I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed.

I currently embed these SVGs using `<object>` elements. (Unlike `<img>`, this allows loading external fonts. And unlike using an `<iframe>`, the `<object>` resizes to the SVG's content size. [See this discussion.](https://stackoverflow.com/questions/4476526/do-i-use-img-object-or-embed-for-svg-files))

However, I don't know whether these SVGs are appropriately sandboxed when using `<object>`. The `<iframe>` permissions model is fairly clear, e.g. `<iframe sandbox="allow-scripts">` disallows everything except running scripts. But what is the sandbox/permission model for `<object>` elements?

* When I embed a page using `<object>`, what can that page do by default? E.g. what cookies can it access? Is it the same as an `<iframe>` without the `sandbox` attribute?
* What are the implications of hosting the user content SVGs on the same domain? Should I instead host them on `foobarusercontent.com`?
* Does the `<object>` tag support an equivalent of the `sandbox` attribute? Is there another way to set permissions for an `<object>`?
* What specifications describe the security model for `<object>`?