Take the 2-minute tour ×

In this 2003 blog post, Mark Pilgrim suggests that iframe tags are dangerous, and should be stripped as a component of HTML sanitization:


In what ways can an iframe tag containing untrusted content be dangerous?

share|improve this question
Is there a particular thread you would like to point me to? Almost all of the threads I looked at that were returned by that search query are answered with something along the lines of "cross-site scripting restrictions prevent XSS attacks via iframes". –  rmh Apr 25 '11 at 21:03
add comment

1 Answer

The potential attack scope is pretty broad and the only saving grace is what you eluded to in your comment regarding the DOM disallowing script form one domain directly interacting with that from another (i.e. iframe accessing cookies from the arent page). However, there's no guarantee that the "untrusted" contents of the iframe won't contain any number of vulnerabilities itself, including XSS which could rewrite the contents of the frame.

Then of course there are various levels of browser manipulation the iframe can perform such as redirecting the page which then makes you vulnerable to attacks like tabnapping. Or the iframe could simply serve up a nice little malware package.

The problem with having an iframe with an untrusted site is that to the end user, it's very well integrated and for all intents and purposes, it's part of your site. Beyond the security risks outlined above, you will be perceived to be responsible for the contents and given it's untrusted, you have no assurance as to whether that content is objectionable or not.

In short, you want to be pretty confident in the integrity of the page you're loading into that frame (i.e. Twitter or Facebook button). I certainly wouldn't be allowing an arbitrary, user defined page to be loaded into a publicly facing site.

share|improve this answer
Thanks, by "untrusted" I really meant "cross-domain and third-party". This is a good answer. –  rmh Apr 26 '11 at 18:05
Personally, I would still treat this as untrusted. I work by this definition: troy.hn/bSHXwE - "Untrusted data comes from any source – either direct or indirect – where integrity is not verifiable and intent may be malicious. This includes manual user input such as form data, implicit user input such as request headers and constructed user input such as query string variables. Consider the application to be a black box and any data entering it to be untrusted." You might logically trust the owner of the iframe, but how well have they secured that page? –  Troy Hunt Apr 26 '11 at 21:03
add comment

Your Answer


