exploit.js: use iframe directly