# Sandboxed iframes don't show confirmation screen

Coinbase checkout iframe's JS-based clickjacking confirmation was bypassed using HTML5 sandbox allow-forms, letting a transparent iframe silently complete payments.

- Payout: hidden
- Severity: medium
- Program: Coinbase
- Found by: homakov
- Disclosed: 2015-04-04
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/54733
- Library page: https://bugbountylibrary.com/r/h1%3A54733
- Tags: area:web domain:web impact:funds-loss kind:bounty platform:hackerone sev:medium tech:payment technique:source-review vuln:clickjacking

**Target:** Coinbase checkout page embedded in iframe
**Root cause:** Clickjacking protection relied on JavaScript (data-confirm attribute on Pay button); HTML5 sandbox with allow-forms disables JS in the iframe while forms still submit, so the confirmation never runs.
**Steps:**
1. Embed the Coinbase checkout URL in an iframe with `sandbox="allow-forms"` inside a `data:text/html` page.
2. Set iframe `style="opacity:0.1"` to make it nearly transparent over attacker content.
3. Victim clicks the transparent iframe; the form submits without the JS confirmation screen.
4. Payment is made to the attacker-controlled checkout.
**How found:** Author recalled his 2013 argument that HTML5 sandbox was a bad idea and reasoned that sandbox allow-forms disables JS but keeps forms functional, defeating JS-based clickjacking defenses.
**Exploitation:** Attacker hosts a page with a near-transparent sandboxed iframe pointing at a Coinbase checkout tied to their own address; a victim click submits the payment form directly, bypassing the JS confirm, and funds go to the attacker's external address.
**Insight:** JS-based clickjacking defenses (confirm dialogs, data-confirm attributes) fail inside `sandbox="allow-forms"` iframes because scripts are disabled but form submission still works; test payment/checkout flows for this bypass.