up to cross-iframe confinement