Iframes can leak key presses to an evil parent frame: https://www.owasp.org/index.php/Cross_Frame_Scripting https://www.owasp.org/index.php/Cross_Frame_Scripti

Iframes can leak key presses to an evil parent frame: https://www.owasp.org/index.php/Cross_Frame_Scripting https://www.owasp.org/index.php/Cross_Frame_Scripting > Every key press the browser user makes in the example.com frame, while trying to log into example.com, can be captured by the attacker, and reported back to evil.com. But this is irrelevant - user can't verify if the domain of the iframe is trusted. If the attacker can modify the parent frame javascript he can just replace the iframe with a phishing page.