Also known as "Clickjacking" or "User-interface redress." You can use an iframe to initiate cross-site request forgery easier. Make an iframe pointing to the target website (like amazon or your bank), use a stylesheet to hide most of it behind your own content so users only see the target link you want them to click on, and design your site so it looks like the link in the iFrame is part of your site. You can add some DOM scripting to change the link's appearance so it doesn't even look like the other site.

This is a bug in the Web, not any particular implementation. We can blame Microsoft because iframes were their idea. More links:

• Slashdot comments
• the issue was discussed on BugZilla in 2002