Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Generally, on pages/domains where you may provide users with a sign in box (such as the Google Accounts login page), you want to disallow other sites from iframing your page to prevent a clickjacking attack – http://en.wikipedia.org/wiki/Clickjacking

So Google.com busts out of cross-domain iframes by default to prevent attacks like this.



Sure, and Google normally does disable iframing — the particular URL that com.google frames is configured to not serve the X-Frame-Options HTTP, allowing this trick to work. Clicking "Sign In" breaks out of the frame (target="_top").

But that goes for all browsers — I wonder why is Chrome for iOS is being singled out here?


Chrome on iOS has some input handling issues inside the iframe.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: