Content Window

ContentWindow fingerprinting analyzes iframe contentWindow objects and cross-origin communication capabilities to detect browser implementation details and security policies. iframes create separate browsing contexts with their own window objects, and how browsers implement these contexts varies significantly. The technique creates same-origin and cross-origin iframes, then enumerates properties and methods on their contentWindow objects, tests property accessibility, measures timing of cross-origin operations, and analyzes security error messages. Different browsers implement Content Security Policy (CSP), Cross-Origin Resource Sharing (CORS), and Same-Origin Policy with subtle variations. For example, Firefox throws specific NS_ERROR_DOM_SECURITY_ERR exceptions while Chrome throws DOMException with different messages. The sandboxed iframe implementation varies: checking for properties blocked by sandbox='allow-scripts' reveals browser security models. Testing window.parent, window.top, window.frames relationships across iframe boundaries exposes browser security enforcement. MessageChannel and postMessage() implementations have timing and serialization differences. Checking for iframe-specific properties like window.frameElement, checking for blocked operations in cross-origin scenarios, and testing navigation between about:blank and data: URIs reveal browser behaviors. Some browsers expose different sets of properties on cross-origin windows versus same-origin windows. The technique also tests for frame busting defenses, X-Frame-Options enforcement, and CSP frame-ancestors implementation. Automated browsers and privacy browsers often have unusual iframe implementations: missing frameElement, altered postMessage behavior, or modified same-origin checks. This fingerprint is stable because security policies are core browser features that rarely change within versions.

• •Iframe capability
• •Sandbox testing
• •API differences