---
id: 5467
title: "Framing without iframes"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/framing-without-iframes"
published_at: "2022-07-27T14:57:00Z"
tags: ["firefox", "xss", "iframes", "cheat-sheet", "embed", "tabindex"]
phying_url: "https://phying.com/item/5467"
lang: en
---

# Framing without iframes

## Summary

Chrome allows framing sites via param tags inside object and embed's code attribute; Firefox now matches Chrome's tabindex onfocus behaviour. Vectors documented in the XSS cheat sheet.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-07-27T14:57:00Z
- **Original:** https://portswigger.net/research/framing-without-iframes
- **Phying News:** https://phying.com/item/5467