IE and Chrome both have ways of restricting iframes from changing window.top.location, but I wouldn't trust them to work.

    IE:
    <iframe src="http://example.com" security="restricted"></iframe>

    Chrome:
    <iframe src="http://example.com" sandbox></iframe>