Difference between <iframe> and <embed>?

0-2 years experience

1. 1We need to display a static PDF menu on our restaurant's website. How would you choose between using an <iframe> and an <embed> tag to display this PDF, and what happens if a user's browser doesn't support PDF viewing?
2. 2Imagine you're adding a third-party weather widget to a blog. The widget provider gives you both an <iframe> and an <embed> snippet. Which one would you prefer if you want to make sure the widget can't maliciously access the parent page's cookies, and how would you configure it?

2-5 years experience

1. 1We are building a dashboard where users can preview untrusted HTML templates submitted by other users. A developer suggested using <embed> because it's simpler, but we have security concerns. Why is <iframe> with a sandbox attribute a better choice here, and what specific vulnerabilities are we mitigating?
2. 2We've integrated a third-party payment form. When using <embed>, we noticed we can't easily handle fallback content or detect when the external resource fails to load. How does switching to an <iframe> help us handle loading states, errors, and responsive resizing?

5-8 years experience

1. 1We're designing a portal that hosts micro-applications developed by external partners. What are the architectural implications of using <iframe> versus <embed> regarding memory footprint, CSS/JS isolation, and Content Security Policy (CSP) overhead?
2. 2Our media-heavy site embeds dozens of interactive PDF reports and external charts. We're seeing massive performance degradation on initial page load. How would you optimize this using <iframe> attributes like loading="lazy" and intersection observers, and why would <embed> limit your options here?

8+ years experience

1. 1Our enterprise application historically used <embed> and <object> tags to load legacy interactive components and documents. We are migrating to a modern, zero-trust security architecture. How would you design a migration path to transition these to secure <iframe> contexts or native web components, and how do you handle cross-origin communication challenges at scale?
2. 2You are architecting an SDK that our enterprise clients will install on their sites to render our complex checkout flow. We must choose between delivering this via an <iframe> or an <embed> element. What are the long-term implications on browser compatibility, cookie deprecation, and client-side performance that would drive your architectural decision?