Skip to content
Browser internals·Advanced·Conceptual·1 min read

Can a cross-origin iframe read its parent page's DOM?

Short interview answer

Not by default. The same-origin policy blocks that access unless both frames share the exact same origin, or they opt into a narrower communication channel such as postMessage.

Key takeaway

Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.

← Back to Same-origin policy and CORS

Related questions