An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames. 
CWE-1021 Improper Restriction of Rendered UI Layers or Frames