[filter-effects-1] Document Clickjacking Attacks

[arichiv]

This formalizes the proposal here: https://chromestatus.com/feature/5117170452398080

[arichiv]

Chrome is currently discussing whether all iframes, or just iframes that are cross-origin with their parent, should have the SVG filter un-applied. Soliciting feedback on that here.

[rebane2001]

From a security perspective, same-origin frames allowing filters would be on-par with how the rest of the restrictions with frames work. The concerns would probably be additional complexity in the case of nested frames, and confusing behavior where filters work on one frame but not another. I personally like the idea of still being able to use filters on my own frames :).

[tabatkins]

Yeah, there's no good reason to disallow filters on same-origin iframes. A same-origin iframe is not remotely a security boundary.