4 ms·

Then the attack shifts. The "security check" becomes, drag this link to your bookmark bar and click it.

• simonbrown 15y ago
  A solution to that for browser vendors: Don't let the user drag javascript links from iframes into the bookmark bar.
  • jrockway 15y ago
    Why let users do anything in their browser? What if someone tricks them into jumping out their window?