Which vulnerability occurs when scripts do not validate untrusted input, enabling code injection via frames across browsers?

Which vulnerability occurs when scripts do not validate untrusted input, enabling code injection via frames across browsers?

• A. Oversize Payloads
• B. Frame Injection
• C. Recursive Payloads
• D. Web API

Answer: (B)

Frame injection occurs when untrusted input isn’t validated, allowing attacker-controlled content to be injected into a frame or iframe and executed in the browser. When a page builds or renders frame content from user-supplied data, an attacker can craft payloads that run within the framed context, and potentially interact with the parent page or other frames across browsers. The core defense is rigorous input validation and output encoding, plus controls like sandboxed iframes and Content Security Policy to restrict what framed content can do. Other options don’t describe cross-frame code injection: oversize payloads point to overflow issues, recursive payloads isn’t a standard vulnerability term, and Web API refers to interfaces rather than a vulnerability.

Frame injection occurs when untrusted input isn’t validated, allowing attacker-controlled content to be injected into a frame or iframe and executed in the browser. When a page builds or renders frame content from user-supplied data, an attacker can craft payloads that run within the framed context, and potentially interact with the parent page or other frames across browsers. The core defense is rigorous input validation and output encoding, plus controls like sandboxed iframes and Content Security Policy to restrict what framed content can do. Other options don’t describe cross-frame code injection: oversize payloads point to overflow issues, recursive payloads isn’t a standard vulnerability term, and Web API refers to interfaces rather than a vulnerability.