What are the application security risks of including a hidden 3rd Party iFrame?
If I understand correctly...
- Click jacking isn't an issue for me because I own the parent page
- Same-Origin Policy prevents 3p frame from interacting my dom/cookies/js
- The frame is hidden, so I don't have to worry about anything that may be displayed in the frame
However I did some experiments in the Chrome console and...
- 3p frame can call things like alert/prompt
- 3p frame can redirect the parent via location.href
- Malware inside the 3p frame (java/flash/activeX) could infect my user
I'd love to see a list of the possible issues and any mitigations, but I can't find a good source of information.
So...What are the application security risks of including a hidden 3rd Party iFrame?