Re: Seamless iframes + CSS3 selectors = bad idea

2009/12/8 Adam Barth <w3c@adambarth.com>

> That seems to address the proximate issue, but it feel like
> blacklisting.  Are there other related attacks we're not thinking of
> that would make sense to address at the same time?
>

Well my POC used a dictionary attack to get the value of the first name text
field. There could be information disclosure issues in future. These could
be mitigated by limiting the amount of external requests.