Collected research

Marginwidth/marginheight - the unexpected cross-origin communication channel

@SecurityMB · research.securitum.com · 13 July 2020

The HTML rendering spec lets a framed document take its body margin from the parent frame's marginwidth and marginheight attributes, and browsers honour this across origins. Chromium and Safari reflect the value into the child's body attribute and Firefox exposes it via getComputedStyle, giving a parent a byte-by-byte channel into a cross-origin frame, and here XSS.

Record

Researcher

@SecurityMB

Published by

research.securitum.com

Date

13 July 2020

Topic

Other

In the archive

• Collected in the 2020 research round

Related sources

• Research challenge

Tags

• sop-bypass
• iframe
• xss
• dom
• css
• same-origin-policy
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of @SecurityMB, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 16 August 2026.