it's not all solved because some applications require framing (eg google docs), and you can run this attack against a non-frame target, such a website with html

it's not all solved because some applications require framing (eg google docs), and you can run this attack against a non-frame target, such a website with html injection, but strict CSP