4 ms·

Browsers are not supposed to let javascript access the DOM or events in a cross-domain iframe, is that not correct?

• cpdt 9y ago
  Correct, but it's still possible for the parent page to overlay invisible textboxes and buttons in order to capture input.
  • chongli 9y ago
    Wow, what a tire fire the web has turned out to be. Can we just throw the whole thing out and start over? I miss the 90s...