> For the complete documentation index, see [llms.txt](https://lohitaksh-nandan.gitbook.io/cheat-sheets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lohitaksh-nandan.gitbook.io/cheat-sheets/web-application/html-injection/iframe.md). # iframe The [\ ``` where `https://malicious-website.com/toplevel.html` contains: ```html ``` When the iframe is loaded, the parent will be redirected to the `https://malware-website.com/pwned.html` page, even if the child document is loaded from a different origin. Same origin policy will be bypassed because the iframe is not being "sandboxed", q.v. [sandbox iframe attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe). ## References * [\ and \