Re: [whatwg/fetch] Split 'document' destination into 'frame' and 'iframe'. (#948)

That attack is possible regardless of whether the initial fetch is `no-cors` or `navigate`. You can also navigate the `object` element from a same-origin document to the target SVG, same problem.

Or is your argument (now, I think it was not before) that navigations of `object` elements should also be `no-cors`? 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/948#issuecomment-553791702