For legacy reasons the location object is special (you can write to it which is a proxy to writing to `location.href`). Some details here https://developer.mozi

For legacy reasons the location object is special (you can write to it which is a proxy to writing to `location.href`). Some details here https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#Location https://developer.mozilla.org/en-US/docs/Web/Security/Same-o... This is actually quite difficult to protect against while keeping functionality intact (not granting allow-scripts to iframes would do it, but also obviously disable JavaScript). The emerging https://github.com/dtapuska/documentaccess https://github.com/dtapuska/documentaccess standard would be a defense-in-depth against this attack.