Clickjacking
Medium · UI Redress
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-1021
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-1021
Definition
Victim UI is framed so clicks hit hidden controls.
Root cause
Missing frame protections.
Affected components
- Components in the “UI Redress” class
- Application / API handlers
- Supporting libraries
Impact
Unintended actions as the user.
Severity
Medium
Safe lab reproduction
In-browser Labs header challenge
Detection methodology
Framing tests.
Evidence examples
- Lab reproduction notes: In-browser Labs header challenge
- Request/response excerpts (redacted)
- Detection signal: Framing tests
Remediation
CSP frame-ancestors / X-Frame-Options.
Secure coding examples
Deny framing by default.
Related CYNARKS lessons & labs
Tools: browser-devtools
Practise related skills in Labs or deepen on Academy library.