diff --git a/build/assets/template/background.html b/build/assets/template/background.html
index d5e039b49..65e53b5ac 100644
--- a/build/assets/template/background.html
+++ b/build/assets/template/background.html
@@ -2,13 +2,17 @@
 <html>
   <head>
     <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Background</title>
   </head>
   <body>
     <iframe
       src="/src/sandbox.html"
       name="sandbox"
-      sandbox="allow-scripts"
-      style="display: none"
+      sandbox="allow-same-origin allow-scripts"
+      hidden
+      aria-hidden="true"
+      tabindex="-1"
     ></iframe>
   </body>
 </html>
diff --git a/build/assets/template/options.html b/build/assets/template/options.html
index 0240dc7fd..f9a233481 100644
--- a/build/assets/template/options.html
+++ b/build/assets/template/options.html
@@ -10,8 +10,10 @@
     <iframe
       src="/src/sandbox.html"
       name="sandbox"
-      sandbox="allow-scripts"
-      style="display: none"
+      sandbox="allow-same-origin allow-scripts"
+      hidden
+      aria-hidden="true"
+      tabindex="-1"
     ></iframe>
   </body>
   <style>
diff --git a/build/assets/template/sandbox.html b/build/assets/template/sandbox.html
index dc97b0eb2..3761c576f 100644
--- a/build/assets/template/sandbox.html
+++ b/build/assets/template/sandbox.html
@@ -2,18 +2,8 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <script>
-      // 某些版本浏览器会因为sandbox中引用了dexie执行此方法导致报错,这里mock一个假的
-      window.BroadcastChannel = function () {
-        return {
-          postMessage: function () {},
-          close: function () {},
-        };
-      };
-    </script>
-    <title>Document</title>
+    <title>Sandbox</title>
   </head>
   <body></body>
 </html>
diff --git a/build/pack.js b/build/pack.js
index 7c883744d..b33fdedda 100644
--- a/build/pack.js
+++ b/build/pack.js
@@ -75,8 +75,8 @@ const chromeManifest = { ...manifest };
 delete chromeManifest.content_security_policy;
 
 delete firefoxManifest.sandbox;
-// firefoxManifest.content_security_policy 是为了支持动态组合的 ts.worker.js Blob URL
-firefoxManifest.content_security_policy = "script-src 'self' blob:; object-src 'self' blob:";
+// 配置 Firefox 的 CSP，以支持在 sandbox 中动态执行 background script 代码
+firefoxManifest.content_security_policy = "script-src 'self' blob: 'unsafe-eval'; object-src 'self' blob:";
 firefoxManifest.browser_specific_settings = {
   gecko: {
     id: `{${
