I have a website say www.example.com.

I include an iframe in www.example.com which loads a another page (say evil.example.net).

What can the owner of evil.example.net do to attack www.example.com?


Your main concern will be malicious javascript, actionscript (flash), Adobe Acrobat and Java Runtime code. These are all web attack surfaces that can be exploited to infect someone via (out-of date) browser plugins.

The problem you're describing is exactly what happens when a popular site accidentally distributes mailicious ads

  • Thanks for the answer. I can post this as a separate question, but is there something that www.evil.com can do when within the iframe of www.good.com which it cannot do if a user directly visited www.evil.com? – Chip Oct 14 '16 at 10:23
  • FYI- I've posted this: security.stackexchange.com/questions/139759/… asking a more specific question. – Chip Oct 14 '16 at 11:09
  • Not when implemented correctly. It would be disastrous is an ad were to have control over the page hosting it. The other way aound however, there are some considerations; if you login page permits being iFramed, an attacker can host your login form and sniff keystrokes. (Cross-Frame Scripting) – J.A.K. Oct 14 '16 at 12:54

By default iframes and the webpage that contains them are completely independent and separate. Neither the parent document nor the iframe has access to each other's DOM, CSS styles, or JavaScript functions if they're not from the same domain.

Keep in mind though that cross-domain iframes still have the ability to trigger alerts, run (malicious?) plugins, autoplay videos, and present submittable forms in an attempt to phish users' information.

Thankfully, the ability to restrict iframes is supported by IE (v10+), Firefox, Chrome, and Safari. It's called the sandbox attribute. With this attribute set, the document inside the iframe cannot do any of the following even if it's from the same origin:

  • Run any JavaScript
  • Change the parent's URL
  • Open pop-ups, new windows, or new tabs
  • Submit forms
  • Run plug-ins
  • Use pointer lock
  • Read cookies or local storage from the parent

See here for examples and more info: https://steemit.com/security/@gaottantacinque/steemit-security-check-iframe-tricks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.