UI redressing

UI redressing attacks can be used to trick a user into performing an action on a legitimate application that is different to what they perceived. The classic example is Clickjacking, that operates by overlaying an invisible iframe over a malicious website. The user thinks they are clicking buttons or other elements on the visible malicious site but are actually clicking buttons in the invisible iframe that perform actions on the target website.

While Clickjacking is generally blocked by default due to modern browser controls, the discovery of DoubleClickjacking has increased the risk of this class of attack again. DoubleClickjacking is not protected against by default and has additionally been shown to be highly effective for performing malicious OAuth consent grants, similar to a consent phishing attack.