We should consider requiring user interaction before allowing a cross-origin iframe to navigate the top window. For example, to prevent stuff like this: https://twitter.com/NateTheFinch/status/933030604844740609 Chrome has been running an intervention to experiment with this and are shipping some kind of mitigation in chrome 64: https://github.com/WICG/interventions/issues/16 If they are successful in shipping that, it might be nice to follow suit.