Improper Restriction of Rendered UI Layers or Frames
This vulnerability occurs when a web application fails to properly control whether its pages can be embedded within frames or UI layers from other websites, potentially misleading users about which site they are interacting with.
Modern web applications should actively define which external sites, if any, are permitted to display their content within frames, iframes, or similar embedding elements. Without these security headers (like X-Frame-Options or Content-Security-Policy frame-ancestors), your site becomes vulnerable to clickjacking or UI redressing attacks. This allows malicious actors to overlay their own interface on top of yours, tricking users into performing actions unintentionally. To prevent this, developers must implement server-side restrictions that explicitly deny or whitelist permissible domains for embedding. This is a critical client-side security control that protects user interactions and data integrity by ensuring your application's interface is only rendered in a trusted context, preventing confusion and unauthorized actions.
Impact: Gain Privileges or Assume IdentityBypass Protection MechanismRead Application DataModify Application Data
An attacker can trick a user into performing actions that are masked and hidden from the user's view. The impact varies widely, depending on the functionality of the underlying application. For example, in a social media application, clickjacking could be used to trik the user into changing privacy settings.
- 103Struts: Incomplete validate() Method Definition
- 181Incorrect Behavior Order: Validate Before Filter
- 222Truncation of Security-relevant Information
- 504DEPRECATED: Motivation/Intent
- 506Embedded Malicious Code
- 587Assignment of a Fixed Address to a Pointer
- 654Reliance on a Single Factor in a Security Decision