iframe Injection
Overview
Injecting user-controlled URLs into <iframe src="..."> allows attackers to embed arbitrary external content in the application's page, enabling:
- Content spoofing (fake login forms within trusted domain)
- Clickjacking of inner content
- Cross-site cookie access in older browsers
Remediation
- Validate and whitelist iframe src URLs against allowed domains
- Use
sandboxattribute on iframes - Set CSP
frame-srcto restrict allowed iframe sources