I was playing with picture-in-picture attacks on Chrome some time ago and even proposed a way for mitigation, but it was dismissed. Here's the PoC I did: https

I was playing with picture-in-picture attacks on Chrome some time ago and even proposed a way for mitigation, but it was dismissed. Here's the PoC I did: https://www.youtube.com/watch?v=0oega6C5SF0 https://www.youtube.com/watch?v=0oega6C5SF0 And the mitigation I proposed was from this: http://i.imgur.com/8m6UdiC.png http://i.imgur.com/8m6UdiC.png To this: http://i.imgur.com/turRAdc.png http://i.imgur.com/turRAdc.png