Computer system and method for sandboxed applications

A client device 200 downloads a sandboxed application 25 contained within a sandbox 220. The client device is configured to operate a privileged application which is not contained within the sandbox. A relay server 120 external to the client device 200 is arranged to pass messages between the sandboxed application 25 and a privileged application 27 of the client device. The messages maybe filtered for security when they pass through the relay sever 120 and/or on receipt by the privileged application 27, to ensure that the requested operation does not leak information to a malicious attacker, or damage or delete any privileged data on the client device. A content server 110 provides a content application 20 which is downloaded and installed on the client device 200 by the privileged application 27 in response to a request from the sandboxed application 25 received via the relay server 120.