# iframe
## Overview
The [\
```
where `https://malicious-website.com/toplevel.html` is:
```html
```
when the `iframe` is loaded, the parent will be redirected to the `https://malware-website.com/pwned.html` page, even if the child document is loaded from a different origin. In this case, the same origin policy will be bypassed because the `iframe` is not being "sandboxed", check out the [sandbox](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe) iframe attribute.
References:
* [\ and \