iframe to use SharedArrayBuffer with web workers created by the iframe. To use SharedArrayBuffer I have to set the following headers

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

However, if I set those headers then the iframe refuses to load and chrome throws a warning stating

An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.

How can I allow the iframe to use SharedArrayBuffer without allowing the iframe to unsandbox itself?

The answer here SharedArrayBuffer in an Iframe suggests

adding allow-scripts and allow-same-origin tokens in the iframe’s sandbox attribute

but that’s exactly what chrome is telling me not to do.

Also I have control over the top level webpage and iframe’s server, but the iframe is a sandbox that runs user provided code so I must assume that it will run malicious code which is why it’s important that it can’t unsandbox itself as the top level domain contains sensitive information such as the user’s authentication token.