diff --git a/.ci-scripts/build-local-qt.sh b/.ci-scripts/build-local-qt.sh
index 831d213295..98a4b9882b 100755
--- a/.ci-scripts/build-local-qt.sh
+++ b/.ci-scripts/build-local-qt.sh
@@ -14,4 +14,5 @@ install_deps \
   qttools \
   qtsvg \
   qtimageformats \
+  qtremoteobjects \
   qtwayland
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 805161b662..8daf9c2a18 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -59,7 +59,7 @@ execute_process(
   OUTPUT_VARIABLE QT_PREFIX_PATH
   OUTPUT_STRIP_TRAILING_WHITESPACE)
 
-project(qtox)
+project(qtox LANGUAGES CXX)
 
 # C++ and C standards.
 set(CMAKE_CXX_STANDARD 20)
@@ -262,6 +262,8 @@ set(${PROJECT_NAME}_SOURCES
     src/chatlog/customtextdocument.h
     src/chatlog/documentcache.cpp
     src/chatlog/documentcache.h
+    src/chatlog/imageloader.cpp
+    src/chatlog/imageloader.h
     src/chatlog/pixmapcache.cpp
     src/chatlog/pixmapcache.h
     src/core/toxfileprogress.cpp
@@ -430,6 +432,12 @@ set(${PROJECT_NAME}_SOURCES
     src/platform/desktop_notifications/desktopnotifybackend.h
     src/platform/posixsignalnotifier.cpp
     src/platform/posixsignalnotifier.h
+    src/platform/sandbox.cpp
+    src/platform/sandbox.h
+    src/platform/sandboxclient.cpp
+    src/platform/sandboxclient.h
+    src/platform/sandboxserver.cpp
+    src/platform/sandboxserver.h
     src/platform/timer.h
     src/platform/timer_osx.cpp
     src/platform/timer_win.cpp
@@ -653,6 +661,8 @@ add_subdirectory(cmake/warnings)
 
 add_library(${PROJECT_NAME}_static STATIC ${${PROJECT_NAME}_FORMS}
                                           ${${PROJECT_NAME}_SOURCES})
+qt_add_repc_sources(${PROJECT_NAME}_static src/platform/sandbox.rep)
+qt_add_repc_replicas(${PROJECT_NAME}_static src/platform/sandbox.rep)
 target_link_libraries(${PROJECT_NAME}_static ${CMAKE_REQUIRED_LIBRARIES}
                       ${ALL_LIBRARIES} coverage_config)
 
@@ -667,8 +677,8 @@ if(COMMAND qt_policy)
   qt_policy(SET QTP0002 NEW)
 endif()
 
-qt_add_executable(${PROJECT_NAME} WIN32 MACOSX_BUNDLE
-                  ${${PROJECT_NAME}_RESOURCES} ${SMILEY_RESOURCES} src/main.cpp)
+qt_add_executable(${PROJECT_NAME} ${${PROJECT_NAME}_RESOURCES} ${SMILEY_RESOURCES} src/main.cpp)
+set_target_properties(${PROJECT_NAME} PROPERTIES WIN32_EXECUTABLE TRUE MACOSX_BUNDLE TRUE)
 target_link_libraries(
   ${PROJECT_NAME} PRIVATE ${PROJECT_NAME}_static ${CMAKE_REQUIRED_LIBRARIES}
                           ${ALL_LIBRARIES})
diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake
index 6370cd400e..e48a6ce379 100644
--- a/cmake/Dependencies.cmake
+++ b/cmake/Dependencies.cmake
@@ -9,16 +9,18 @@
 ################################################################################
 
 # This should go into subdirectories later.
-find_package(PkgConfig        REQUIRED)
-find_package(Qt6Concurrent    REQUIRED)
-find_package(Qt6Core          REQUIRED)
-find_package(Qt6Gui           REQUIRED)
-find_package(Qt6Linguist      REQUIRED)
-find_package(Qt6Network       REQUIRED)
-find_package(Qt6Svg           REQUIRED)
-find_package(Qt6Test          REQUIRED)
-find_package(Qt6Widgets       REQUIRED)
-find_package(Qt6Xml           REQUIRED)
+find_package(PkgConfig REQUIRED)
+find_package(Qt6 REQUIRED COMPONENTS
+  Concurrent
+  Core
+  Gui
+  Linguist
+  Network
+  RemoteObjects
+  Svg
+  Test
+  Widgets
+  Xml)
 
 function(add_dependency)
   set(ALL_LIBRARIES ${ALL_LIBRARIES} ${ARGN} PARENT_SCOPE)
@@ -29,6 +31,7 @@ add_dependency(
   Qt6::Core
   Qt6::Gui
   Qt6::Network
+  Qt6::RemoteObjects
   Qt6::Svg
   Qt6::Widgets
   Qt6::Xml)
@@ -214,7 +217,7 @@ if(QT_FEATURE_static)
     find_library(KIMG_${fmt_lib}_LIBRARY kimg_${fmt}
                 PATHS "${QT6_INSTALL_PREFIX}/plugins/imageformats")
     if(KIMG_${fmt_lib}_LIBRARY)
-      message(STATUS "Found ${fmt_lib} imageformats plugin: ${KIMG_${fmt}_LIBRARY}")
+      message(STATUS "Found ${fmt_lib} imageformats plugin: ${KIMG_${fmt_lib}_LIBRARY}")
       add_dependency(${KIMG_${fmt_lib}_LIBRARY})
       set_property(SOURCE src/main.cpp APPEND PROPERTY COMPILE_DEFINITIONS QTOX_USE_KIMG_${fmt_lib})
     else()
diff --git a/src/BUILD.bazel b/src/BUILD.bazel
index 37f3efaa86..e3f6079d20 100644
--- a/src/BUILD.bazel
+++ b/src/BUILD.bazel
@@ -1,5 +1,5 @@
 load("@rules_cc//cc:defs.bzl", "cc_library", "objc_library")
-load("//third_party/qt:build_defs.bzl", "qt_moc", "qt_uic")
+load("//third_party/qt:build_defs.bzl", "qt_moc", "qt_repc", "qt_uic")
 load("//tools/project:build_defs.bzl", "mkstamp")
 
 DEFINES = [
@@ -10,6 +10,20 @@ DEFINES = [
     "UPDATE_CHECK_ENABLED",
 ]
 
+qt_repc(
+    name = "src_repc_source",
+    srcs = ["platform/sandbox.rep"],
+    tags = ["qt"],
+    type = "source",
+)
+
+qt_repc(
+    name = "src_repc_replica",
+    srcs = ["platform/sandbox.rep"],
+    tags = ["qt"],
+    type = "replica",
+)
+
 qt_moc(
     name = "src_moc",
     srcs = [
@@ -24,6 +38,7 @@ qt_moc(
         "chatlog/content/text.h",
         "chatlog/content/timestamp.h",
         "chatlog/customtextdocument.h",
+        "chatlog/imageloader.h",
         "core/core.h",
         "core/coreav.h",
         "core/corefile.h",
@@ -60,6 +75,9 @@ qt_moc(
         "platform/desktop_notifications/desktopnotify.h",
         "platform/desktop_notifications/desktopnotifybackend.h",
         "platform/posixsignalnotifier.h",
+        "platform/sandbox.h",
+        "platform/sandboxclient.h",
+        "platform/sandboxserver.h",
         "video/camerasource.h",
         "video/corevideosource.h",
         "video/netcamview.h",
@@ -124,15 +142,19 @@ qt_moc(
         "widget/tool/screenshotgrabber.h",
         "widget/tool/toolboxgraphicsitem.h",
         "widget/widget.h",
+        ":src_repc_replica",
+        ":src_repc_source",
     ],
     hdrs = glob(["**/*.h"]),
     mocopts = [
         "-Iqtox",
+        "-Iqtox/src",
         "-Iqtox/util/include",
     ] + ["-D%s=1" % d for d in DEFINES],
     tags = ["qt"],
     deps = [
         "//qtox/util",
+        "@qt//:qt_remoteobjects",
         "@qt//:qt_widgets",
     ],
 )
@@ -166,6 +188,7 @@ mkstamp(
 COPTS = [
     "-Iqtox",
     "-I$(GENDIR)/qtox",
+    "-I$(GENDIR)/qtox/src/platform",
 ] + select({
     "//tools/config:freebsd": [],
     "//tools/config:linux": ["-fPIC"],
@@ -187,6 +210,8 @@ cc_library(
     name = "src",
     srcs = [":version"] + [
         ":src_moc",
+        ":src_repc_replica",
+        ":src_repc_source",
         ":src_ui",
     ] + glob(
         ["**/*.cpp"],
@@ -227,6 +252,7 @@ cc_library(
         "@qt//:qt_dbus",
         "@qt//:qt_gui",
         "@qt//:qt_network",
+        "@qt//:qt_remoteobjects",
         "@qt//:qt_svg",
         "@qt//:qt_widgets",
         "@qt//:qt_xml",
@@ -245,15 +271,7 @@ cc_library(
 cc_library(
     name = "main",
     srcs = ["main.cpp"],
-    copts = [
-        "-Iqtox",
-        "-I$(GENDIR)/qtox",
-    ] + select({
-        "//tools/config:freebsd": [],
-        "//tools/config:linux": ["-fPIC"],
-        "//tools/config:osx": [],
-        "//tools/config:windows": [],
-    }),
+    copts = COPTS,
     tags = ["qt"],
     visibility = ["//qtox:__subpackages__"],
     deps = [
diff --git a/src/appmanager.cpp b/src/appmanager.cpp
index 5d0ea444dd..42df79bb03 100644
--- a/src/appmanager.cpp
+++ b/src/appmanager.cpp
@@ -13,6 +13,8 @@
 #include "src/persistence/settings.h"
 #include "src/persistence/toxsave.h"
 #include "src/platform/posixsignalnotifier.h"
+#include "src/platform/sandboxclient.h"
+#include "src/platform/sandboxserver.h"
 #include "src/version.h"
 #include "src/video/camerasource.h"
 #include "src/widget/tool/messageboxmanager.h"
@@ -25,6 +27,7 @@
 #include <QFontDatabase>
 #include <QMessageBox>
 #include <QObject>
+#include <QRemoteObjectHost>
 
 namespace {
 // logMessageHandler and associated data must be static due to qInstallMessageHandler's
@@ -189,7 +192,6 @@ AppManager::AppManager(int& argc, char** argv)
     : qapp((preConstructionInitialization(), new QApplication(argc, argv)))
     , messageBoxManager(new MessageBoxManager(nullptr))
     , settings(new Settings(*messageBoxManager))
-    , ipc(new IPC(settings->getCurrentProfileId()))
 {
 }
 
@@ -200,6 +202,37 @@ void AppManager::preConstructionInitialization()
 
 int AppManager::startGui(QCommandLineParser& parser)
 {
+    // Terminating signals are connected directly to quit() without any filtering.
+    connect(&PosixSignalNotifier::globalInstance(), &PosixSignalNotifier::terminatingSignal,
+            qapp.get(), &QApplication::quit);
+    PosixSignalNotifier::watchCommonTerminatingSignals();
+
+    // User signal 1 is used to screenshot the application.
+    connect(&PosixSignalNotifier::globalInstance(), &PosixSignalNotifier::usrSignal, qapp.get(),
+            [this](PosixSignalNotifier::UserSignal signal) {
+                if (signal == PosixSignalNotifier::UserSignal::Screenshot) {
+                    nexus->screenshot();
+                }
+            });
+    PosixSignalNotifier::watchUsrSignals();
+
+    // Install Unicode 6.1 supporting font
+    // Keep this as close to the beginning of `main()` as possible, otherwise
+    // on systems that have poor support for Unicode qTox will look bad.
+    if (QFontDatabase::addApplicationFont(":/font/DejaVuSans.ttf") == -1) {
+        qWarning() << "Couldn't load font";
+    }
+
+    if (parser.isSet("portable")) {
+        // We don't go through settings here, because we're not making qTox
+        // portable (which moves files around). Instead, we start up in
+        // portable mode as a one-off.
+        settings->getPaths().setPortable(true);
+        settings->getPaths().setPortablePath(parser.value("portable"));
+    }
+
+    ipc = std::make_unique<IPC>(settings->getCurrentProfileId());
+
     if (ipc->isAttached()) {
         connect(settings.get(), &Settings::currentProfileIdChanged, ipc.get(), &IPC::setProfileId);
     } else {
@@ -253,6 +286,14 @@ int AppManager::startGui(QCommandLineParser& parser)
     qDebug() << "Commit:" << VersionInfo::gitVersion();
     qDebug() << "Process ID:" << QCoreApplication::applicationPid();
 
+    if (settings->getExperimentalSandbox()) {
+        sandbox = std::make_unique<SandboxClient>(this);
+        qDebug() << "Sandbox ready:" << sandbox->isReady();
+    } else {
+        sandbox = std::make_unique<SandboxServer>(this);
+        qDebug() << "Sandbox disabled";
+    }
+
     QString profileName;
     bool autoLogin = settings->getAutoLogin();
 
@@ -317,7 +358,7 @@ int AppManager::startGui(QCommandLineParser& parser)
     //  note: Because Settings is shouldering global settings as well as model specific ones it
     //  cannot be integrated into a central model object yet
     cameraSource = std::unique_ptr<CameraSource>(new CameraSource{*settings});
-    nexus = std::unique_ptr<Nexus>(new Nexus{*settings, *messageBoxManager, *cameraSource, *ipc});
+    nexus = std::unique_ptr<Nexus>(new Nexus{*settings, *messageBoxManager, *cameraSource, *ipc, *sandbox});
     // Autologin
     // TODO (kriby): Shift responsibility of linking views to model objects from nexus
     // Further: generate view instances separately (loginScreen, mainGUI, audio)
@@ -364,20 +405,6 @@ int AppManager::startGui(QCommandLineParser& parser)
 
 int AppManager::run()
 {
-    // Terminating signals are connected directly to quit() without any filtering.
-    connect(&PosixSignalNotifier::globalInstance(), &PosixSignalNotifier::terminatingSignal,
-            qapp.get(), &QApplication::quit);
-    PosixSignalNotifier::watchCommonTerminatingSignals();
-
-    // User signal 1 is used to screenshot the application.
-    connect(&PosixSignalNotifier::globalInstance(), &PosixSignalNotifier::usrSignal, qapp.get(),
-            [this](PosixSignalNotifier::UserSignal signal) {
-                if (signal == PosixSignalNotifier::UserSignal::Screenshot) {
-                    nexus->screenshot();
-                }
-            });
-    PosixSignalNotifier::watchUsrSignals();
-
     qapp->setApplicationName("qTox");
     qapp->setDesktopFileName("io.github.qtox.qTox");
     qapp->setApplicationVersion(QStringLiteral("%1, git commit %2 (%3)")
@@ -387,13 +414,6 @@ int AppManager::run()
                                              ? QStringLiteral("stable")
                                              : QStringLiteral("unstable")));
 
-    // Install Unicode 6.1 supporting font
-    // Keep this as close to the beginning of `main()` as possible, otherwise
-    // on systems that have poor support for Unicode qTox will look bad.
-    if (QFontDatabase::addApplicationFont("://font/DejaVuSans.ttf") == -1) {
-        qWarning() << "Couldn't load font";
-    }
-
     QString locale = settings->getTranslation();
     // We need to init the resources in the translations_library explicitly.
     // See https://doc.qt.io/qt-5/resources.html#using-resources-in-a-library
@@ -417,17 +437,10 @@ int AppManager::run()
 #ifdef UPDATE_CHECK_ENABLED
         {{"u", "update-check"}, tr("Checks whether this program is running the latest qTox version.")},
 #endif // UPDATE_CHECK_ENABLED
+        {{"S", "sandbox"}, tr("Start the qTox sandbox process (internal, don't use).")},
     });
     parser.process(*qapp);
 
-    if (parser.isSet("portable")) {
-        // We don't go through settings here, because we're not making qTox
-        // portable (which moves files around). Instead, we start up in
-        // portable mode as a one-off.
-        settings->getPaths().setPortable(true);
-        settings->getPaths().setPortablePath(parser.value("portable"));
-    }
-
     // If update-check is requested, do it and exit.
     if (parser.isSet("update-check")) {
         UpdateCheck* updateCheck = new UpdateCheck(*settings, qapp.get());
@@ -442,11 +455,20 @@ int AppManager::run()
                     QTextStream(stdout) << message;
                     qapp->quit();
                 });
-    } else {
-        const int result = startGui(parser);
-        if (result != 0) {
-            return result;
-        }
+        return qapp->exec();
+    }
+
+    if (parser.isSet("sandbox")) {
+        // Start the sandbox process.
+        SandboxServer sandboxServer;
+        QRemoteObjectHost srcNode(QUrl(QStringLiteral("local:replica")));
+        srcNode.enableRemoting(&sandboxServer);
+        return qapp->exec();
+    }
+
+    const int result = startGui(parser);
+    if (result != 0) {
+        return result;
     }
 
     return qapp->exec();
diff --git a/src/appmanager.h b/src/appmanager.h
index efd000f138..dce85163da 100644
--- a/src/appmanager.h
+++ b/src/appmanager.h
@@ -9,14 +9,15 @@
 
 #include <memory>
 
-class MessageBoxManager;
-class Settings;
+class CameraSource;
 class IPC;
+class MessageBoxManager;
+class Nexus;
 class QApplication;
 class QCommandLineParser;
+class Sandbox;
+class Settings;
 class ToxURIDialog;
-class Nexus;
-class CameraSource;
 
 class AppManager : public QObject
 {
@@ -42,4 +43,5 @@ private slots:
     std::unique_ptr<ToxURIDialog> uriDialog;
     std::unique_ptr<CameraSource> cameraSource;
     std::unique_ptr<Nexus> nexus;
+    std::unique_ptr<Sandbox> sandbox;
 };
diff --git a/src/chatlog/chatmessage.cpp b/src/chatlog/chatmessage.cpp
index 218586abcb..dbbff48b18 100644
--- a/src/chatlog/chatmessage.cpp
+++ b/src/chatlog/chatmessage.cpp
@@ -4,7 +4,6 @@
  */
 
 #include "chatmessage.h"
-#include "chatlinecontentproxy.h"
 #include "textformatter.h"
 #include "content/broken.h"
 #include "content/filetransferwidget.h"
@@ -13,6 +12,7 @@
 #include "content/spinner.h"
 #include "content/text.h"
 #include "content/timestamp.h"
+#include "src/chatlog/chatlinecontentproxy.h"
 #include "src/widget/style.h"
 #include "src/widget/tool/identicon.h"
 
@@ -165,7 +165,7 @@ ChatMessage::Ptr ChatMessage::createFileTransferMessage(const QString& sender, C
                                                         ToxFile file, bool isMe, const QDateTime& date,
                                                         DocumentCache& documentCache,
                                                         Settings& settings, Style& style,
-                                                        IMessageBoxManager& messageBoxManager)
+                                                        IMessageBoxManager& messageBoxManager, ImageLoader& imageLoader)
 {
     ChatMessage::Ptr msg = ChatMessage::Ptr(new ChatMessage(documentCache, settings, style));
 
@@ -178,7 +178,7 @@ ChatMessage::Ptr ChatMessage::createFileTransferMessage(const QString& sender, C
     msg->addColumn(new Text(documentCache, settings, style, sender, authorFont, true),
                    ColumnFormat(NAME_COL_WIDTH, ColumnFormat::FixedSize, ColumnFormat::Right));
     msg->addColumn(new ChatLineContentProxy(new FileTransferWidget(nullptr, coreFile, file, settings,
-                                                                   style, messageBoxManager),
+                                                                   style, messageBoxManager, imageLoader),
                                             320, 0.6f),
                    ColumnFormat(1.0, ColumnFormat::VariableSize));
     msg->addColumn(new Timestamp(date, settings.getTimestampFormat(), baseFont, documentCache,
diff --git a/src/chatlog/chatmessage.h b/src/chatlog/chatmessage.h
index c695c38476..1e9e2984aa 100644
--- a/src/chatlog/chatmessage.h
+++ b/src/chatlog/chatmessage.h
@@ -12,12 +12,13 @@
 #include <QDateTime>
 
 class CoreFile;
-class QGraphicsScene;
 class DocumentCache;
-class SmileyPack;
+class IMessageBoxManager;
+class QGraphicsScene;
+class ImageLoader;
 class Settings;
+class SmileyPack;
 class Style;
-class IMessageBoxManager;
 
 class ChatMessage : public ChatLine
 {
@@ -55,7 +56,7 @@ class ChatMessage : public ChatLine
                                                       ToxFile file, bool isMe, const QDateTime& date,
                                                       DocumentCache& documentCache,
                                                       Settings& settings, Style& style,
-                                                      IMessageBoxManager& messageBoxManager);
+                                                      IMessageBoxManager& messageBoxManager, ImageLoader& imageLoader);
     static ChatMessage::Ptr createTypingNotification(DocumentCache& documentCache,
                                                      Settings& settings, Style& style);
     static ChatMessage::Ptr createBusyNotification(DocumentCache& documentCache, Settings& settings,
diff --git a/src/chatlog/chatwidget.cpp b/src/chatlog/chatwidget.cpp
index ea939fc8bf..93f3a59901 100644
--- a/src/chatlog/chatwidget.cpp
+++ b/src/chatlog/chatwidget.cpp
@@ -14,7 +14,6 @@
 #include "src/persistence/settings.h"
 #include "src/widget/style.h"
 #include "src/widget/translator.h"
-#include <iostream>
 
 #include <QAction>
 #include <QApplication>
@@ -27,8 +26,6 @@
 
 #include <algorithm>
 #include <cassert>
-#include <set>
-
 
 namespace {
 
@@ -194,7 +191,7 @@ ChatLogIdx clampedAdd(ChatLogIdx idx, int val, IChatLog& chatLog)
 
 ChatWidget::ChatWidget(IChatLog& chatLog_, const Core& core_, DocumentCache& documentCache_,
                        SmileyPack& smileyPack_, Settings& settings_, Style& style_,
-                       IMessageBoxManager& messageBoxManager_, QWidget* parent)
+                       IMessageBoxManager& messageBoxManager_, ImageLoader& imageLoader_, QWidget* parent)
     : QGraphicsView(parent)
     , selectionRectColor{style_.getColor(Style::ColorPalette::SelectText)}
     , chatLog(chatLog_)
@@ -205,6 +202,7 @@ ChatWidget::ChatWidget(IChatLog& chatLog_, const Core& core_, DocumentCache& doc
     , settings(settings_)
     , style{style_}
     , messageBoxManager{messageBoxManager_}
+    , imageLoader{imageLoader_}
 {
     // Create the scene
     busyScene = new QGraphicsScene(this);
@@ -1439,7 +1437,7 @@ void ChatWidget::renderFile(QString displayName, ToxFile file, bool isSelf, QDat
         assert(coreFile);
         chatMessage = ChatMessage::createFileTransferMessage(displayName, *coreFile, file, isSelf,
                                                              timestamp, documentCache, settings,
-                                                             style, messageBoxManager);
+                                                             style, messageBoxManager, imageLoader);
     } else {
         auto proxy = static_cast<ChatLineContentProxy*>(chatMessage->getContent(1));
         assert(proxy->getWidgetType() == ChatLineContentProxy::FileTransferWidgetType);
diff --git a/src/chatlog/chatwidget.h b/src/chatlog/chatwidget.h
index 2e81157e04..03347bb909 100644
--- a/src/chatlog/chatwidget.h
+++ b/src/chatlog/chatwidget.h
@@ -13,17 +13,18 @@
 #include "chatmessage.h"
 #include "src/model/ichatlog.h"
 
-class QGraphicsScene;
+class ChatLineContent;
+class ChatLineStorage;
+class IMessageBoxManager;
 class QGraphicsRectItem;
+class QGraphicsScene;
 class QMouseEvent;
 class QTimer;
-class ChatLineContent;
-struct ToxFile;
-class SmileyPack;
+class ImageLoader;
 class Settings;
+class SmileyPack;
 class Style;
-class ChatLineStorage;
-class IMessageBoxManager;
+struct ToxFile;
 
 static const size_t DEF_NUM_MSG_TO_LOAD = 100;
 class ChatWidget : public QGraphicsView
@@ -32,7 +33,7 @@ class ChatWidget : public QGraphicsView
 public:
     ChatWidget(IChatLog& chatLog_, const Core& core_, DocumentCache& documentCache,
                SmileyPack& smileyPack, Settings& settings, Style& style,
-               IMessageBoxManager& messageBoxManager, QWidget* parent = nullptr);
+               IMessageBoxManager& messageBoxManager, ImageLoader& imageLoader, QWidget* parent = nullptr);
     ~ChatWidget() override;
 
     void insertChatlines(std::map<ChatLogIdx, ChatLine::Ptr> chatLines);
@@ -216,4 +217,5 @@ private slots:
     Settings& settings;
     Style& style;
     IMessageBoxManager& messageBoxManager;
+    ImageLoader& imageLoader;
 };
diff --git a/src/chatlog/content/filetransferwidget.cpp b/src/chatlog/content/filetransferwidget.cpp
index 35404be174..3885f52ef1 100644
--- a/src/chatlog/content/filetransferwidget.cpp
+++ b/src/chatlog/content/filetransferwidget.cpp
@@ -7,7 +7,6 @@
 #include "ui_filetransferwidget.h"
 
 #include "src/core/corefile.h"
-#include "src/model/exiftransform.h"
 #include "src/persistence/settings.h"
 #include "src/widget/style.h"
 #include "src/widget/tool/imessageboxmanager.h"
@@ -22,10 +21,10 @@
 #include <QMessageBox>
 #include <QMouseEvent>
 #include <QPainter>
+#include <QPainterPath>
 #include <QVariantAnimation>
 
 #include <cassert>
-#include <math.h>
 
 
 // The leftButton is used to accept, pause, or resume a file transfer, as well as to open a
@@ -35,7 +34,8 @@
 
 FileTransferWidget::FileTransferWidget(QWidget* parent, CoreFile& _coreFile, ToxFile file,
                                        Settings& settings_, Style& style_,
-                                       IMessageBoxManager& messageBoxManager_)
+                                       IMessageBoxManager& messageBoxManager_,
+                                       ImageLoader& imageLoader_)
     : QWidget(parent)
     , coreFile{_coreFile}
     , ui(new Ui::FileTransferWidget)
@@ -47,6 +47,7 @@ FileTransferWidget::FileTransferWidget(QWidget* parent, CoreFile& _coreFile, Tox
     , settings(settings_)
     , style{style_}
     , messageBoxManager{messageBoxManager_}
+    , imageLoader{imageLoader_}
 {
     ui->setupUi(this);
 
@@ -195,7 +196,7 @@ void FileTransferWidget::paintEvent(QPaintEvent* event)
                                         buttonFieldWidth, buttonFieldWidth + lineWidth, 50, 50,
                                         Qt::RelativeSize);
         buttonBackground.addRect(width() - 2 * buttonFieldWidth - lineWidth * 2, 0,
-                                 buttonFieldWidth * 2, buttonFieldWidth / 2);
+                                 buttonFieldWidth * 2, static_cast<qreal>(buttonFieldWidth) / 2);
         buttonBackground.addRect(width() - 1.5 * buttonFieldWidth - lineWidth * 2, 0,
                                  buttonFieldWidth * 2, buttonFieldWidth + 1);
         buttonBackground.setFillRule(Qt::WindingFill);
@@ -208,7 +209,7 @@ void FileTransferWidget::paintEvent(QPaintEvent* event)
                                         buttonFieldWidth, buttonFieldWidth),
                                   50, 50, Qt::RelativeSize);
         leftButton.addRect(QRect(width() - 2 * buttonFieldWidth - lineWidth, 0,
-                                 buttonFieldWidth / 2, buttonFieldWidth / 2));
+                                 buttonFieldWidth / 2, static_cast<qreal>(buttonFieldWidth) / 2));
         leftButton.addRect(QRect(width() - 1.5 * buttonFieldWidth - lineWidth, 0,
                                  buttonFieldWidth / 2, buttonFieldWidth));
         leftButton.setFillRule(Qt::WindingFill);
@@ -478,7 +479,7 @@ void FileTransferWidget::handleButton(QPushButton* btn)
 
 void FileTransferWidget::showPreview(const QString& filename)
 {
-    ui->previewButton->setIconFromFile(filename);
+    ui->previewButton->setIconFromFile(imageLoader, filename);
     ui->previewButton->show();
 }
 
diff --git a/src/chatlog/content/filetransferwidget.h b/src/chatlog/content/filetransferwidget.h
index 0c5f5e3a18..30063cf264 100644
--- a/src/chatlog/content/filetransferwidget.h
+++ b/src/chatlog/content/filetransferwidget.h
@@ -8,7 +8,6 @@
 #include <QTime>
 #include <QWidget>
 
-#include "src/chatlog/chatlinecontent.h"
 #include "src/core/toxfile.h"
 
 class CoreFile;
@@ -17,11 +16,12 @@ namespace Ui {
 class FileTransferWidget;
 }
 
-class QVariantAnimation;
+class IMessageBoxManager;
 class QPushButton;
+class QVariantAnimation;
+class ImageLoader;
 class Settings;
 class Style;
-class IMessageBoxManager;
 
 class FileTransferWidget : public QWidget
 {
@@ -29,7 +29,7 @@ class FileTransferWidget : public QWidget
 
 public:
     FileTransferWidget(QWidget* parent, CoreFile& _coreFile, ToxFile file, Settings& settings,
-                       Style& style, IMessageBoxManager& messageBoxManager);
+                       Style& style, IMessageBoxManager& messageBoxManager, ImageLoader& imageLoader);
     ~FileTransferWidget() override;
     bool isActive() const;
     void onFileTransferUpdate(ToxFile file);
@@ -81,4 +81,5 @@ private slots:
     Settings& settings;
     Style& style;
     IMessageBoxManager& messageBoxManager;
+    ImageLoader& imageLoader;
 };
diff --git a/src/chatlog/imageloader.cpp b/src/chatlog/imageloader.cpp
new file mode 100644
index 0000000000..77afcc3d2e
--- /dev/null
+++ b/src/chatlog/imageloader.cpp
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2025 The TokTok team.
+ */
+
+#include "imageloader.h"
+
+ImageLoader::~ImageLoader() = default;
diff --git a/src/chatlog/imageloader.h b/src/chatlog/imageloader.h
new file mode 100644
index 0000000000..86f9f4ec8f
--- /dev/null
+++ b/src/chatlog/imageloader.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2025 The TokTok team.
+ */
+
+#pragma once
+
+class QPixmap;
+class QByteArray;
+
+class ImageLoader
+{
+public:
+    virtual ~ImageLoader();
+
+    virtual QPixmap loadImage(const QByteArray& data) = 0;
+};
diff --git a/src/nexus.cpp b/src/nexus.cpp
index 4f9ae2d07a..901ea5d89a 100644
--- a/src/nexus.cpp
+++ b/src/nexus.cpp
@@ -48,7 +48,7 @@
 Q_DECLARE_OPAQUE_POINTER(ToxAV*)
 
 Nexus::Nexus(Settings& settings_, IMessageBoxManager& messageBoxManager_,
-             CameraSource& cameraSource_, IPC& ipc_, QObject* parent)
+             CameraSource& cameraSource_, IPC& ipc_, ImageLoader& imageLoader_, QObject* parent)
     : QObject(parent)
     , profile{nullptr}
     , settings{settings_}
@@ -57,6 +57,7 @@ Nexus::Nexus(Settings& settings_, IMessageBoxManager& messageBoxManager_,
     , style{new Style()}
     , messageBoxManager{messageBoxManager_}
     , ipc{ipc_}
+    , imageLoader{imageLoader_}
 {
     QObject::connect(this, &Nexus::saveGlobal, &settings, &Settings::saveGlobal);
 }
@@ -220,8 +221,8 @@ void Nexus::showMainGUI()
     assert(profile);
 
     // Create GUI
-    widget =
-        std::make_unique<Widget>(*profile, *audioControl, cameraSource, settings, *style, ipc, *this);
+    widget = std::make_unique<Widget>(*profile, *audioControl, cameraSource, settings, *style, ipc,
+                                      imageLoader, *this);
 
     // Start GUI
     widget->init();
diff --git a/src/nexus.h b/src/nexus.h
index 5a1c2e3bf7..ab3ad46604 100644
--- a/src/nexus.h
+++ b/src/nexus.h
@@ -12,16 +12,17 @@
 
 #include <memory>
 
-class Widget;
-class Profile;
-class Settings;
-class LoginScreen;
-class Core;
-class QCommandLineParser;
 class CameraSource;
-class Style;
+class Core;
+class ImageLoader;
 class IMessageBoxManager;
 class IPC;
+class LoginScreen;
+class Profile;
+class QCommandLineParser;
+class Settings;
+class Style;
+class Widget;
 
 #ifdef Q_OS_MAC
 class QMenuBar;
@@ -37,7 +38,7 @@ class Nexus : public QObject
     Q_OBJECT
 public:
     Nexus(Settings& settings, IMessageBoxManager& messageBoxManager, CameraSource& cameraSource,
-          IPC& ipc, QObject* parent = nullptr);
+          IPC& ipc, ImageLoader& imageLoader, QObject* parent = nullptr);
     ~Nexus() override;
     void start();
     void showMainGUI();
@@ -99,4 +100,5 @@ public slots:
     std::unique_ptr<Style> style;
     IMessageBoxManager& messageBoxManager;
     IPC& ipc;
+    ImageLoader& imageLoader;
 };
diff --git a/src/persistence/settings.cpp b/src/persistence/settings.cpp
index b55a21ed8f..100ba511c7 100644
--- a/src/persistence/settings.cpp
+++ b/src/persistence/settings.cpp
@@ -580,6 +580,10 @@ void Settings::loadPersonal(const Profile& profile, bool newProfile)
             }
         });
     });
+
+    inGroup(ps, "Experimental", [this, &ps] {
+        experimentalSandbox = ps.value("sandbox", false).toBool();
+    });
 }
 
 void Settings::resetToDefault()
@@ -808,6 +812,11 @@ void Settings::savePersonal(QString profileName, const ToxEncrypt* passkey)
     inGroup(ps, "Version", [this, &ps] { //
         ps.setValue("settingsVersion", personalSettingsVersion);
     });
+
+    inGroup(ps, "Experimental", [this, &ps] {
+        ps.setValue("sandbox", experimentalSandbox);
+    });
+
     ps.save();
 }
 
@@ -2177,6 +2186,19 @@ bool Settings::getEnableConferencesColor() const
     return nameColors;
 }
 
+bool Settings::getExperimentalSandbox() const
+{
+    QMutexLocker<QRecursiveMutex> locker{&bigLock};
+    return experimentalSandbox;
+}
+
+void Settings::setExperimentalSandbox(bool newValue)
+{
+    if (setVal(experimentalSandbox, newValue)) {
+        emit experimentalSandboxChanged(newValue);
+    }
+}
+
 /**
  * @brief Write a default personal .ini settings file for a profile.
  * @param basename Filename without extension to save settings.
diff --git a/src/persistence/settings.h b/src/persistence/settings.h
index d6de340ed7..e9da4ed29a 100644
--- a/src/persistence/settings.h
+++ b/src/persistence/settings.h
@@ -10,7 +10,6 @@
 #include "src/core/icoresettings.h"
 #include "src/core/idebugsettings.h"
 #include "src/core/toxencrypt.h"
-#include "src/core/toxfile.h"
 #include "src/persistence/iconferencesettings.h"
 #include "src/persistence/ifriendsettings.h"
 #include "src/persistence/inotificationsettings.h"
@@ -223,6 +222,9 @@ public slots:
     void typingNotificationChanged(bool enabled);
     void dbSyncTypeChanged(Db::syncType type);
 
+    // Experimental
+    void experimentalSandboxChanged(bool enabled);
+
 public:
     bool applyCommandLineOptions(const QCommandLineParser& parser);
     static bool verifyProxySettings(const QCommandLineParser& parser);
@@ -466,6 +468,10 @@ public slots:
     void setShowConferenceJoinLeaveMessages(bool newValue) override;
     SIGNAL_IMPL(Settings, showConferenceJoinLeaveMessagesChanged, bool show)
 
+    // Experimental
+    bool getExperimentalSandbox() const;
+    void setExperimentalSandbox(bool newValue);
+
     // State
     QByteArray getWindowGeometry() const;
     void setWindowGeometry(const QByteArray& value);
@@ -706,6 +712,9 @@ private slots:
 
     int themeColor;
 
+    // Experimental features/changes
+    bool experimentalSandbox;
+
     static QRecursiveMutex bigLock;
     static const QString globalSettingsFile;
     static QThread* settingsThread;
diff --git a/src/platform/sandbox.cpp b/src/platform/sandbox.cpp
new file mode 100644
index 0000000000..5b383ce1df
--- /dev/null
+++ b/src/platform/sandbox.cpp
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2025 The TokTok team.
+ */
+
+#include "sandbox.h"
+
+Sandbox::~Sandbox() = default;
diff --git a/src/platform/sandbox.h b/src/platform/sandbox.h
new file mode 100644
index 0000000000..4051c6e85d
--- /dev/null
+++ b/src/platform/sandbox.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2025 The TokTok team.
+ */
+
+#pragma once
+
+#include "src/chatlog/imageloader.h"
+
+class QPixmap;
+class QByteArray;
+
+class Sandbox : public ImageLoader
+{
+public:
+    ~Sandbox() override;
+
+    virtual bool isReady() const = 0;
+};
diff --git a/src/platform/sandbox.rep b/src/platform/sandbox.rep
new file mode 100644
index 0000000000..aa1fd554ac
--- /dev/null
+++ b/src/platform/sandbox.rep
@@ -0,0 +1,6 @@
+#include <QPixmap>
+
+class Sandbox
+{
+    SLOT(QPixmap loadImage(const QByteArray& data));
+}
diff --git a/src/platform/sandboxclient.cpp b/src/platform/sandboxclient.cpp
new file mode 100644
index 0000000000..4cf9cc2ea3
--- /dev/null
+++ b/src/platform/sandboxclient.cpp
@@ -0,0 +1,87 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2025 The TokTok team.
+ */
+
+#include "sandboxclient.h"
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wheader-hygiene"
+#include "rep_sandbox_replica.h"
+#pragma GCC diagnostic pop
+
+#include <QCoreApplication>
+#include <QPixmap>
+#include <QProcess>
+#include <QTimer>
+
+struct SandboxClient::Data
+{
+    explicit Data(QObject* parent) {}
+
+    QRemoteObjectNode repNode;
+    std::unique_ptr<SandboxReplica> sandboxReplica;
+    QProcess server;
+};
+
+SandboxClient::SandboxClient(QObject* parent)
+    : QObject(parent)
+    , d(std::make_unique<Data>(this))
+{
+    qDebug() << "Starting sandbox server";
+    d->server.start(QCoreApplication::applicationFilePath(), {"--sandbox"}, QIODevice::ReadOnly);
+
+    // Write any output from the server to the console.
+    connect(&d->server, &QProcess::readyReadStandardOutput, this,
+            [this] { qDebug() << d->server.readAllStandardOutput(); });
+    connect(&d->server, &QProcess::readyReadStandardError, this,
+            [this] { qWarning() << d->server.readAllStandardError(); });
+
+    // If the server process dies, wait 5 seconds and start it back up.
+    auto restartConnection = connect(&d->server, &QProcess::finished, this, [this](int exitCode) {
+        qWarning() << "Sandbox server died with exit code" << exitCode;
+        QTimer::singleShot(5000, this, [this] {
+            d->server.start(QCoreApplication::applicationFilePath(), {"--sandbox"});
+        });
+    });
+
+    // If our application is about to quit, kill the server process.
+    connect(qApp, &QCoreApplication::aboutToQuit, this, [this, restartConnection] {
+        disconnect(restartConnection);
+        d->server.kill();
+    });
+
+    d->repNode.connectToNode(QUrl(QStringLiteral("local:replica")));
+    d->sandboxReplica.reset(d->repNode.acquire<SandboxReplica>());
+
+    // Wait for up to 2 seconds for the server to start.
+    if (!d->server.waitForStarted(2000)) {
+        qWarning() << "Failed to start sandbox server";
+        return;
+    }
+
+    // Wait for up to 10 seconds for the replica to be acquired.
+    if (!d->sandboxReplica->waitForSource(10000)) {
+        qWarning() << "Failed to acquire sandbox replica";
+    }
+}
+
+SandboxClient::~SandboxClient()
+{
+    d->server.kill();
+}
+
+bool SandboxClient::isReady() const
+{
+    return d->sandboxReplica->isReplicaValid();
+}
+
+QPixmap SandboxClient::loadImage(const QByteArray& data)
+{
+    auto reply = d->sandboxReplica->loadImage(data);
+    reply.waitForFinished();
+    if (!reply.isFinished()) {
+        qWarning() << "Failed to load image from sandbox" << reply.error();
+        return {};
+    }
+    return reply.returnValue();
+}
diff --git a/src/platform/sandboxclient.h b/src/platform/sandboxclient.h
new file mode 100644
index 0000000000..1cd6d32591
--- /dev/null
+++ b/src/platform/sandboxclient.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2025 The TokTok team.
+ */
+
+#pragma once
+
+#include "sandbox.h"
+#include <QObject>
+
+#include <memory>
+
+class QPixmap;
+class QByteArray;
+
+class SandboxClient : public QObject, public Sandbox
+{
+    Q_OBJECT
+
+public:
+    SandboxClient(QObject* parent);
+    ~SandboxClient();
+
+    bool isReady() const override;
+    QPixmap loadImage(const QByteArray& data) override;
+
+private:
+    struct Data;
+    std::unique_ptr<Data> d;
+};
diff --git a/src/platform/sandboxserver.cpp b/src/platform/sandboxserver.cpp
new file mode 100644
index 0000000000..bb6d4724bf
--- /dev/null
+++ b/src/platform/sandboxserver.cpp
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2025 The TokTok team.
+ */
+
+#include "sandboxserver.h"
+
+#include "src/model/exiftransform.h"
+
+#include <QImage>
+
+SandboxServer::SandboxServer(QObject* parent)
+    : SandboxSimpleSource(parent)
+{
+}
+
+SandboxServer::~SandboxServer() = default;
+
+bool SandboxServer::isReady() const
+{
+    return true;
+}
+
+QPixmap SandboxServer::loadImage(const QByteArray& data)
+{
+    QImage image = QImage::fromData(data);
+    auto orientation = ExifTransform::getOrientation(data);
+    image = ExifTransform::applyTransformation(image, orientation);
+
+    return QPixmap::fromImage(image);
+}
diff --git a/src/platform/sandboxserver.h b/src/platform/sandboxserver.h
new file mode 100644
index 0000000000..e074dff57d
--- /dev/null
+++ b/src/platform/sandboxserver.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2025 The TokTok team.
+ */
+
+#pragma once
+
+#include "sandbox.h"
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wheader-hygiene"
+#include "rep_sandbox_source.h"
+#pragma GCC diagnostic pop
+
+#include <QObject>
+
+class SandboxServer : public SandboxSimpleSource, public Sandbox
+{
+    Q_OBJECT
+
+public:
+    SandboxServer(QObject* parent = nullptr);
+    ~SandboxServer() override;
+
+    bool isReady() const override;
+    QPixmap loadImage(const QByteArray& data) override;
+};
diff --git a/src/widget/form/chatform.cpp b/src/widget/form/chatform.cpp
index 43b0e0a022..bdf5ebe67a 100644
--- a/src/widget/form/chatform.cpp
+++ b/src/widget/form/chatform.cpp
@@ -4,7 +4,6 @@
  */
 
 #include "chatform.h"
-#include "src/chatlog/chatlinecontentproxy.h"
 #include "src/chatlog/chatmessage.h"
 #include "src/chatlog/chatwidget.h"
 #include "src/chatlog/content/filetransferwidget.h"
@@ -16,7 +15,6 @@
 #include "src/model/status.h"
 #include "src/nexus.h"
 #include "src/persistence/history.h"
-#include "src/persistence/offlinemsgengine.h"
 #include "src/persistence/profile.h"
 #include "src/persistence/settings.h"
 #include "src/video/netcamview.h"
@@ -24,7 +22,6 @@
 #include "src/widget/contentdialogmanager.h"
 #include "src/widget/form/loadhistorydialog.h"
 #include "src/widget/imagepreviewwidget.h"
-#include "src/widget/maskablepixmapwidget.h"
 #include "src/widget/searchform.h"
 #include "src/widget/style.h"
 #include "src/widget/tool/callconfirmwidget.h"
@@ -36,6 +33,7 @@
 
 #include <QApplication>
 #include <QClipboard>
+#include <QDragEnterEvent>
 #include <QFileDialog>
 #include <QFileInfo>
 #include <QMessageBox>
@@ -97,10 +95,10 @@ ChatForm::ChatForm(Profile& profile_, Friend* chatFriend, IChatLog& chatLog_,
                    SmileyPack& smileyPack_, CameraSource& cameraSource_, Settings& settings_,
                    Style& style_, IMessageBoxManager& messageBoxManager,
                    ContentDialogManager& contentDialogManager_, FriendList& friendList_,
-                   ConferenceList& conferenceList_, QWidget* parent_)
+                   ConferenceList& conferenceList_, ImageLoader& imageLoader, QWidget* parent_)
     : GenericChatForm(profile_.getCore(), chatFriend, chatLog_, messageDispatcher_, documentCache_,
                       smileyPack_, settings_, style_, messageBoxManager, friendList_,
-                      conferenceList_, parent_)
+                      conferenceList_, imageLoader, parent_)
     , core{profile_.getCore()}
     , f(chatFriend)
     , isTyping{false}
diff --git a/src/widget/form/chatform.h b/src/widget/form/chatform.h
index 84ba350761..dd46564b5a 100644
--- a/src/widget/form/chatform.h
+++ b/src/widget/form/chatform.h
@@ -16,7 +16,6 @@
 #include "src/model/status.h"
 #include "src/persistence/history.h"
 #include "src/video/netcamview.h"
-#include "src/widget/tool/screenshotgrabber.h"
 
 class CallConfirmWidget;
 class ContentDialogManager;
@@ -34,6 +33,7 @@ class Profile;
 class QHideEvent;
 class QMoveEvent;
 class QPixmap;
+class ImageLoader;
 class Settings;
 class SmileyPack;
 class Style;
@@ -46,7 +46,7 @@ class ChatForm : public GenericChatForm
              IMessageDispatcher& messageDispatcher_, DocumentCache& documentCache,
              SmileyPack& smileyPack, CameraSource& cameraSource, Settings& settings, Style& style,
              IMessageBoxManager& messageBoxManager, ContentDialogManager& contentDialogManager,
-             FriendList& friendList, ConferenceList& conferenceList, QWidget* parent = nullptr);
+             FriendList& friendList, ConferenceList& conferenceList, ImageLoader& imageLoader, QWidget* parent = nullptr);
     ~ChatForm() override;
     void setStatusMessage(const QString& newMessage);
 
diff --git a/src/widget/form/conferenceform.cpp b/src/widget/form/conferenceform.cpp
index 5f415f9d8f..1d2363bad6 100644
--- a/src/widget/form/conferenceform.cpp
+++ b/src/widget/form/conferenceform.cpp
@@ -8,21 +8,17 @@
 #include "tabcompleter.h"
 #include "src/chatlog/chatwidget.h"
 #include "src/chatlog/content/text.h"
-#include "src/core/conferenceid.h"
 #include "src/core/core.h"
 #include "src/core/coreav.h"
 #include "src/friendlist.h"
 #include "src/model/conference.h"
 #include "src/model/friend.h"
-#include "src/persistence/iconferencesettings.h"
 #include "src/persistence/settings.h"
 #include "src/widget/chatformheader.h"
 #include "src/widget/conferencewidget.h"
 #include "src/widget/flowlayout.h"
 #include "src/widget/form/chatform.h"
-#include "src/widget/maskablepixmapwidget.h"
 #include "src/widget/style.h"
-#include "src/widget/tool/croppinglabel.h"
 #include "src/widget/translator.h"
 
 #include <QDragEnterEvent>
@@ -70,11 +66,11 @@ QString editName(const QString& name)
 
 ConferenceForm::ConferenceForm(Core& core_, Conference* chatConference, IChatLog& chatLog_,
                                IMessageDispatcher& messageDispatcher_, Settings& settings_,
-                               DocumentCache& documentCache_, SmileyPack& smileyPack_,
-                               Style& style_, IMessageBoxManager& messageBoxManager,
-                               FriendList& friendList_, ConferenceList& conferenceList_)
-    : GenericChatForm(core_, chatConference, chatLog_, messageDispatcher_, documentCache_,
-                      smileyPack_, settings_, style_, messageBoxManager, friendList_, conferenceList_)
+                               DocumentCache& documentCache_, SmileyPack& smileyPack_, Style& style_,
+                               IMessageBoxManager& messageBoxManager, FriendList& friendList_,
+                               ConferenceList& conferenceList_, ImageLoader& imageLoader)
+    : GenericChatForm(core_, chatConference, chatLog_, messageDispatcher_, documentCache_, smileyPack_,
+                      settings_, style_, messageBoxManager, friendList_, conferenceList_, imageLoader)
     , core{core_}
     , conference(chatConference)
     , inCall(false)
diff --git a/src/widget/form/conferenceform.h b/src/widget/form/conferenceform.h
index 98e46d8d46..be1fdc6603 100644
--- a/src/widget/form/conferenceform.h
+++ b/src/widget/form/conferenceform.h
@@ -7,7 +7,7 @@
 
 #include "genericchatform.h"
 #include "src/core/toxpk.h"
-#include "src/persistence/iconferencesettings.h"
+
 #include <QMap>
 
 namespace Ui {
@@ -36,7 +36,7 @@ class ConferenceForm : public GenericChatForm
                    IMessageDispatcher& messageDispatcher_, Settings& settings_,
                    DocumentCache& documentCache, SmileyPack& smileyPack, Style& style,
                    IMessageBoxManager& messageBoxManager, FriendList& friendList,
-                   ConferenceList& conferenceList);
+                   ConferenceList& conferenceList, ImageLoader& imageLoader);
     ~ConferenceForm() override;
 
     void peerAudioPlaying(ToxPk peerPk);
diff --git a/src/widget/form/genericchatform.cpp b/src/widget/form/genericchatform.cpp
index 5fdd6350a3..b080e994e0 100644
--- a/src/widget/form/genericchatform.cpp
+++ b/src/widget/form/genericchatform.cpp
@@ -120,7 +120,7 @@ GenericChatForm::GenericChatForm(const Core& core_, const Chat* chat, IChatLog&
                                  IMessageDispatcher& messageDispatcher_, DocumentCache& documentCache,
                                  SmileyPack& smileyPack_, Settings& settings_, Style& style_,
                                  IMessageBoxManager& messageBoxManager, FriendList& friendList_,
-                                 ConferenceList& conferenceList_, QWidget* parent_)
+                                 ConferenceList& conferenceList_, ImageLoader& imageLoader, QWidget* parent_)
     : QWidget(parent_, Qt::Window)
     , core{core_}
     , audioInputFlag(false)
@@ -138,7 +138,7 @@ GenericChatForm::GenericChatForm(const Core& core_, const Chat* chat, IChatLog&
     searchForm = new SearchForm(settings, style);
     dateInfo = new QLabel(this);
     chatWidget = new ChatWidget(chatLog_, core, documentCache, smileyPack, settings, style,
-                                messageBoxManager, this);
+                                messageBoxManager, imageLoader, this);
     searchForm->hide();
     dateInfo->setAlignment(Qt::AlignHCenter);
     dateInfo->setVisible(false);
diff --git a/src/widget/form/genericchatform.h b/src/widget/form/genericchatform.h
index d6a8f29d92..701c8e496a 100644
--- a/src/widget/form/genericchatform.h
+++ b/src/widget/form/genericchatform.h
@@ -8,7 +8,6 @@
 #include "src/chatlog/chatmessage.h"
 #include "src/core/toxpk.h"
 #include "src/model/ichatlog.h"
-#include "src/widget/searchtypes.h"
 
 #include <QMenu>
 #include <QWidget>
@@ -19,32 +18,30 @@
  *        - Even a different font is not enough – TODO #1307 ~~zetok
  */
 
+class Chat;
 class ChatFormHeader;
-class ChatWidget;
 class ChatTextEdit;
-class Chat;
+class ChatWidget;
 class ContentLayout;
 class CroppingLabel;
+class DocumentCache;
 class FlyoutOverlayWidget;
+class FriendList;
 class GenericNetCamView;
+class IMessageBoxManager;
+class IMessageDispatcher;
 class MaskablePixmapWidget;
-class SearchForm;
-class Widget;
-
 class QLabel;
 class QPushButton;
 class QSplitter;
 class QToolButton;
 class QVBoxLayout;
-
-class IMessageDispatcher;
-struct Message;
-class DocumentCache;
-class SmileyPack;
+class SearchForm;
 class Settings;
+class SmileyPack;
 class Style;
-class IMessageBoxManager;
-class FriendList;
+class Widget;
+struct Message;
 
 namespace Ui {
 class MainWindow;
@@ -64,7 +61,7 @@ class GenericChatForm : public QWidget
                     IMessageDispatcher& messageDispatcher_, DocumentCache& documentCache,
                     SmileyPack& smileyPack, Settings& settings, Style& style,
                     IMessageBoxManager& messageBoxmanager, FriendList& friendList,
-                    ConferenceList& conferenceList, QWidget* parent_ = nullptr);
+                    ConferenceList& conferenceList, ImageLoader& imageLoader, QWidget* parent_ = nullptr);
     ~GenericChatForm() override;
 
     void setName(const QString& newName);
diff --git a/src/widget/form/settings/advancedform.cpp b/src/widget/form/settings/advancedform.cpp
index 63a7b95c01..db6a5fdaf3 100644
--- a/src/widget/form/settings/advancedform.cpp
+++ b/src/widget/form/settings/advancedform.cpp
@@ -13,7 +13,6 @@
 #include <QMessageBox>
 #include <QProcess>
 
-#include "src/model/status.h"
 #include "src/persistence/profile.h"
 #include "src/persistence/settings.h"
 #include "src/widget/tool/imessageboxmanager.h"
@@ -57,6 +56,8 @@ AdvancedForm::AdvancedForm(Settings& settings_, Style& style, IMessageBoxManager
     bodyUI->cbEnableLanDiscovery->setChecked(settings.getEnableLanDiscovery() && udpEnabled);
     bodyUI->cbEnableLanDiscovery->setEnabled(udpEnabled);
 
+    bodyUI->cbExperimentalSandbox->setChecked(settings.getExperimentalSandbox());
+
     QString warningBody =
         tr("Unless you %1 know what you are doing, "
            "please do %2 change anything here. Changes "
@@ -148,10 +149,8 @@ void AdvancedForm::on_btnCopyDebug_clicked()
 void AdvancedForm::on_resetButton_clicked()
 {
     const QString title = tr("Reset settings");
-    bool result =
-        messageBoxManager.askQuestion(title,
-                                      tr("All settings will be reset to default. Are you sure?"),
-                                      tr("Yes"), tr("No"));
+    bool result = messageBoxManager.askQuestion( //
+        title, tr("All settings will be reset to default. Are you sure?"), tr("Yes"), tr("No"));
 
     if (!result)
         return;
@@ -212,6 +211,12 @@ void AdvancedForm::on_proxyType_currentIndexChanged(int index)
     settings.setProxyType(proxytype);
 }
 
+void AdvancedForm::on_cbExperimentalSandbox_stateChanged()
+{
+    settings.setExperimentalSandbox(bodyUI->cbExperimentalSandbox->isChecked());
+}
+
+
 /**
  * @brief Retranslate all elements in the form.
  */
diff --git a/src/widget/form/settings/advancedform.h b/src/widget/form/settings/advancedform.h
index 2ab0a21bf0..ed0eb62889 100644
--- a/src/widget/form/settings/advancedform.h
+++ b/src/widget/form/settings/advancedform.h
@@ -42,6 +42,8 @@ private slots:
     void on_proxyAddr_editingFinished();
     void on_proxyPort_valueChanged(int port);
     void on_proxyType_currentIndexChanged(int index);
+    // Experimental
+    void on_cbExperimentalSandbox_stateChanged();
 
 private:
     void retranslateUi();
diff --git a/src/widget/form/settings/advancedsettings.ui b/src/widget/form/settings/advancedsettings.ui
index a4ec756c57..d25eca7fa5 100644
--- a/src/widget/form/settings/advancedsettings.ui
+++ b/src/widget/form/settings/advancedsettings.ui
@@ -24,7 +24,7 @@
        <rect>
         <x>0</x>
         <y>0</y>
-        <width>485</width>
+        <width>479</width>
         <height>545</height>
        </rect>
       </property>
@@ -35,21 +35,21 @@
           <string notr="true">{IMPORTANT NOTE HERE}</string>
          </property>
          <property name="textFormat">
-          <enum>Qt::RichText</enum>
+          <enum>Qt::TextFormat::RichText</enum>
          </property>
          <property name="alignment">
-          <set>Qt::AlignCenter</set>
+          <set>Qt::AlignmentFlag::AlignCenter</set>
          </property>
          <property name="wordWrap">
           <bool>true</bool>
          </property>
          <property name="textInteractionFlags">
-          <set>Qt::TextSelectableByKeyboard|Qt::TextSelectableByMouse</set>
+          <set>Qt::TextInteractionFlag::TextSelectableByKeyboard|Qt::TextInteractionFlag::TextSelectableByMouse</set>
          </property>
         </widget>
        </item>
        <item>
-        <widget class="QGroupBox" name="ProtableGroup">
+        <widget class="QGroupBox" name="portableGroup">
          <property name="title">
           <string>Portable</string>
          </property>
@@ -111,7 +111,7 @@
           <string>Connection settings</string>
          </property>
          <property name="alignment">
-          <set>Qt::AlignLeading|Qt::AlignLeft|Qt::AlignTop</set>
+          <set>Qt::AlignmentFlag::AlignLeading|Qt::AlignmentFlag::AlignLeft|Qt::AlignmentFlag::AlignTop</set>
          </property>
          <layout class="QVBoxLayout" name="verticalLayoutProxy">
           <property name="topMargin">
@@ -215,8 +215,24 @@
             </item>
            </layout>
           </item>
+         </layout>
+        </widget>
+       </item>
+       <item>
+        <widget class="QGroupBox" name="experimentalGroup">
+         <property name="title">
+          <string>Experimental features</string>
+         </property>
+         <layout class="QVBoxLayout" name="experimentalLayout">
           <item>
-           <layout class="QHBoxLayout" name="horizontalLayout_4"/>
+           <widget class="QCheckBox" name="cbExperimentalSandbox">
+            <property name="toolTip">
+             <string extracomment="describes sandbox checkbox">Use a separate process for image parsing.</string>
+            </property>
+            <property name="text">
+             <string>Process sandboxing (requires restart)</string>
+            </property>
+           </widget>
           </item>
          </layout>
         </widget>
@@ -231,7 +247,7 @@
        <item>
         <spacer name="verticalSpacer">
          <property name="orientation">
-          <enum>Qt::Vertical</enum>
+          <enum>Qt::Orientation::Vertical</enum>
          </property>
          <property name="sizeHint" stdset="0">
           <size>
diff --git a/src/widget/imagepreviewwidget.cpp b/src/widget/imagepreviewwidget.cpp
index 3c1f41a723..a037ee383f 100644
--- a/src/widget/imagepreviewwidget.cpp
+++ b/src/widget/imagepreviewwidget.cpp
@@ -4,7 +4,7 @@
  */
 
 #include "imagepreviewwidget.h"
-#include "src/model/exiftransform.h"
+#include "src/platform/sandbox.h"
 
 #include <QApplication>
 #include <QBuffer>
@@ -14,18 +14,17 @@
 #include <QString>
 
 namespace {
-QPixmap pixmapFromFile(const QString& filename)
+static const QStringList previewExtensions = {
+    "gif",  // Graphics Interchange Format
+    "jpeg", // Joint Photographic Experts Group
+    "jpg",  // Joint Photographic Experts Group
+    "png",  // Portable Network Graphics
+    "qoi",  // Quite OK Image Format
+    "svg",  // Scalable Vector Graphics
+    "webp", // WebP
+};
+QPixmap pixmapFromFile(ImageLoader& imageLoader, const QString& filename)
 {
-    static const QStringList previewExtensions = {
-        "gif",  // Graphics Interchange Format
-        "jpeg", // Joint Photographic Experts Group
-        "jpg",  // Joint Photographic Experts Group
-        "png",  // Portable Network Graphics
-        "qoi",  // Quite OK Image Format
-        "svg",  // Scalable Vector Graphics
-        "webp", // WebP
-    };
-
     if (!previewExtensions.contains(QFileInfo(filename).suffix().toLower())) {
         return {};
     }
@@ -35,12 +34,7 @@ QPixmap pixmapFromFile(const QString& filename)
         return {};
     }
 
-    const QByteArray imageFileData = imageFile.readAll();
-    QImage image = QImage::fromData(imageFileData);
-    auto orientation = ExifTransform::getOrientation(imageFileData);
-    image = ExifTransform::applyTransformation(image, orientation);
-
-    return QPixmap::fromImage(image);
+    return imageLoader.loadImage(imageFile.readAll());
 }
 
 QPixmap scaleCropIntoSquare(const QPixmap& source, const int targetSize)
@@ -108,9 +102,9 @@ void ImagePreviewButton::initialize(const QPixmap& image)
     setToolTip(getToolTipDisplayingImage(image));
 }
 
-void ImagePreviewButton::setIconFromFile(const QString& filename)
+void ImagePreviewButton::setIconFromFile(ImageLoader& imageLoader, const QString& filename)
 {
-    initialize(pixmapFromFile(filename));
+    initialize(pixmapFromFile(imageLoader, filename));
 }
 
 void ImagePreviewButton::setIconFromPixmap(const QPixmap& pixmap)
diff --git a/src/widget/imagepreviewwidget.h b/src/widget/imagepreviewwidget.h
index 2b62e67518..ed2bbaa613 100644
--- a/src/widget/imagepreviewwidget.h
+++ b/src/widget/imagepreviewwidget.h
@@ -9,6 +9,8 @@
 #include <QPushButton>
 #include <QString>
 
+class ImageLoader;
+
 class ImagePreviewButton : public QPushButton
 {
 public:
@@ -22,7 +24,7 @@ class ImagePreviewButton : public QPushButton
     ImagePreviewButton(ImagePreviewButton&&) = delete;
     ImagePreviewButton& operator=(ImagePreviewButton&&) = delete;
 
-    void setIconFromFile(const QString& filename);
+    void setIconFromFile(ImageLoader& imageLoader, const QString& filename);
     void setIconFromPixmap(const QPixmap& pixmap);
 
 private:
diff --git a/src/widget/widget.cpp b/src/widget/widget.cpp
index e3863283af..ab238a8634 100644
--- a/src/widget/widget.cpp
+++ b/src/widget/widget.cpp
@@ -5,6 +5,7 @@
 
 #include "widget.h"
 
+#include <QtCore/qlogging.h>
 #include <cassert>
 
 #include <QActionGroup>
@@ -127,7 +128,8 @@ void Widget::acceptFileTransfer(const ToxFile& file, const QString& path)
 Widget* Widget::instance{nullptr};
 
 Widget::Widget(Profile& profile_, IAudioControl& audio_, CameraSource& cameraSource_,
-               Settings& settings_, Style& style_, IPC& ipc_, Nexus& nexus_, QWidget* parent)
+               Settings& settings_, Style& style_, IPC& ipc_, ImageLoader& imageLoader_,
+               Nexus& nexus_, QWidget* parent)
     : QMainWindow(parent)
     , profile{profile_}
     , trayMenu{nullptr}
@@ -147,6 +149,7 @@ Widget::Widget(Profile& profile_, IAudioControl& audio_, CameraSource& cameraSou
     , contentDialogManager(new ContentDialogManager(*friendList))
     , ipc{ipc_}
     , toxSave(new ToxSave{settings, ipc, this})
+    , imageLoader(imageLoader_)
     , nexus{nexus_}
 {
     installEventFilter(this);
@@ -1188,7 +1191,7 @@ void Widget::addFriend(uint32_t friendId, const ToxPk& friendPk)
     auto friendForm =
         new ChatForm(profile, newFriend, *chatHistory, *friendMessageDispatcher, *documentCache,
                      *smileyPack, cameraSource, settings, style, *messageBoxManager,
-                     *contentDialogManager, *friendList, *conferenceList, this);
+                     *contentDialogManager, *friendList, *conferenceList, imageLoader, this);
     connect(friendForm, &ChatForm::updateFriendActivity, this, &Widget::updateFriendActivity);
 
     friendMessageDispatchers[friendPk] = friendMessageDispatcher;
@@ -1298,8 +1301,19 @@ void Widget::onFriendStatusMessageChanged(uint32_t friendId, const QString& mess
     str.replace('\n', ' ').remove('\r').remove(QChar('\0'));
     f->setStatusMessage(str);
 
-    friendWidgets[friendPk]->setStatusMsg(str);
-    chatForms[friendPk]->setStatusMessage(str);
+    FriendWidget* friendWidget = friendWidgets[friendPk];
+    if (friendWidget == nullptr) {
+        qCritical() << "FriendWidget not found for friend" << friendId;
+    } else {
+        friendWidget->setStatusMsg(str);
+    }
+
+    ChatForm* chatForm = chatForms[friendPk];
+    if (chatForm == nullptr) {
+        qCritical() << "ChatForm not found for friend" << friendId;
+    } else {
+        chatForm->setStatusMessage(str);
+    }
 }
 
 void Widget::onFriendDisplayedNameChanged(const QString& displayed)
@@ -2147,7 +2161,7 @@ Conference* Widget::createConference(uint32_t conferencenumber, const Conference
 
     auto form = new ConferenceForm(*core, newConference, *chatHistory, *messageDispatcher, settings,
                                    *documentCache, *smileyPack, style, *messageBoxManager,
-                                   *friendList, *conferenceList);
+                                   *friendList, *conferenceList, imageLoader);
     connect(&settings, &Settings::nameColorsChanged, form, &GenericChatForm::setColorizedNames);
     form->setColorizedNames(settings.getEnableConferencesColor());
     conferenceMessageDispatchers[conferenceId] = messageDispatcher;
diff --git a/src/widget/widget.h b/src/widget/widget.h
index 5b4ec093ad..ec92caf115 100644
--- a/src/widget/widget.h
+++ b/src/widget/widget.h
@@ -36,24 +36,34 @@ class MainWindow;
 class AddFriendForm;
 class AlSink;
 class Camera;
+class CameraSource;
 class ChatForm;
+class ChatHistory;
 class CircleWidget;
+class Conference;
+class ConferenceForm;
+class ConferenceInvite;
+class ConferenceInviteForm;
+class ConferenceList;
+class ConferenceRoom;
+class ConferenceWidget;
 class ContentDialog;
+class ContentDialogManager;
 class ContentLayout;
 class Core;
 class FilesForm;
 class Friend;
 class FriendChatroom;
+class FriendList;
 class FriendListWidget;
 class FriendWidget;
 class GenericChatroomWidget;
-class Conference;
-class ConferenceForm;
-class ConferenceRoom;
-class ConferenceInvite;
-class ConferenceInviteForm;
-class ConferenceWidget;
+class IChatLog;
+class ImageLoader;
+class IMessageBoxManager;
+class IPC;
 class MaskablePixmapWidget;
+class Nexus;
 class ProfileForm;
 class ProfileInfo;
 class QActionGroup;
@@ -61,23 +71,14 @@ class QMenu;
 class QPushButton;
 class QSplitter;
 class QTimer;
-class SettingsWidget;
-class SystemTrayIcon;
-class VideoSurface;
-class UpdateCheck;
 class Settings;
-class IChatLog;
-class ChatHistory;
+class SettingsWidget;
 class SmileyPack;
-class CameraSource;
 class Style;
-class IMessageBoxManager;
-class ContentDialogManager;
-class FriendList;
-class ConferenceList;
-class IPC;
+class SystemTrayIcon;
 class ToxSave;
-class Nexus;
+class UpdateCheck;
+class VideoSurface;
 
 class Widget final : public QMainWindow
 {
@@ -115,7 +116,7 @@ class Widget final : public QMainWindow
 
 public:
     Widget(Profile& profile_, IAudioControl& audio_, CameraSource& cameraSource, Settings& settings,
-           Style& style, IPC& ipc, Nexus& nexus, QWidget* parent = nullptr);
+           Style& style, IPC& ipc, ImageLoader& imageLoader_, Nexus& nexus, QWidget* parent = nullptr);
     ~Widget() override;
     void init();
     void setCentralWidget(QWidget* widget, const QString& widgetName);
@@ -366,7 +367,6 @@ private slots:
     QMap<ConferenceId, QSharedPointer<ConferenceForm>> conferenceForms;
     Core* core = nullptr;
 
-
     std::unique_ptr<MessageProcessor::SharedParams> sharedMessageProcessorParams;
     std::unique_ptr<NotificationGenerator> notificationGenerator;
     std::unique_ptr<DesktopNotify> notifier;
@@ -392,5 +392,6 @@ private slots:
     std::unique_ptr<ContentDialogManager> contentDialogManager;
     IPC& ipc;
     std::unique_ptr<ToxSave> toxSave;
+    ImageLoader& imageLoader;
     Nexus& nexus;
 };