DoubleClickjacking Bypasses Frame Protections by Swapping Windows Mid-Double-Click

A December 2024 technique called DoubleClickjacking was published by security researcher Paulos Yibelo, showing that common frame-blocking defenses can be circumvented. The attack avoids embedding a page in a frame, instead opening a top-level window that prompts a victim to double-click. The first click closes the overlaying window, and the second click lands on a sensitive control, such as an OAuth approval button, on the underlying real page. Because the target page loads as a normal top-level page with the victim's session, headers like X-Frame-Options, CSP and SameSite cookies do not block it. The article notes that the attack typically targets screens where a single click carries serious consequences, such as approving an app or confirming a payment.