Menu
The sandbox attribute added for iFrame elements in HTML5 spec renders any frame breaking/busting/killing method null in modern browsers (tested with current version of Chrome & Safari) if the flag allow-top-navigation is not set, even if the flags allow-forms and allow-scripts are present.
Any JavaScript method out there, such as if(top != self)
top.location.replace(location);
Triggering a submit event on a form
with the target="_top" attribute
Triggering a click event on an
anchor element with the target="_top" attribute. In fact, anchor elements with the target="_top" attribute are rendered useless. So, a nice message to advice users to take action won't work either (as shown in this Flickr iFrame example).
I want a way to break out of frames on modern browsers, which have implemented the sandbox attribute for iFrames with the flags allow-forms and allow-scripts present?
Seems like they have just given the missing pieces of a puzzle to all black hats with this attribute.
I am looking for a solution, which will break out of frames. Not for a solution, which won't display the site inside frames (such as X-Frame-Options response header) or using CSS to hide the body and such.
602
On Android, open the Google Chrome menu, then tap on Settings > Privacy and security > Privacy Sandbox.
You can remove the sandbox attribute from the element using iframe. removeAttribute("sandbox") this will make the iframe non-sandboxed for the next content you load into it, not the currently loaded one.
Given an iframe with an empty sandbox attribute, the framed document will be fully sandboxed, subjecting it to the following restrictions: JavaScript will not execute in the framed document. This not only includes JavaScript explicitly loaded via script tags, but also inline event handlers and javascript: URLs.
I am afraid that you won't find a solution, as the point of the sandbox is that you can't break out of it.
If there was a hack to break out, it would be classified as a security issue by the vendor and patched quickly.
111
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
