Top 10 winner

Clickjacking / Videojacking

Clickjacking: Web pages can see and hear you

Jeremiah Grossman · blog.jeremiahgrossman.com · 7 October 2008

The disclosure that clickjacking plus Adobe Flash turns any machine with a webcam or microphone into a remote surveillance device on one click, and that clickjacking the Flash Global Security Settings panel makes it persistent. Notes it bypasses CSRF token defences and that framebusting, plugin disabling and NoScript are the only stopgaps.

Record

Document

Clickjacking: Web pages can see and hear you

Researcher

Jeremiah Grossman

Published by

blog.jeremiahgrossman.com

Date

7 October 2008

Topic

Browser

In the archive

• Ranked #4 in the 2008 Top 10 Web Hacking Techniques

Related sources

• Clickjacking webcam demonstration

Tags

• clickjacking
• ui-redress
• flash
• iframe
• csrf
• info-leak
• mitigation
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.