removed all remote code execution from injected iframes