Framing without iframes
Summary: PortSwigger researcher Gareth Heyes found new ways to frame a web site without the iframe element: Chrome allows param tags to change the URL of an object tag, and Chrome and WebKit allow the "code" attribute in an embed tag to reference an external URL. He also reported that Firefox now matches Chrome in firing events such as onfocus automatically via tabindex attributes, and the XSS cheat sheet was updated with these findings plus a new regex search interface.
Bottom line: These framing techniques did not yield working XSS in testing - JavaScript URLs failed and data: protocol URLs executed from a null origin - but they remain available to chain other attacks or bypass CSP, and the Firefox tabindex change means a vector that once stayed quiet now fires on its own.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026