Content isolation is the use of security boundaries to stop rendered or otherwise untrusted content from accessing files, processes, credentials, or network connections outside its intended scope. It can be implemented with sandboxed renderers, restricted permissions, separate processes, and limits on outbound network access.
It matters because HTML previews, document viewers, and other components may process attacker-controlled content. If a renderer shares the application’s access to local files or secrets, malicious content could try to read them or send data elsewhere. In practice, defenders should treat previewed files as untrusted, isolate rendering components from sensitive resources, and tightly control their permissions and network paths.