title: How to break out of a sandboxed iFrame?
body: <h2>1. What is the issue?</h2>
  
  <p>The <a href="http://dev.w3.org/html5/spec/single-page.html#attr-iframe-sandbox" rel="noreferrer"><code>sandbox</code></a> attribute added for <a href="http://dev.w3.org/html5/spec/single-page.html#the-iframe-element" rel="noreferrer">iFrame</a> elements in HTML5 spec renders any frame breaking/busting/killing method null in <a href="http://caniuse.com/iframe-sandbox" rel="noreferrer">modern browsers</a> (tested with current version of Chrome &amp; Safari) if the flag <a href="http://dev.w3.org/html5/spec/single-page.html#sandboxed-top-level-navigation-browsing-context-flag" rel="noreferrer"><code>allow-top-navigation</code></a> is not set, even if the flags <a href="http://dev.w3.org/html5/spec/single-page.html#attr-iframe-sandbox-allow-forms" rel="noreferrer"><code>allow-forms</code></a> and <a href="http://dev.w3.org/html5/spec/single-page.html#attr-iframe-sandbox-allow-scripts" rel="noreferrer"><code>allow-scripts</code></a> are present.</p>
  
  <h2>2. What I have tried?</h2>
  
  <ul>
  <li><p>Any JavaScript method out there, such as <code>if(top != self)
  top.location.replace(location);</code></p></li>
  <li><p>Triggering a submit event on a form
  with the <code>target="_top"</code> attribute</p></li>
  <li><p>Triggering a click event on an
  anchor element with the <code>target="_top"</code> attribute. In fact, anchor elements with the <code>target="_top"</code> attribute are rendered useless. So, a nice message to advice users to take action won't work either (as shown in this <a href="http://jsfiddle.net/Shef/HEaan/" rel="noreferrer">Flickr iFrame example</a>).</p></li>
  </ul>
  
  <h2>3. What I want to achieve?</h2>
  
  <p>I want a way to break out of frames on modern browsers, which have implemented the <code>sandbox</code> attribute for iFrames with the flags <code>allow-forms</code> and <code>allow-scripts</code> present?</p>
  
  <p><em>Seems like they have just given the missing pieces of a puzzle to all black hats with this attribute.</em></p>
  
  <h2>4. What I am not looking for?</h2>
  
  <p>I am looking for a solution, which will break out of frames. Not for a solution, which won't display the site inside frames (such as <a href="https://developer.mozilla.org/en-US/docs/The_X-FRAME-OPTIONS_response_header" rel="noreferrer"><code>X-Frame-Options</code> response header</a>) or using CSS to hide the body and such.</p>