The InfoBox does indeed run in an iframe for security and sanitation purposes. You can remove all restrictions by calling the below line of code after creating the view:

viewer.infoBox.frame.removeAttribute('sandbox');

Only do this if you are in complete control of the data that will be loaded into the InfoBox, otherwise it is a security issue.

You can style the infoBox just as easy by injecting any css you want into the viewer.infoBox.frame for example:

            var cssLink = frameDocument.createElement("link");
            cssLink.href = buildModuleUrl('Path/To/Your/CSS/File.css');
            cssLink.rel = "stylesheet";
            cssLink.type = "text/css";
            viewer.infoBox.frame.contentDocument.head.appendChild(cssLink);

By default, we inject the contents of Widgets/InfoBox/InfoBoxDescription.css

You can also style outer InfoBox properties by overriding the CSS classes defined in Widgets/InfoBox/InfoBox.css in your own apps css file. I’m not sure if you’ll be able to add draggable support in this way, but you can do a bunch of other stuff.

If you want to replace the infoBox completely, then simply pass “infoBox: false” to the Viewer constructor. It’s then up to you to bring up your own widget when an entity is selected. The InfoBox simply displayed the content of the entity.description property. You could copy/paste the existing InfoBox code as a starting point.

http://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/