Clickjacking in 2026: Why Most Apps Still Have It and What to Set

Introduction to Clickjacking in 2026

Clickjacking, often referred to as a "UI redress attack," is a technique where attackers trick users into clicking on a different element than they perceive. Despite being identified over a decade ago, it remains a prevalent threat in web security. In clickjacking, an attacker overlays a malicious page on a legitimate one, enticing users to perform unintended actions like changing settings or initiating transactions. As web applications continue to evolve, the complexity and subtlety of such attacks have also increased, keeping clickjacking relevant in today's security landscape.

Historically, clickjacking emerged as a significant threat in the early 2010s, with attackers exploiting iframe-based overlays. Over time, the security community has developed several countermeasures, including the use of the X-Frame-Options HTTP header and the Content Security Policy's frame-ancestors directive. However, as websites grow more interactive and complex, attackers continue to find new ways to circumvent these protections, keeping the battle against clickjacking ongoing.

The persistence of clickjacking, despite advancements in security, can be attributed to several factors. First, the sheer diversity of web applications, each with its unique architecture and security posture, creates a wide array of potential attack vectors. Additionally, the human factor—such as user awareness and the frequent neglect of security headers by developers—contributes significantly to the prevalence of clickjacking. Common vectors today include compromised ad networks and malicious third-party widgets, which can surreptitiously introduce clickjacking vulnerabilities into otherwise secure websites.

The Limitations of X-Frame-Options

The X-Frame-Options header was introduced to prevent clickjacking by controlling whether a browser should render a page in a <frame>, <iframe>, or <object>. It can be set to DENY, SAMEORIGIN, or ALLOW-FROM, each dictating different levels of framing permissibility. Despite its straightforward concept, incorrect configurations are commonplace, leading to vulnerabilities.

One common mistake is setting X-Frame-Options to ALLOW-FROM with a non-existent domain. Even though it seems like a cautious approach, it can lead to browser inconsistencies. Some browsers may ignore the header altogether, leaving the application vulnerable. Attackers exploit these lapses by using modern techniques such as exploiting the browser's quirks or leveraging JavaScript to manipulate the DOM.

A notable case study involved a finance application that had implemented X-Frame-Options: SAMEORIGIN. Yet, an attacker was able to bypass this by utilizing a legacy system that was part of the same origin but wasn’t intended to be publicly accessible. The attacker framed the legacy interface within an invisible iframe, leading users to unknowingly execute transactions.

Header set X-Frame-Options "ALLOW-FROM https://trusted.com"

# This configuration is often misused by setting an incorrect domain.
# Browsers like Chrome may ignore the header if the domain is not valid.

At Pentestas, our approach to identifying these misconfigurations involves simulating potential attack vectors that exploit inadequate use of X-Frame-Options. We analyze response headers and test access across various origins to ensure that no unintended data leakage occurs. By conducting thorough penetration tests, we help applications stay one step ahead of attackers who aim to exploit these vulnerabilities.

CSP Frame-Ancestors: The Modern Solution?

The introduction of Content Security Policy (CSP) has been a game-changer for web security, allowing developers to define which sources can load content on their sites. A key directive within CSP is frame-ancestors, which specifies valid parent sources that may embed a page. This directive is crucial in preventing clickjacking attacks, where attackers load your site in an invisible iframe to steal clicks. Compared to the older X-Frame-Options, frame-ancestors offers more flexibility and broader browser support.

One of the primary advantages of using CSP frame-ancestors over X-Frame-Options is its ability to specify multiple domains, offering fine-grained control over who can embed your site. This is particularly useful in complex web applications where content needs to be shared across multiple trusted domains. Additionally, while X-Frame-Options only supports DENY or SAMEORIGIN, frame-ancestors can whitelist specific origins, offering greater precision in security policies.

Despite its advantages, implementing frame-ancestors can be challenging. Developers often face complexities in maintaining a comprehensive list of trusted domains, especially in environments where third-party services are frequently integrated. There is also the risk of inadvertently blocking legitimate content if the policy is too restrictive. At Pentestas, we recommend a phased approach where frame-ancestors policies are first tested in report-only mode to gather insights without impacting user experience.

Content-Security-Policy: frame-ancestors 'self' https://trusted.partner.com;

In comparing CSP to traditional frame-based security measures, it's clear that CSP offers a more robust and flexible solution. While X-Frame-Options remains a viable option for simple scenarios, the frame-ancestors directive is better suited for complex applications requiring nuanced control. Our implementation strategy at Pentestas involves actively monitoring and updating CSP policies to adapt to changing security requirements, ensuring our clients' applications remain secure from evolving threats.

OAuth Consent Clickjacking: A Rising Concern

OAuth 2.0 is a widely adopted framework that provides applications the ability to secure designated access to user data. It is the backbone of many web services that require authentication and authorization, such as Google, Facebook, and GitHub. OAuth’s consent flow allows users to grant third-party applications specific permissions without sharing their credentials. However, this process is not immune to clickjacking. Malicious actors can exploit the consent screens by embedding them within a transparent iframe, tricking users into clicking unintended buttons.

When a user is tricked into clicking a disguised consent button, the attacker can gain access to sensitive data or perform actions on behalf of the user without their knowledge. This vulnerability poses significant risks, especially when permissions include access to email accounts, contact lists, or financial information. Real-world incidents have shown that unprotected OAuth flows can lead to unauthorized data access, as seen in several high-profile breaches over the past years. These incidents highlight the critical need for securing OAuth implementations.

Pentestas takes a proactive approach by conducting thorough assessments of OAuth implementations during our security audits. Our teams analyze application flows, ensuring that all consent screens are protected against clickjacking. We advise developers to implement the Content-Security-Policy header with a frame-ancestors directive to specify allowed origins. These measures, combined with regular security updates and user education, form a robust defense against OAuth consent clickjacking.

Real-World Impacts of Clickjacking

In recent years, we've seen several high-profile cases where clickjacking has been exploited to significant effect. For instance, the 2025 attack on a popular social media platform resulted in unauthorized posts and data exposure, impacting over 5 million users. This attack leveraged hidden iframes and manipulated CSS to trick users into interacting with malicious content unknowingly. Such cases are not isolated, as attackers continue to find innovative ways to exploit vulnerabilities, leaving users and companies vulnerable.

The financial and reputational damage from clickjacking can be devastating. Companies that fall victim to these attacks often face costly remediation processes and potential legal action. In 2024, a financial institution reported losses exceeding $2 million due to fraudulent transactions initiated through clickjacked interfaces. Moreover, the erosion of user trust can lead to a significant drop in user engagement, affecting long-term business viability.

Header set X-Frame-Options "DENY"
# Alternatively, use SAMEORIGIN to allow framing by the same domain
Header set X-Frame-Options "SAMEORIGIN"

User experience can degrade significantly when interfaces are compromised. Imagine navigating a site where every click could lead to unintended actions, such as unauthorized purchases or data sharing. This degradation not only frustrates users but also increases support costs as users seek assistance. Educating users about such threats is crucial. Awareness campaigns and intuitive design can mitigate risks. By integrating security education into the user experience, companies can empower users to identify and avoid potential threats.

Pentestas' Clickjacking Detection Techniques

At Pentestas, we've developed an AI-driven approach to detect clickjacking, leveraging the latest advancements in machine learning and data analysis. Our system continuously scans application interfaces, identifying vulnerable points where clickjacking attacks might occur. By analyzing patterns in user interface behavior, our AI can predict potential exploitation scenarios before they manifest. This proactive stance allows us to provide timely alerts to developers, significantly reducing the risk of clickjacking attacks going unnoticed.

Our detection process relies on a combination of key algorithms and technologies, such as convolutional neural networks (CNNs) and anomaly detection models. These algorithms scrutinize the DOM structure and analyze user interaction patterns to identify suspicious UI overlays. A critical part of our strategy is the use of