Description
When an inline frame tag (<iframe>) on a webpage references an external resource without the sandbox attribute set, it allows the external URL to manipulate the content within the frame. This can potentially trick users into performing unintended actions, such as submitting passwords or interacting with malicious content.
Recommendation
Mitigate this risk by setting the sandbox attribute for iframes that reference external URLs. The sandbox attribute provides a restricted environment for the iframe’s content, limiting its capabilities and enhancing security.
References
Could your website be exposed too?
SmartScanner can check your website for Insecure Inline Frame and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys - Vulnerability
- Svelte: SSR XSS via Insecure Promise Serialization in hydratable - Vulnerability
- Insecure Direct Object Reference (IDOR) - Vulnerability
- unhead: Streaming SSR `streamKey` injected into inline script without identifier validation - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2024