Properties are accessible in a sandboxed iframe

13

13

13

This vector attempts to see which properties are available on the parent window of a sandboxed iframe.

Created on: Friday, June 7, 2024 at 7:41:00 PM

Updated on: Wednesday, December 10, 2025 at 9:40:19 PM

Category: Browser Quirks

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

const props = Object.getOwnPropertyNames(window);
for(const prop in document){
  try{
       props.push("document."+prop);
  } catch{}
}
props.forEach(prop => {
    try {
         if(typeof parent[prop] !== 'undefined') {
             log("parent."+prop);
          }
    } catch{}
})

1337