4 ms·

Any reason you couldn't just outright black out any pixels covered by different-origin iframes?

• jgraham 12y ago
  Even some same-origin things, for example input type=file, which can reveal paths on the local filesystem, would have to be blanked out.