CSS isn't the security issue here. IFrames are the security issue; and have been since the first day they were added to a browser.