This is not a knockout issue but a security issue.
Google.com uses the x-frame-options HTTP response header to limit who can "frame" their pages (and Google sets the value to SAMEORIGIN meaning only Google.com can iFrame its pages):
If you use Chrome and open up Chrome's developer tools (F12), look at the Console tab when running your fiddle. it displays an error message when your viewmodel tries to update the src:
So, your code works fine, but security reasons prevent you from using
google.com as your iframe source.