Hacker News Reader

unrelated. I create iframe with victim website and i don't set sandbox attribute.

And, obviously, victim cannot set sandbox for itself

Sorry, I misinterpreted your attack, and it's more worrying than I initially thought. I would add some information about the fix, namely adding the header "X-Frame-Options: SAMEORIGIN" [1].

[1] https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Option...

yes SAMEORIGIN/DENY is perfect solution. but, damn it, insecure-by-default and any site is frameable by default so far.

Reply on news.ycombinator.com