- Security researcher Dinis Costa showed that a bug on a throwaway page can become account takeover when a trusted page embeds that page and hands it secrets.
- Costa said the bug looked useless on its own. Our reading: severity and scope rules that rate each bug alone can miss the chain.
Dinis Costa, a security researcher, argued that a cross-site scripting bug (XSS, a flaw that lets an attacker run code in a page) can look worthless alone. It stops being worthless once a valuable page embeds the flawed page and trusts it. He made the case at OWASP AppSec Days Portugal 2026 in Porto, in a talk the OWASP Foundation published.
What was said
Costa described a simple setup. A page, target.com/games, embeds a page from games.com in an iframe (a window inside a page). The attacker needs XSS on any games.com page, not necessarily the framed one.
The victim must click once on an attacker's site, which Costa called reasonable. The attacker's code then runs inside the frame. It cannot reach the parent directly, but he showed three uses of that position.
First, a phishing form on a domain the victim trusts. Second, the parent may pass a session token in the frame's address, where the attacker's code can read it. Third, the parent may take messages from the frame and write them straight into the page.
In the real app, which Costa described as a very big casino and sports betting company, the parent sent the player's session token into the game frame. In a demo on an app he built to mirror it, he copied the token into a cookie and took over the account. He had first saved the bug in his notes, then later saw the page being framed. Of it he said: "I had it, I saved it, because it was useless, it's not even in scope."
Why it matters
Our reading: one bug cannot be rated without asking what trusts its origin. Every frame a page embeds, and every secret it hands to that frame, gives a small flaw more to reach. A scope list that excludes a low-value domain may exclude the first link in a chain. A severity score that judges each bug alone can leave many low ratings that add up to a serious hole. Builders can list what they embed and what they send into those frames. Buyers can ask vendors the same.
The other side
The attack has limits. It needs a victim to click on an attacker's site. It also depends on the parent and frame exchanging something useful. Costa called the phishing case the least impactful, and said triage might not accept it.
The technique is also not new. Costa said he found a blog post by researcher Cooper Young describing it, which credited a podcast. He said he found nothing online on impact or fixes. The talk did not say how common this setup is, and did not discuss AI.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- OWASP Foundation: From Out of Scope XSS to Account Takeover The Iframe Sandwich Dinis Costa (2026-10-22)
