[jszymborski]

Too bad CORS doesn't fix this. It would be awesome to be able to sandbox a page completely.

[JimDabell]

You can use CSP for this:

    Content-Security-Policy: img-src 'self';