{
  "slug": "clickjacking",
  "url": "https://library.infinity8labs.com/clickjacking/",
  "title": "Clickjacking",
  "short": "Clickjacking",
  "aliases": [
    "UI redressing",
    "User interface redress attack",
    "Frame overlay attack"
  ],
  "summary": "Clickjacking places a trusted page inside a deceptive frame so the user clicks or types into controls they cannot clearly see. It can turn an ordinary authenticated action into an unintended change.",
  "cwe": [
    "CWE-1021"
  ],
  "owasp": "A04:2021 Insecure Design",
  "typical_severity": {
    "min": "low",
    "max": "high"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
      "url": "https://cwe.mitre.org/data/definitions/1021.html"
    },
    {
      "title": "OWASP Clickjacking Defense Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A04:2021 Insecure Design",
      "url": "https://owasp.org/Top10/A04_2021-Insecure_Design/"
    },
    {
      "title": "PortSwigger Web Security Academy: Clickjacking",
      "url": "https://portswigger.net/web-security/clickjacking"
    },
    {
      "title": "MDN: CSP frame-ancestors",
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/clickjacking/#overview",
    "https://library.infinity8labs.com/clickjacking/#impact",
    "https://library.infinity8labs.com/clickjacking/#examples",
    "https://library.infinity8labs.com/clickjacking/#remediation",
    "https://library.infinity8labs.com/clickjacking/#testing",
    "https://library.infinity8labs.com/clickjacking/#references"
  ]
}