Welcome to internal
When an iframe's src is internal (no URL scheme which defaults to ms-appx) the contents run in local context and have full access to the local device