# Framing and consent prompt bypass

Framing defenses or consent prompts that a global grant, wrapper scheme, or sandbox can silently skip

_Area: Web business logic and race conditions. Seen in 3 disclosed reports; latest 2018-12-17. Updated 2026-10-31._

## How it works
A page assumes a protection layer enforces consent or blocks framing, but the layer is weaker than the assumption. Three ways it breaks: (1) the framing defense only checks the top window's origin, so a nested attacker frame defeats SAMEORIGIN; (2) the consent step is JavaScript, so an HTML5 sandbox that disables scripts but keeps forms working skips it; (3) a permission decision is stored globally instead of per-origin, and a generic wrapper scheme forwards to inner schemes without re-prompting. In each case the user never sees the intended prompt or block.

## Where it shows up
- Framing protection relying only on X-Frame-Options SAMEORIGIN, or on CSP2 frame-ancestors where older browsers (Safari/IE) lack support [E1](https://bugbountylibrary.com/r/h1%3A85624.md)
- User-controlled HTML embedded in an iframe on the main origin (player cards, embeds) [E1](https://bugbountylibrary.com/r/h1%3A85624.md)
- Clickjacking confirmation implemented in JS (confirm dialogs, data-confirm attributes) on payment/checkout buttons [E2](https://bugbountylibrary.com/r/h1%3A54733.md)
- Iframes that can be sandboxed with allow-forms, disabling scripts while forms still submit [E2](https://bugbountylibrary.com/r/h1%3A54733.md)
- Permission prompts remembered globally rather than per-origin [E3](https://bugbountylibrary.com/r/h1%3A416040.md)
- Generic wrapper schemes (url:) that forward to other registered handlers [E3](https://bugbountylibrary.com/r/h1%3A416040.md)

## How to review
The invariant: every sensitive action must require a consent or framing check that cannot be skipped by nesting, sandboxing, or a prior global grant. Check that framing defense uses frame-ancestors with a fallback for browsers lacking it, and that it compares the real embedding chain, not just the top window. For consent, verify the confirmation is enforced server-side or via a mechanism that survives script-disabled iframes. For permissions, confirm grants are scoped per-origin and wrapper schemes re-prompt for the inner scheme.

## Variants seen
- Nested-frame SAMEORIGIN bypass plus sandbox-disabled frame-buster on player card iframes [E1](https://bugbountylibrary.com/r/h1%3A85624.md)
- JS confirmation bypassed via sandbox allow-forms on a checkout iframe [E2](https://bugbountylibrary.com/r/h1%3A54733.md)
- Global permission memory plus url: wrapper forwarding to mailto/bitcoin/telnet [E3](https://bugbountylibrary.com/r/h1%3A416040.md)

## Impact and severity
Led to forced tweets/follows/retweets (wormable) [E1](https://bugbountylibrary.com/r/h1%3A85624.md), silent payment completion [E2](https://bugbountylibrary.com/r/h1%3A54733.md), and launching arbitrary protocol handlers without consent [E3](https://bugbountylibrary.com/r/h1%3A416040.md). Severity rises when the action is financial or self-propagating, and when the bypass works across common browsers.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A85624.md
- E2: https://bugbountylibrary.com/r/h1%3A54733.md
- E3: https://bugbountylibrary.com/r/h1%3A416040.md