Frameable response (potential Clickjacking)
Summary: PortSwigger Research describes clickjacking as an attack that becomes possible when a page fails to set an X-Frame-Options or Content-Security-Policy HTTP header, letting an attacker-controlled page load it in an iframe and overlay it with a different interface. Induced mouse clicks and keystrokes then cause victims to carry out actions in the targeted application unwittingly, circumventing cross-site request forgery defenses, and the page-level "framebusting" code some applications use is described as normally ineffective and usually circumventable by a skilled attacker.
Key Takeaway: The fix is a response header set to DENY or SAMEORIGIN, and the source notes SAMEORIGIN can be partially bypassed if the application itself can be made to frame untrusted websites - so the protection depends on how your own pages handle framing, not just on the header being present.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026