Skip to main content
3 of 6
added 241 characters in body
m0sa Mod
  • 10.9k
  • 2
  • 30
  • 35

Hmn, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like chrome thinks that the utility iframe should be sandboxed from it's parent iframe.

Relevate w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on the example would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates

m0sa Mod
  • 10.9k
  • 2
  • 30
  • 35