Chrome 91 removed the ability to do alert(), confirm() etc from cross-origin <iframe>s.
chromestatus.com/feature/514869
Probably a net-good move, but that means you literally can't use these on CodePen (and others) in any way.
Is there a sandbox flag or something to re-allow?