iframe abuse
summary
Notes a dozen concrete iframe tricks and whether they actually work: using detect global leaks via a fresh iframe to find leaked variables, using XHR-in-iframe keeps mobile keyboard to avoid disappearing keyboards in iOS webviews, using progressive streaming via script tags as a Comet/WebSocket fallback, running third‑party ads inside an iframe to contain document.write, using an iframe+appcache as an iframe appcache offline fallback, and even a now‑patched tel: iframe factory reset exploit. Each technique is followed by implementation quirks and real outcomes.
AI-written summary · about
chapters (8)
- 0:00Introduction to Iframes
- 2:03History of Frames
- 4:26Dynamic Iframe Manipulation
- 7:07Using Iframes for Hacks
- 9:20Solving Browser Quirks
- 12:18Iframes in Ads and Security
- 14:43Cross-Origin Communication
- 18:13Sandboxing and Future Uses
related talks
29miframes: A look in to the black heart of the browsers
44mIFRAME
36mHTML5 JS Security
42mIframe v Script
27mLocal frames: exploiting inherited origins to bypass content blockers
22mNuances of Iframe: Lessons from Contentstack Live Preview
53mBreaking Limits on Mobile HTML5
20mWhy MCP and ChatGPT Apps Use Double Iframes